Privacy policy

1. Data we collect

• Identity and contact data: name, date of birth, nationality, address, email, phone number.
• Verification data: identity documents, proof of address, and the results of identity and sanctions checks.
• Financial and suitability data: source of funds, employment, trading experience, and appropriateness answers.
• Transaction data: deposits, withdrawals, orders, positions and account balances.
• Technical data: IP address, device and browser information, timestamps, and platform activity logs.
• Communications: messages, support tickets, and recordings or notes of calls where applicable.

2. Why we process it

• To perform our contract with you: opening your account, executing orders, and processing payments.
• To comply with legal obligations: identity verification, anti money laundering checks, transaction reporting and record keeping.
• For our legitimate interests: fraud prevention, risk management, security monitoring, and improving our products.
• With your consent: optional marketing communications and non essential cookies, which you can withdraw at any time.

3. Automated processing

We use automated checks for identity verification, fraud detection and risk monitoring, and our AI features produce market analysis and trading signals. Where an automated decision would significantly affect you, such as declining an application, you can ask for human review by contacting us.

4. Who we share data with

We do not sell personal data. Where a provider is located outside your region, transfers are made under a lawful transfer mechanism such as standard contractual clauses.

• Identity verification, payment and banking providers who help us deliver the service.
• Technology providers who host our infrastructure and provide platform and analytics tooling, under contract and on our instructions.
• Regulators, tax authorities, courts and law enforcement where we are legally required to disclose information.
• Professional advisers, auditors and insurers, and any party involved in a corporate transaction affecting our business.

5. How long we keep it

Account, transaction and verification records are retained for the period required by financial services and anti money laundering law, which is typically at least five years after the end of our relationship. Website and marketing data are kept for shorter periods and then deleted or anonymised.

6. Your rights

To exercise any of these rights, contact privacy@cfxmarkets.com. We respond within the period required by applicable law and may ask you to verify your identity first.

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion, where we are not required to keep the data by law.
• Object to or restrict processing based on our legitimate interests.
• Receive your data in a portable format, and withdraw consent where processing is based on consent.
• Complain to a data protection authority if you believe we have handled your data unlawfully. In Malta this is the Office of the Information and Data Protection Commissioner.

7. Security

We use encryption in transit and at rest, access controls on a least privilege basis, two factor authentication available on every client account, logging and continuous monitoring of our infrastructure. No system is completely secure, so please tell us immediately if you suspect unauthorised access to your account.

8. Changes and contact

We update this policy when our processing changes. The date at the top of this page shows when it was last revised. Privacy questions can be sent to privacy@cfxmarkets.com.