01
Who processes your data
The controller of your personal data is [LEGAL ENTITY], registration number [N], address: [ADDRESS]. Processing is carried out in accordance with the EU General Data Protection Regulation and the national legislation of the country of incorporation. Data Protection Officer: [EMAIL].
02
What data is collected
| Category | What it includes | Source |
|---|---|---|
| Identity data: | Name, date of birth, nationality, document number | The client. |
| Financial data: | Information on income and source of funds, payment details. | The client and payment providers |
| Experience data: | Appropriateness assessment results, trading experience. | The client. |
| Trading data: | Transaction history, account history, support requests. | Collected automatically |
| Technical data | IP address, device type, browser, cookies. | Collected automatically |
| Communication records | Telephone calls, correspondence, chats. | Collected automatically |
| Screening data: | Results of sanctions screening and politically exposed person checks. | Screening providers |
| Contact data: | Address, email, telephone | The client. |
03
Legal basis for processing
| Purpose of processing | Legal basis |
|---|---|
| Opening and maintaining the account, executing orders | Performance of a contract |
| Client identification and anti-money laundering | Legal obligation |
| Regulatory reporting | Legal obligation |
| Recording of telephone calls and correspondence | Legal obligation under MiFID II |
| Fraud prevention | Legitimate interest |
| Service improvement and analytics | Legitimate interest. |
| Marketing communications | Client consent |
| Analytics and advertising cookies | Client consent |
04
Recording of communications
MiFID II requires investment firms to record telephone conversations and electronic communications relating to the provision of investment services. Recordings are retained for at least five years and may be provided to the client on request, as well as to the regulator.
It is not possible to opt out of recording; if you refuse, services via the relevant communication channel will cease to be provided.
05
Who your data is shared with
- Regulatory and tax authorities where required by law.
- Banks and payment providers for the purpose of settling payments.
- Identity verification and sanctions screening providers.
- IT infrastructure and cloud service providers.
- External auditors and legal advisers.
- Group companies, to the extent necessary to provide the services.
Personal data is never sold to third parties under any circumstances.
06
Transfers outside the European Economic Area
Where data is transferred to a country outside the European Economic Area, the standard contractual clauses approved by the European Commission apply, or a Commission adequacy decision. A list of recipients is available on request.
07
Retention periods
| Data | Retention period |
|---|---|
| Identity documents: | 5 years after the relationship ends. |
| Transaction history: | 5 years after the relationship ends. |
| Recordings of calls and correspondence: | 5 years. |
| Marketing consent records: | Until consent is withdrawn. |
| Technical logs: | 12 months. |
The period may be extended in the event of legal proceedings or a regulatory instruction.
08
Your rights
Under the Regulation you have the right to
- obtain confirmation of processing and a copy of your data,
- request the rectification of inaccurate data,
- request the erasure of data where there is no legal basis for retaining it,
- restrict processing,
- withdraw consent at any time,
- lodge a complaint with a data protection supervisory authority.
Limitation.
The right to erasure does not extend to data whose retention is required by anti-money laundering legislation and MiFID II rules. Even after the account is closed, this information is retained for the statutory period.
How to exercise your rights:
send a request to [EMAIL]. A response is provided within one month. For complex requests the period may be extended by a further two months, with notice given to you.
09
Security
The following measures are applied
- encryption of data in transit,
- access restricted on a need-to-know basis,
- two-factor authentication in the client area,
- logging of access to client data,
- regular security testing and staff training.
