Institutional Data Protection & Privacy Framework
Last Updated: January 2026 | Effective for all global trading accounts.
📋 Information We Collect
To open and maintain a live trading account, our institutional prime brokerage is legally required to collect and retain a defined set of client information. We collect only what is necessary for account operation, regulatory reporting and platform security.
- ▸Personal identification: full legal name, date of birth, nationality, residential address, email and telephone number.
- ▸Financial details: declared source of funds, employment status, annual income bracket, trading experience and appropriateness assessment answers.
- ▸KYC verification documents: government-issued photo ID, passport or driving licence, and a proof of address dated within the last 90 days.
- ▸Device and IP telemetry: IP address, device fingerprint, browser type, operating system, session timestamps and Client Portal login history.
⚖️ How We Process & Use Client Data
Client data is processed strictly for lawful, defined purposes. We never sell client data, and we never share personal information with marketing brokers or unaffiliated data resellers.
- ▸Executing trades: routing orders to Tier-1 liquidity providers, calculating margin, settling positions and producing statements.
- ▸Fraud prevention: detecting unauthorised access, payment fraud, chargeback abuse and suspicious login geographies.
- ▸Regulatory compliance: satisfying transaction reporting, record-keeping and AML obligations under FCA, CySEC and ASIC standards.
- ▸Account security: two-factor authentication, session validation, withdrawal verification and identity re-confirmation.
🛡️ Segregated Custody & Cryptographic Protection
Client records are held in segregated, access-controlled environments physically separated from public-facing infrastructure. Access is granted on a strict least-privilege basis and every access event is logged and audited.
- ▸256-bit SSL/TLS encryption on all data in transit between your device, the Client Portal and our execution servers.
- ▸Encrypted cold-storage backups of KYC documentation, retained for the statutory period and then permanently destroyed.
- ▸Non-disclosure to unauthorised third parties — data is shared only with regulators, licensed payment processors and audited service providers under binding confidentiality agreements.
- ▸Continuous intrusion monitoring, periodic penetration testing and enforced internal access reviews.
👤 Client Data Rights & GDPR Compliance
You retain full control over the personal data we hold. Requests are acknowledged within 72 hours and fulfilled within 30 calendar days, subject to statutory retention duties that may require us to keep certain trading and AML records.
- ▸Right of access: request a complete copy of the personal data held on your account.
- ▸Right to rectification: correct inaccurate or outdated personal or financial information.
- ▸Right to erasure: request account closure and deletion of data not subject to mandatory regulatory retention.
- ▸Right to data portability: receive your records in a structured, machine-readable format.