Legacy Circle Privacy Policy

Effective date: [INSERT DATE]
Version: [INSERT VERSION NUMBER]

1. Who We Are

This Privacy Policy explains how Velvet Group Limited, trading as Velvet Society, collects, uses, stores and discloses personal information.

Velvet Group Limited
Company number: [INSERT]
NZBN: [INSERT]
Registered office: [INSERT]

Velvet Group Limited is the membership Provider.

Relevant Velvet Society, Legacy Circle and Eros intellectual property is owned by or licensed through:

Luxe IP Holdings Limited
Company number: [INSERT]
NZBN: [INSERT]

References to Velvet, Velvet Society, we, us or our mean Velvet Group Limited and authorised service providers acting on its behalf.

2. Scope

This Policy applies to personal information collected through:

- The Velvet Society website.
- The Legacy Circle application.
- The private Portal.
- Membership onboarding.
- Events.
- Consultations.
- Email, telephone and messaging.
- Payment systems.
- Financial-capacity verification.
- Partner-benefit administration.
- Guest applications.
- Capital-raise expressions of interest.
- Other authorised Velvet services.

3. Information We May Collect

We may collect:

Identity Information

- Legal name.
- Preferred name.
- Date of birth.
- Age confirmation.
- Photograph.
- Identification documents.
- Signature.
- Membership number.

Contact Information

- Email address.
- Telephone number.
- Postal address.
- City and country.
- Preferred contact method.

Application Information

- Occupation.
- Employer.
- Business interests.
- Professional background.
- Referral information.
- Relationship with Velvet or Eros.
- Reasons for applying.
- Membership Tier of interest.
- Personal statement.
- References.
- Reputation and suitability information.

Financial-Capacity Information

- Approximate income range.
- Approximate net-asset range.
- Approximate liquid-asset range.
- Source of membership funds.
- Intended purchaser.
- Whether borrowing is proposed.
- Accountant, lawyer or adviser confirmation.
- Bank or investment confirmation.
- Company or trust information.
- Other verification information.

We encourage applicants to redact irrelevant account numbers, transaction histories and unrelated personal information.

Payment Information

- Amount paid.
- Payment date.
- Payment method.
- Billing address.
- Payment status.
- Refund information.
- Limited transaction references.

Full payment-card details will ordinarily be processed by an authorised payment provider rather than stored by Velvet.

Membership Information

- Membership Tier.
- Membership status.
- Benefits used.
- Guest allocations.
- Event bookings.
- Concierge requests.
- Partner benefits.
- Founder-card and ring details.
- Recognition preferences.
- Complaints.
- Conduct or safety information.

Portal and Technical Information

- Login dates.
- IP address.
- Device information.
- Browser information.
- Session data.
- Password-reset activity.
- Access history.
- Documents viewed.
- Acceptance records.
- Security alerts.
- Cookies and analytics information.

Communication Information

- Emails.
- Messages.
- Telephone notes.
- Consultation records.
- Feedback.
- Survey responses.
- Marketing preferences.

Event Information

- Attendance.
- Guest information.
- Dietary or accessibility requirements.
- Safety incidents.
- Venue restrictions.
- Photographic consent.
- Behavioural or conduct concerns.

Information revealing highly personal matters will be handled with additional care.

4. How We Collect Information

We may collect information:

- Directly from you.
- From an authorised representative.
- From a referring member.
- From a company or trust purchasing membership.
- From professional advisers.
- From payment providers.
- From event or hospitality Partners.
- From identity-verification providers.
- From publicly available business or professional sources.
- From authorised security and fraud-prevention systems.

Where we collect personal information from another source, we will take reasonable steps to notify you where required and appropriate.

5. Why We Collect Information

We may use personal information to:

- Assess an application.
- Verify identity.
- Verify age.
- Assess membership suitability.
- Assess financial capacity.
- Confirm source of funds.
- Prevent fraud.
- Protect members and staff.
- Grant or manage Portal access.
- Administer membership.
- Process payments.
- Issue cards, rings and gifts.
- Manage benefits.
- Manage guest access.
- Coordinate events.
- Provide concierge support.
- Communicate with members.
- Manage complaints.
- Enforce membership terms.
- Protect Confidential Information.
- Protect intellectual property.
- Maintain security.
- Meet accounting, tax and legal obligations.
- Manage future expressions of interest.
- Improve Velvet services.
- Send authorised marketing.
- Conduct internal reporting.

6. Information Required for an Application

Some information is optional.

However, if an applicant does not provide information reasonably required to assess the application, Velvet may be unable to:

- Verify identity.
- Assess suitability.
- Approve the requested Tier.
- Confirm financial capacity.
- Grant Portal access.
- Complete membership.
- Process a payment.
- Provide a particular benefit.

7. Financial Information

Financial information is collected only where reasonably required for:

- Membership-capacity assessment.
- Payment verification.
- Fraud prevention.
- Source-of-funds review.
- Risk management.
- Future investor expressions of interest.
- Compliance with applicable legal requirements.

Membership financial screening does not certify a person as:

- A wholesale investor.
- An eligible investor.
- A suitable investor.
- Approved for a later financial offer.

A separate assessment will be required for any future investment opportunity.

8. Who May Access Information

Personal information may be accessed by:

- Authorised Velvet staff.
- Authorised directors and officers.
- Approved membership administrators.
- Approved technology providers.
- Secure website and hosting providers.
- Payment processors.
- Identity-verification providers.
- Accountants.
- Auditors.
- Lawyers.
- Insurers.
- Security advisers.
- Event and hospitality Partners where necessary.
- Luxe IP Holdings Limited where necessary to protect intellectual property.
- A Related Entity administering an approved benefit.
- Government or regulatory authorities where required by law.

We do not sell applicants’ or members’ personal information to advertisers.

9. Partner Disclosure

We may disclose limited information to a Partner where necessary to arrange:

- Event access.
- Accommodation.
- Transport.
- Hospitality.
- Concierge services.
- Guest benefits.
- A founder gift.
- Another requested benefit.

We will seek to disclose only information reasonably necessary for that purpose.

Partners may have their own privacy policies.

10. Overseas Providers

Some technology, communications, payment, storage or Partner services may operate outside New Zealand.

Where personal information is disclosed overseas, we will take reasonable steps required by applicable privacy law to ensure appropriate protection.

We may also use a service provider that stores or processes information overseas while acting on our behalf.

11. Cookies and Analytics

Our websites and Portal may use:

- Essential cookies.
- Authentication cookies.
- Security cookies.
- Preference cookies.
- Analytics tools.
- Performance tools.
- Advertising or campaign-measurement tools, where enabled.

Essential cookies may be required for:

- Portal login.
- Security.
- Session management.
- Form submission.
- Fraud prevention.

Non-essential cookies should be activated only in accordance with the website’s cookie settings and applicable requirements.

Users may manage cookies through:

- The website cookie controls.
- Their browser settings.
- Device settings.

Disabling some cookies may affect website functionality.

12. Marketing Communications

With consent or where otherwise permitted, we may send:

- Membership information.
- Event invitations.
- Partner offers.
- Founder updates.
- Velvet news.
- Application follow-ups.
- Commercial communications.

Marketing messages will identify the sender and provide an unsubscribe method.

Unsubscribing from marketing will not prevent necessary:

- Contract communications.
- Payment notices.
- Safety notices.
- Privacy notices.
- Membership administration.
- Event information for an existing booking.

13. Security

We use reasonable safeguards appropriate to the sensitivity of the information, which may include:

- Access restrictions.
- Multi-factor authentication.
- Encryption.
- Secure hosting.
- Password controls.
- Staff confidentiality.
- Activity logging.
- Secure document transfer.
- Backup procedures.
- Provider due diligence.
- Incident-response procedures.

No internet or storage system can be guaranteed completely secure.

Applicants should not send sensitive financial documents by ordinary email unless expressly instructed.

14. Portal Security

Portal credentials are personal.

Users must:

- Keep passwords confidential.
- Use a strong unique password.
- Enable multi-factor authentication where available.
- Log out from shared devices.
- Notify Velvet of suspected compromise.
- Avoid sharing Portal materials.

Velvet may suspend access where unusual or unauthorised activity is detected.

15. Privacy Breaches

If a privacy incident occurs, Velvet will:

- Investigate.
- Contain the incident where possible.
- Assess potential harm.
- Take remedial action.
- Notify affected people and the Privacy Commissioner where required.
- Review safeguards.

16. Retention

We retain personal information only for as long as reasonably required for the purpose for which it was collected or as required by law.

Indicative retention periods are:

Unsuccessful Preliminary Applications

- [SELECT: 90 / 180] days after final decision, unless:
  - A complaint remains open.
  - Legal retention is required.
  - The applicant consents to future contact.
  - Fraud or safety concerns justify longer retention.

Withdrawn Applications

- [SELECT: 90 / 180] days after withdrawal.

Approved Applicants Who Do Not Purchase

- [SELECT: 12 / 24] months, subject to consent and operational requirements.

Current Members

- For the membership period and for a reasonable period afterwards.

Payment and Accounting Records

- For the period required by tax, accounting and legal obligations.

Financial Verification Documents

- Only for as long as reasonably necessary.
- Where practical, Velvet may record the verification outcome and securely delete underlying documents.

Security and Portal Logs

- [INSERT RETENTION PERIOD], unless longer retention is reasonably required for investigation.

Information may be securely deleted, anonymised or aggregated when no longer required.

17. Access and Correction

A person may request:

- Confirmation that Velvet holds their personal information.
- Access to their information.
- Correction of inaccurate information.
- A statement of correction where applicable.

Requests should be sent to:

Privacy Officer
Email: [INSERT]
Postal address: [INSERT]

Velvet may need to verify identity before responding.

Access may be limited where permitted or required by law.

18. Updating Information

Applicants and members must keep relevant information accurate.

They should notify Velvet of changes to:

- Contact details.
- Legal name.
- Payment details.
- Recognition preferences.
- Security concerns.
- Authorised representatives.
- Other material membership information.

19. Information About Other People

A person providing information about another individual must:

- Have authority to provide it.
- Ensure it is accurate.
- Inform the person where appropriate.
- Avoid providing unnecessary sensitive information.

This applies particularly to:

- Guests.
- Referees.
- Partners.
- Company representatives.
- Trust beneficiaries or trustees.

20. Photographs and Media

Velvet may take photographs or video at events.

Where practical:

- Event photography will be disclosed.
- Members may state privacy preferences.
- Express consent will be sought for identifiable promotional features, testimonials or personal founder stories.

A person may ask Velvet not to use an identifiable image of them for future promotional purposes, subject to lawful uses and materials already printed or published.

21. Automated Screening

Velvet may use digital systems to assist with:

- Fraud detection.
- Security.
- Duplicate applications.
- Portal-risk detection.
- Identity verification.

Velvet will not rely solely on automated processing to make a materially adverse membership decision where human review is reasonably required.

22. Children and Minors

The Legacy Circle is intended for adults aged 18 and over.

We do not knowingly accept applications from minors.

23. Changes to This Policy

We may update this Privacy Policy.

Material changes will be published with:

- A new effective date.
- A version number.
- Notice through email or the Portal where appropriate.

24. Privacy Complaints

Privacy concerns should first be sent to the Privacy Officer.

Privacy Officer: [INSERT NAME OR POSITION]
Email: [INSERT]
Telephone: [INSERT]
Postal address: [INSERT]

We will aim to acknowledge a privacy complaint within [INSERT] business days.

A person may also complain to the New Zealand Office of the Privacy Commissioner.

25. Application Collection Notice

The following notice should appear directly above the application form:

Why We Are Collecting Your Information

Velvet Group Limited trading as Velvet Society collects the information in this application to:

- Assess your Legacy Circle application.
- Verify your identity and age.
- Assess membership and financial suitability.
- Communicate with you.
- Protect Velvet’s community and intellectual property.
- Administer approved Portal access and membership.
- Meet legal and operational requirements.

Information may be shared with authorised service providers and professional advisers where reasonably necessary.

Providing required information is voluntary, but Velvet may be unable to assess or approve an application without it.

You may request access to or correction of your personal information by contacting:

[INSERT PRIVACY EMAIL]

Application Privacy Checkboxes

- I have read the Legacy Circle Privacy Policy.
- I understand why my information is being collected.
- I confirm that the information I have supplied is accurate.
- I consent to Velvet contacting me regarding my application.
- I understand that application approval is not guaranteed.
- I consent to receive marketing communications. [OPTIONAL — MUST NOT BE PRE-TICKED]