Privacy Policy

1. Introduction

Marcellus Bullion ("we", "our", "us"), a trading name of Marcellus Capital Group Limited (Company Number: [XXXXXXXX]), is committed to protecting and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website, services, or communicate with us. By using our services, you acknowledge that you have read and understood this policy.

2. Data Controller

Marcellus Capital Group Limited is the data controller responsible for your personal data. If you have any questions about this Privacy Policy or our data practices, please contact us at:

3. Information We Collect

We may collect and process the following categories of personal data:

• Identity Data: Full name, date of birth, nationality, government-issued identification documents
• Contact Data: Email address, telephone numbers, postal address
• Financial Data: Bank account details, payment information, source of funds documentation
• Transaction Data: Details of purchases, sales, storage arrangements, and payment history
• Technical Data: IP address, browser type, device information, cookies, and usage data
• Profile Data: Investment preferences, communication preferences, feedback
• KYC/AML Data: Information required for regulatory compliance including proof of identity and address

4. Legal Basis for Processing

We process your personal data on the following legal grounds under UK GDPR:

• Contract: Processing necessary for the performance of a contract with you
• Legal Obligation: Processing necessary to comply with AML regulations, tax laws, and other legal requirements
• Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention and service improvement
• Consent: Where you have given explicit consent for marketing communications

5. How We Use Your Data

We use your personal data to:

• Process and fulfil your orders for precious metals
• Provide secure storage services and account management
• Conduct identity verification and anti-money laundering checks
• Communicate with you about your account, orders, and our services
• Comply with legal and regulatory obligations
• Detect and prevent fraud and other criminal activity
• Improve our website, products, and services
• Send marketing communications (with your consent)

6. Data Sharing

We may share your personal data with:

• Service Providers: Vault operators, payment processors, courier services
• Regulatory Bodies: HMRC, FCA, law enforcement agencies as required by law
• Professional Advisors: Lawyers, accountants, auditors
• Identity Verification Services: Third-party KYC/AML providers

We require all third parties to respect the security of your personal data and treat it in accordance with the law. We do not sell your personal data to third parties.

7. International Transfers

Your personal data may be transferred to, and processed in, countries outside the United Kingdom, including Switzerland and Singapore where our vault facilities are located. We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO).

8. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. For AML purposes, we are required to retain records for a minimum of 5 years after the end of our business relationship.

9. Your Rights

Under UK GDPR, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Restrict Processing: Request limitation of processing
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interests or for marketing
• Right to Withdraw Consent: Where processing is based on consent

To exercise any of these rights, please contact our Data Protection Officer. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. This includes encryption, access controls, and regular security assessments.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our website and, where appropriate, by email. Your continued use of our services after such changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at: