PRIVACY POLICY

---

This Privacy Policy ("Policy") governs the collection, use, storage, and disclosure of personal information provided by users ("you" or "User") to Cornerstone Capital Int. ("we," "us," or "Company") through our website (the "Website"), email communications, or other interaction channels. This Policy is designed to comply with applicable U.S. privacy laws, including but not limited to state-specific statutes such as the CCPA and Virginia Consumer Data Protection Act (VCDPA).  

By accessing or using the Website or voluntarily submitting personal information to us, you: 

• Acknowledge that you have read, understood, and agreed to the terms of this Policy; 
• Consent to the processing of your personal information as described herein.

If you do not agree with this Policy, you must immediately discontinue use of the Website and refrain from providing any personal information to Cornerstone Capital Int. 

We reserve the right to modify this Policy at any time. Material changes will be communicated via prominent notice on the Website or direct notification (where required by law). Continued use after such updates constitutes acceptance of the revised terms.  

You maintain the following rights regarding your Personal Data, which we will facilitate upon verifiable request:

1. Right to Withdraw Consent - You may revoke previously given consent at any time, without affecting the lawfulness of processing based on consent before withdrawal.
2. Right to Lodge Complaints - You have the right to file a complaint with your local Data Protection Authority.
3. Right of Access - You may request confirmation of whether we process your Personal Data and obtain a copy.
4. Right to Rectification - You may update or correct inaccurate or incomplete Personal Data.
5. Right to Erasure ("Right to Be Forgotten") - You may request deletion of your Personal Data under certain conditions.
6. Right to Restriction of Processing - You may limit how we use your data in specific circumstances.
7. Right to Data Portability - You may receive your data in a structured format or request direct transfer to another controller where technically feasible.
8. Right to Object - You may object to processing based on legitimate interests, including direct marketing.
9. Rights Regarding Automated Decision-Making - You may request human intervention, express your viewpoint, and contest automated decisions producing legal or similarly significant effects. 

Your Personal Data benefits from dual protection: both through Cornerstone Capital's rigorous security standards and through enforceable legal rights. Under applicable data protection laws, we only process your information when at least one of these lawful bases applies:

1. Contractual Necessity - To execute or prepare agreements with you
2. Legal Compliance - To meet our statutory obligations
3. Consent - When you've given explicit permission
4. Legitimate Interests - For our justified business needs, balanced against your rights
5. Public Interest - For official functions or tasks
6. Vital Interests - To protect someone's life

Should you believe we haven't upheld our data protection commitments, please immediately contact our Privacy Team: csc-international@proton.me

1. We may process your Personal Data based on legitimate business interests, which represents a lawful basis under data protection regulations. This occurs when we have a justified need to process your information, provided that:

• Such processing is necessary for our business operations
• It does not override your fundamental rights and freedoms
• We conduct a formal balancing test to ensure fairness 

2. When relying on legitimate interest, we will:

• Clearly disclose this basis for processing
• Specify the particular interests involved
• Provide you with straightforward objection mechanisms

Note: In exceptional cases, our compelling legitimate grounds for processing may take precedence if they demonstrably outweigh your interests. You may always request information about our balancing test through our Data Protection Officer. 

1. We shall retain your personal data only for as long as necessary, ensuring it remains protected and used solely for legitimate purposes as outlined in this Policy.

2. Your data will be maintained throughout your active client relationship with Cornerstone.

3. Following termination of your client status, we will retain your data for the minimum statutory period required - being at least 10 years under Congolese regulations - to comply with our legal and regulatory obligations.

4. Please note that regarding third-party data processors:

• We will make reasonable efforts to facilitate deletion requests on your behalf.
• The timely execution of such requests depends entirely on the third party's processes.
• We cannot guarantee or be held responsible for delays in third-party compliance

5. In exceptional circumstances, we may retain data for extended periods when:

• Technical constraints prevent deletion
• Required for legal claims or investigations
• Necessary to comply with ongoing regulatory requirements

1. The provision of your personal data is necessary for us to:

• Comply with our legal and regulatory obligations;
• Perform contractual agreements with you; and
• Maintain the proper operation of your account and our services.

2. Should you choose not to provide required personal data:

• We may be unable to enter into or continue a contractual relationship with you;
• Certain account services may become unavailable; and
• Our ability to fulfil legal requirements may be compromised.

3. We shall always inform you when specific data elements are mandatory versus optional, explaining the consequences of non-provision in each case.

We may disclose your personal data to the following categories of recipients where necessary:

1. Government authorities, including law enforcement agencies, regulatory bodies, and other official entities;

2. Credit reference agencies for identity and credit verification purposes;

3. Fraud prevention agencies to mitigate financial crime risks;

4. Identity verification service providers to comply with anti-money laundering (AML) regulations;

5. Tax authorities and financial governing bodies as required by law;

6. Introducing brokers or intermediaries who facilitated your relationship with us;

7. Third parties with your explicit consent or at your direction;

8. Service providers essential to deliver products/services you’ve requested (e.g., payment processors, IT vendors).

The specific third parties with whom we share your data will depend on the products or services you utilise, and we will only disclose information strictly necessary for those purposes. Additionally, we may share personal data with:

• Affiliated or subsidiary companies within our corporate group;
• Business partners under strict confidentiality agreements;
• Successors in title in the event of a business merger, acquisition, or restructuring