Privacy Policy

1. Information We Collect

Cabot Wealth Management Inc ("Cabot Wealth," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes the types of information we collect, how we use and protect that information, and the choices you have regarding our use of your data. This policy applies to all clients, prospective clients, website visitors, and other individuals who interact with our services.

Personal Information

When you engage with our services, visit our website, or communicate with us, we may collect the following personal information:

• Identification Data: Full legal name, date of birth, Social Security number or taxpayer identification number, government-issued identification numbers, citizenship and residency status.
• Contact Information: Mailing address, email address, telephone numbers (home, mobile, and business), and preferred method of contact.
• Employment Information: Employer name and address, occupation, job title, employment status, and income details.
• Account Credentials: Username, password, and security questions when you create an account on our client portal or other digital platforms.

Financial Information

As an SEC-registered investment advisory firm, we collect and maintain detailed financial information necessary to provide our services, including:

• Asset and Liability Data: Bank and brokerage account statements, retirement account balances, real estate holdings, business interests, outstanding debts, mortgages, and other liabilities.
• Income and Expense Information: Salary and wage records, investment income, rental income, business revenue, tax returns, and regular expense summaries.
• Insurance and Estate Planning Documents: Existing insurance policies, wills, trusts, powers of attorney, and beneficiary designations.
• Investment Preferences: Risk tolerance assessments, investment objectives, time horizons, liquidity needs, and any restrictions or preferences regarding specific investments or industries.
• Transaction Records: Purchase and sale confirmations, account transfer records, dividend and interest payment records, and fee schedules.

Usage Data

When you visit our website or use our digital platforms, we automatically collect certain information about your device and browsing activity:

• Device Information: IP address, browser type and version, operating system, device type and manufacturer, and screen resolution.
• Usage Patterns: Pages visited, time spent on each page, navigation paths, referring URLs, search terms used within our site, and click patterns.
• Access Times: Date and time of visits, time zone, and frequency of visits.
• Interaction Data: Forms started but not submitted, features used, documents downloaded, and links clicked.

Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar tracking technologies to enhance your browsing experience, analyze site traffic, and understand user preferences. For detailed information, please see Section 6 — Cookie Policy below.

2. How We Use Your Information

We use the information we collect for the following purposes:

Provision of Advisory Services

• Creating and maintaining your client profile and investment policy statement.
• Developing personalized financial plans and investment recommendations tailored to your goals, risk tolerance, and financial circumstances.
• Executing and managing investment transactions on your behalf in accordance with your advisory agreement.
• Monitoring portfolio performance and rebalancing assets as needed to maintain alignment with your stated objectives.
• Preparing required regulatory reports, account statements, and tax documentation.

Communication and Relationship Management

• Responding to your inquiries, requests, and communications in a timely manner.
• Sending account updates, performance reports, market commentary, and regulatory notices required by law.
• Distributing our newsletter, insights, and educational materials (only with your prior consent).
• Scheduling and confirming consultations, meetings, and portfolio review sessions.
• Notifying you of changes to our services, policies, or terms that may affect your account.

Compliance and Legal Obligations

• Fulfilling our obligations as an SEC-registered investment adviser under the Investment Advisers Act of 1940 and related regulations.
• Complying with anti-money laundering (AML) and know-your-customer (KYC) requirements under the Bank Secrecy Act and USA PATRIOT Act.
• Responding to lawful requests from regulatory bodies, including the Securities and Exchange Commission, state securities regulators, and the Financial Industry Regulatory Authority (FINRA).
• Maintaining records as required by Rule 204-2 under the Investment Advisers Act (the "Books and Records Rule").
• Defending against legal claims and participating in legal proceedings where required.

Operational Improvement

• Analyzing website usage patterns to improve user experience, site navigation, and content relevance.
• Detecting, preventing, and investigating security incidents, fraud, and unauthorized access to our systems.
• Testing and deploying new features, services, and technologies to enhance our digital platforms.
• Conducting internal research, analytics, and quality assurance to refine our advisory processes.

3. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We may share your information only in the following circumstances:

Service Providers and Third Parties

We share information with trusted third-party service providers who perform functions on our behalf, including:

• Custodians and Clearing Firms: To hold and safeguard your assets, execute trades, and generate account statements (e.g., Charles Schwab, Fidelity, or other qualified custodians).
• Technology Providers: To host our website, client portal, portfolio management software, and customer relationship management systems.
• Financial Data Aggregators: To import and consolidate your financial account information for comprehensive planning.
• Professional Advisors: Attorneys, auditors, and consultants who assist us in maintaining compliance and improving our services.
• Email and Communication Platforms: To deliver newsletters, notifications, and client communications.

All service providers are bound by contractual obligations to protect your information and use it solely for the purposes for which it was shared.

Legal and Regulatory Requirements

We may disclose your information when required by law, regulation, or legal process, including:

• In response to a subpoena, court order, or regulatory examination.
• To comply with SEC, FINRA, state securities commission, or FSCA (South Africa) requirements.
• To verify your identity as part of anti-money laundering or counter-terrorism financing obligations.
• To report suspicious activity as required by the Bank Secrecy Act.
• To protect our rights, property, or safety, or that of our clients, employees, or the public.

Affiliates and Branch Offices

We may share information with our South Africa branch office located at 5th St, Sandown, Sandton, 2031, South Africa, for the purpose of providing coordinated advisory services to international clients. Such transfers are conducted in compliance with applicable data protection laws, including the South African Protection of Personal Information Act (POPIA).

Business Transitions

In the event of a merger, acquisition, reorganization, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.

4. Data Security Measures

We implement comprehensive administrative, technical, and physical safeguards to protect your personal and financial information against unauthorized access, alteration, disclosure, or destruction:

Technical Safeguards

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher with 256-bit SSL certificates. Sensitive data at rest is encrypted using AES-256 encryption standards.
• Access Controls: Role-based access controls restrict employee access to client information on a strict need-to-know basis. Multi-factor authentication is required for all staff accessing client records.
• Network Security: Enterprise-grade firewalls, intrusion detection and prevention systems, and regular vulnerability scanning protect our network infrastructure.
• Application Security: Our web applications undergo regular penetration testing and code reviews to identify and remediate security vulnerabilities.

Administrative Safeguards

• Employee Training: All employees receive annual training on data privacy, information security, and regulatory compliance, including the SEC's Regulation S-P (Standards for Safeguarding Customer Information).
• Incident Response: We maintain a documented incident response plan that outlines procedures for detecting, containing, and reporting data breaches in accordance with applicable notification laws.
• Vendor Management: Third-party service providers are subject to due diligence reviews and contractual requirements to maintain appropriate security standards.
• Information Security Program: We maintain a written information security program (WISP) as required by Massachusetts data privacy regulations (201 CMR 17.00) and SEC Regulation S-ID.

Physical Safeguards

• Physical access to our offices and data centers is restricted via keycard entry systems and visitor logs.
• Paper records containing sensitive information are stored in locked cabinets and shredded when no longer needed.
• Surveillance systems monitor physical access points to areas where client data is stored or processed.

Despite our best efforts, no method of electronic transmission or storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security. If you have reason to believe that your information has been compromised, please contact us immediately using the information provided in Section 12.

5. Your Rights

You have the following rights regarding your personal information:

Right of Access

You have the right to request a copy of the personal information we hold about you. Upon verified request, we will provide you with a summary of the data collected, the purposes for which it is used, and the third parties with whom it has been shared. We will respond to such requests within 30 days.

Right of Correction

You have the right to request correction of any inaccurate or incomplete personal information we hold about you. You may update your contact information and certain profile details directly through our client portal or by contacting your dedicated advisor.

Right of Deletion

You may request the deletion of your personal information, subject to our legal and regulatory obligations. As an SEC-registered investment adviser, we are required to maintain certain records for specified periods under Rule 204-2 of the Investment Advisers Act. Where deletion is not required to be retained by law, we will honor your request within 30 days.

Right to Opt Out

You may opt out of receiving marketing communications from us at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email.
• Contacting us directly at support@cabotwealthmgtinc.com.
• Calling our office at +1 (978) 745-1700.

Please note that even if you opt out of marketing communications, we will continue to send account-related and regulatory notices as required by law.

Right to Data Portability

Where technically feasible, you may request to receive your personal data in a structured, commonly used, and machine-readable format (such as CSV or JSON), or to have that data transmitted directly to another service provider.

Exercising Your Rights

To exercise any of these rights, please submit a written request to our Chief Compliance Officer at the contact information provided in Section 12. We may require verification of your identity before processing your request. We will respond to all legitimate requests within 30 days of receipt, or within 60 days if the request is particularly complex.

6. Cookie Policy

Our website uses cookies and similar tracking technologies to enhance your browsing experience and analyze usage patterns. A cookie is a small text file placed on your device when you visit our website.

Types of Cookies We Use

• Strictly Necessary Cookies: These cookies are essential for the website to function properly, including session management, security features, and load balancing. They cannot be disabled.
• Performance and Analytics Cookies: These cookies collect information about how visitors use our website, such as which pages are most visited and whether users encounter error messages. We use this information solely to improve website performance and user experience. All analytics data is aggregated and anonymized.
• Functionality Cookies: These cookies allow the website to remember choices you make (such as your preferred language, region, or display settings) and provide enhanced, personalized features.
• Marketing Cookies: With your consent, we may use marketing cookies to deliver relevant advertisements and track the effectiveness of our marketing campaigns across websites and devices.

How to Manage Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to:

• View and delete existing cookies.
• Block cookies from specific sites or all sites.
• Set preferences for certain types of cookies.
• Configure your browser to notify you when a cookie is being set.

Please note that disabling certain cookies may affect the functionality of our website and limit your ability to use some features. For more information on managing cookies in popular browsers, visit the help pages of your respective browser.

7. California Privacy Rights (CCPA)

The California Consumer Privacy Act (CCPA) grants California residents specific rights regarding their personal information. If you are a California resident, you have the following additional rights:

Right to Know

You have the right to request, up to twice per year, the following information about how we have collected, used, and shared your personal information in the preceding 12 months:

• The categories of personal information we have collected.
• The specific pieces of personal information we have collected about you.
• The categories of sources from which we collected your information.
• The business or commercial purposes for collecting or selling your information.
• The categories of third parties with whom we shared your information.

Right to Delete

You have the right to request that we delete any personal information we have collected from you, subject to certain exceptions required by law (including our regulatory record-keeping obligations as an SEC-registered adviser).

Right to Opt Out of Sale

We do not sell your personal information. Under the CCPA, "sale" refers to the collection of personal information from consumers for the purpose of creating advertising and communications based on consumer behavior across different websites. Because we do not engage in this practice, there is no need for you to exercise an opt-out right. We will never sell your personal information without your explicit consent.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. We will not deny services, charge different prices, or provide a different level of quality of services because you exercised a privacy right under the CCPA.

Authorized Agent

You may designate an authorized agent to submit requests on your behalf. We will require verification that the agent has been authorized to act on your behalf, and we may also verify your identity directly.

8. International Data Transfers

Cabot Wealth Management Inc operates offices in both the United States and South Africa. As a result, your personal information may be transferred between these jurisdictions in the course of providing our services.

United States

Our primary operations and data processing activities are conducted in the United States. All personal information collected from U.S. residents is stored and processed in compliance with applicable U.S. federal and state privacy laws, including SEC Regulation S-P and the Massachusetts Standards for the Protection of Personal Information (201 CMR 17.00).

South Africa

Our South Africa branch office, located at 5th St, Sandown, Sandton, 2031, South Africa, processes personal information in compliance with the South African Protection of Personal Information Act (POPIA), 2013. POPIA establishes conditions for the lawful processing of personal information and provides data subjects with rights similar to those described in this policy.

Transfer Safeguards

When transferring personal information between the United States and South Africa, we implement appropriate safeguards including:

• Encrypted data transmission channels (TLS 1.2+).
• Contractual data processing agreements with all parties involved in the transfer.
• Compliance with both U.S. and South African data protection requirements.
• Regular audits of data transfer practices and security measures.

If you are located outside the United States, please be aware that your information will be transferred to and processed in the United States. By using our services, you consent to this transfer and acknowledge that the privacy laws in the United States may differ from those in your country of residence.

9. Children's Privacy

Our services are directed toward adults seeking financial planning and investment management services. We do not knowingly collect personal information from children under the age of 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take immediate steps to delete that information from our systems.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at support@cabotwealthmgtinc.com, and we will take appropriate action.

For custodial accounts (UGMA/UTMA) and education savings plans (529 plans) established for minors, we collect information about the minor beneficiary through the adult custodian or account owner. In such cases, the information is collected and used solely for the purpose of establishing and maintaining the account in compliance with applicable laws.

10. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, regulatory, accounting, or reporting requirements.

Regulatory Retention Requirements

As an SEC-registered investment adviser, we are required to maintain certain records for specified periods:

• Client account records: Five years from the end of the fiscal year during which the account was closed or the last entry was made.
• Transaction records: Five years from the end of the fiscal year during which the transaction was effected.
• Client correspondence: Five years from the end of the fiscal year during which the communication was made.
• Marketing materials and advertisements: Five years from the end of the fiscal year during which the advertisement was last used.
• Compliance records: Five years from the end of the fiscal year during which the record was created.

Retention Periods for Other Data

• Website visitor data: Up to 26 months for analytics purposes.
• Marketing email subscribers: Until you unsubscribe, plus a reasonable period to process your request.
• Cookie data: As specified in the cookie settings (typically 1–12 months depending on the type).

When the applicable retention period expires, we securely delete or anonymize your personal information in accordance with our data destruction procedures.

11. Changes to This Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this page.
• Post a prominent notice on our website homepage for a reasonable period.
• Send an email notification to active clients when the changes significantly affect how their personal information is collected, used, or shared.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our services after any changes constitutes your acceptance of the updated policy.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Cabot Wealth Management Inc
216 Essex St, Salem, MA 01970, USA
Phone: +1 (978) 745-1700
Email: info@cabotwealthmgtinc.com
Support: support@cabotwealthmgtinc.com

South Africa Branch Office
5th St, Sandown, Sandton, 2031, South Africa

For privacy-specific inquiries or to exercise your data subject rights, please direct your written request to our Chief Compliance Officer at the address above or via email at support@cabotwealthmgtinc.com.

If you believe that our handling of your personal information does not comply with applicable privacy laws, you have the right to lodge a complaint with a supervisory authority. In the United States, you may contact the Federal Trade Commission (FTC) or your state attorney general's office. In South Africa, you may contact the Information Regulator.