Privacy Policy

• Contact information and personal identifiers — full name, email address, phone number, mailing address, date of birth, government-issued identification numbers (e.g., Social Security number, ITIN, EIN), and username.
• Financial and commercial information — bank account details, transaction history, account balances, ownership information, and business revenue or funding details.
• Professional or employment information — company name, job title, company affiliation, ownership percentage, and business role.
• Identity verification data — government-issued identity documents, biometric identifiers (including facial scans or voiceprints used to verify your identity), and information extracted from photographs you submit.
• Demographic information — age, citizenship, jurisdiction of incorporation, and related business structure details.
• Internet and electronic network activity — browser characteristics, device IDs, operating system version, language preferences, referring URLs, and information about your actions on our platform (e.g., page views, clicks, searches).
• Geolocation data — approximate location derived from IP address.
• Inferences — profiles drawn from any of the above to reflect preferences, risk characteristics, behavior, or aptitudes relevant to account management and compliance.
• Audio and/or video recordings — recordings of calls made for onboarding, support, or compliance verification purposes.
• Sensitive Personal Information — under applicable law, certain data we collect may be classified as sensitive, including government-issued identifiers, financial account numbers, and account login credentials. We use and share such information only as permitted by law.
• Other information you choose to provide — information included in messages you send us, responses to surveys, or submissions in connection with any account inquiry.

If you use Hollis & Co for business purposes, we may process Personal Information about individuals connected to your business, including employees, contractors, authorized users, vendors, and counterparties. We collect this information when you provide it directly or when it is transmitted through integrations you authorize.

Where we process Personal Information on behalf of a business customer, we do so in accordance with your instructions and applicable law.

Information you provide when you apply for or open an account, use our Services, communicate with our team, enable integrations, or refer others to Hollis & Co.

We collect information automatically through cookies, device identifiers, log files, and similar technologies when you access or use our platform.

• Banking partners and service providers — including Column N.A. and identity verification, fraud prevention, and financial services companies.
• Credit bureaus and agencies — to obtain consumer and commercial credit information where necessary.
• Marketing and analytics partners — including data providers, referral partners, and advertising networks.
• Publicly available sources — corporate registries, government databases, and other publicly accessible information.

We use artificial intelligence and machine learning technologies to enhance security, streamline operations, and improve your experience. This includes using AI for fraud detection, identity verification, transaction monitoring, and platform improvement.

Hollis & Co may offer AI-assisted features — such as account summaries, compliance flagging, or treasury analysis — that process your financial data. Because machine learning systems learn from the data they process, you should avoid entering Personal Information into AI prompts that you do not want used for improvement or training purposes.

Essential Cookies are required for the platform to function. They enable secure login, fraud prevention, account session management, and core features. Without these, parts of the Services will not work.

Analytic and Performance Cookies help us understand how the platform is used so we can improve it. We may use third-party analytics providers such as Google Analytics. To opt out of Google Analytics, visit Google's opt-out tool.

Functional Cookies remember your preferences and settings so your experience remains consistent across sessions.

Advertising Cookies may be used to measure the effectiveness of communications and to show Hollis & Co content on third-party platforms. Under certain U.S. privacy laws, use of these technologies may constitute "sharing" of Personal Information. You may opt out through your browser settings, device-level privacy settings, or industry opt-out programs such as the Network Advertising Initiative or the Digital Advertising Alliance.

Because there is no consistent industry standard for how services should respond to Do Not Track signals, we do not currently respond to them. Where required by applicable law, we honor legally recognized opt-out preference signals such as the Global Privacy Control ("GPC").

Our Services may contain links to third-party websites or services. Those parties operate independently with their own privacy practices. We are not responsible for their privacy practices and encourage you to review their policies.

• Account Information. You may update certain profile information through your account settings.
• Marketing Communications. You may opt out of promotional emails at any time by clicking "unsubscribe." You will continue to receive transactional and account-related messages.
• Device Permissions. You may control platform access to mobile device features through your device settings.

If you are located in a jurisdiction with applicable privacy laws, you may have the following rights:

• Right to Know / Access — request the categories and specific pieces of Personal Information we have collected about you, sources, purposes, and third parties with whom it was shared.
• Right to Correct — request correction of inaccurate Personal Information.
• Right to Delete — request deletion of your Personal Information, subject to exceptions (e.g., where retention is required by law or to complete a transaction).
• Right to Restrict or Object — in certain circumstances, object to or request restriction of specific processing.
• Right to Opt Out of Sale or Sharing — you may have the right to opt out of the "sale" or "sharing" of Personal Information as defined under applicable law.
• Right to Non-Discrimination — we will not discriminate against you for exercising privacy rights.
• Right to Appeal — if we deny your request, you may have the right to appeal our decision depending on your jurisdiction.

Please note that certain consumer privacy rights (such as those under the California Consumer Privacy Act) may not apply to Personal Information processed in a business-to-business context, or to information governed by the GLBA.

To submit a privacy request, contact us at privacy@hollisand.co. To protect your information, we will verify your identity before fulfilling your request. We will respond within the timeframe required by applicable law.

In some jurisdictions, you may designate an authorized agent to submit requests on your behalf. We may require written authorization, proof of the agent's identity, and independent verification of your identity. If we cannot verify both, we may deny the request.

If you are located in the European Economic Area (EEA) or the United Kingdom, your Personal Information is protected under the EU General Data Protection Regulation ("GDPR") and, in the UK, the UK GDPR as incorporated into domestic law by the Data Protection Act 2018.

Legal basis for processing. Where GDPR or UK GDPR applies to our processing of your Personal Information, we rely on the following legal bases:

• Contract performance — processing necessary to open and operate your account and provide the Services you requested.
• Legal obligation — processing required to comply with applicable laws and regulations, including AML/KYC obligations administered through Column N.A.
• Legitimate interests — processing for fraud prevention, security, platform improvement, and communications, where not overridden by your interests or rights.
• Consent — where we rely on consent (e.g., certain marketing communications), you may withdraw it at any time without affecting prior processing.

Your GDPR / UK GDPR rights. In addition to the rights listed in Section 9.2, EEA and UK residents have the right to data portability (receive a copy of your data in a structured, machine-readable format) and the right to object to processing based on legitimate interests. To exercise any of these rights, contact privacy@hollisand.co.

Supervisory authority complaints. If you believe we have not complied with applicable data protection law, you have the right to lodge a complaint with your local supervisory authority. UK residents may contact the Information Commissioner's Office (ICO). A list of EU supervisory authorities is available from the European Data Protection Board.

Canadian residents may file a complaint with the Office of the Privacy Commissioner of Canada or the applicable provincial privacy authority.