Discover Privacy Policy Trading

INTRODUCTION

Your privacy is very important to us. We are committed to protecting and respecting your personal data. This Privacy Policy describes what types of personal data we collect about you when you choose to use our services, how we process your personal data, when and with whom we share it and how we keep it and store it safe. It also details your rights in respect to how we process your personal information and how you may exercise your rights according to this Privacy Policy.

Please take the time to read and understand this Policy. This Privacy Policy provides an overview of how the Company processes your personal data and sets out the information that the Company must provide to you for the purpose of the Data Protection Act, Cap. 8.18 ("DPA 2011") of Saint Lucia on the protection of individuals in relation to personal data and to regulate the collection, holding, use, processing, correction and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and for related matters.

By using any of the communication channels to contact us and/or by applying for an account with the Company, you consent to the terms stipulated in this Policy Notice, including any amendments, that govern how the Company collects, stores, uses, shares and in any other form processes your personal data and your rights during the course of your business relationship with the Company and after its termination.

The information contained herein supersedes any information in relation to the processing of personal data that is included in any of the existing client agreements and associated forms on matters that are covered by this Privacy Policy.

We may revise or update this Policy from time to time. The new version of this Policy will be available on the Company's website. As per the relevant sections of the DPA, if you are a natural person, the Company is the personal data controller of your personal data in relation to the processing activities which your personal data undergo as stated further below.

"processing" in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including- organization, adaptation or alteration of the information or data; Retrieval, consultation or use of the information or data; disclosure, of the information or data by transmission, dissemination, or otherwise making available; or alignment, combination, blocking, erasure, or destruction of the information or data;

"data controller" means a person who, either alone or with others, determines how personal data is processed; (Substituted by Act 2 of 2015)

WHO WE ARE?

CloackX, is a Saint Lucian registered foreign exchange broker licensed and supervised by the Financial Services Regulatory Authority of Saint Lucia (FSRA).

Legal Name: CloackX Ltd
Registered Office: [Address]
Telephone: +357-00-000-000
Email: support@cloackx.com

OUR COMMITMENT

We maintain robust technical and organisational safeguards to ensure confidentiality, integrity, and availability of personal data and to comply with the duties imposed on "data controllers" under the DPA 2011. Only authorised personnel or service providers who require access to fulfil their duties may handle your information.

WHAT INFORMATION WE COLLECT

As part of the Company's client account opening procedures and ongoing obligations, the Company needs to abide by the legislative framework currently in place with the Financial Services Regulatory Authority of Saint Lucia (FSRA) and with the supervisory authorities of its branches. Specifically, the Company shall comply with its legal obligations under the Money Laundering (Prevention) Act (Cap 12.20) for the establishment of the Client's economic profile and prevention of money laundering. Also, the Company shall abide with the relevant record keeping obligations.

The Company based on the above-mentioned, is obliged to request, collect, and maintain for at least five (5) years the following:

• name and surname;
• date of birth;
• place of birth;
• nationality;
• copy of the passport and/or of the identity card;
• utility bill (including the full address of the Client);
• Tax identification number
• tax residence;
• telephone number;
• email;
• employer's name;
• profession;
• industry of employment;
• gross annual income;
• net worth;
• anticipated turnover;
• bank account details;

We may collect the said information directly from you (during the account opening procedure) and/or from other persons including, for example, credit reference agencies, fraud prevention agencies, banks, other financial institutions, third authentication service providers, and providers of public registers.

We may also collect your personal information regarding your use of our website(s), such as pages visited, frequency, duration of visit and reading activities (for more information refer to our 'Cookies disclaimer').

We also keep records of your trading behavior, including a record of; products you trade and their performance; historical data about the trades and investments you have made, including the amount invested; historical data about your payment activities and your withdrawal activities.

Further to the above, the Company may also request further information to improve its services to you (existing or potential Clients) or our activities (if you are our provider of trading data) under our relevant agreement or comply with applicable regulations.

We record communications, electronic, by telephone, in person or otherwise, that we have with you in relation to the services that were provided by the Company to you and the relationship with you. The said recordings will be the Company's sole property and will constitute evidence of the communications between the Company and you.

USE OF INFORMATION COLLECTED

We will use, store, process and handle your personal information in accordance with the Data Protection Act Regulation providing for the protection of natural persons regarding the processing of personal data and for the free movement of such data, as amended or replaced from time to time.

Your personal data, not publicly available information and/or already possessed by the Company without abiding by the provisions of Data protection Act Regulation, will be collected and processed explicitly and specifically only for the purposes that have been collected for ('purpose limitation and minimization') while the Company must require only the information necessary in relation to the purposes for which they have been collected.

We may transfer your personal information outside Saint Lucia. If we make such a transfer, we will ensure that the transfer is lawful and that there are appropriate security arrangements in place to safeguard your personal data as provided by the applicable regulations. Furthermore, the Company follows Saint Lucia's instructions in respect to this matter and shall ensure that the third country that your data may be transferred to is recognized by Saint Lucia as adequate in providing safeguard measures for the protection of your personal data.

CONTACTING YOU

We may, for the purposes of providing our services to you or administering the terms of our agreement with you, make direct contact with you from time to time via telephone, fax, email, chat, or post.

Subject to your consent, the Company may contact you from time to time, by telephone, fax, email, chat, or post for marketing purposes to bring products or services that may be of interest to you to your attention or to conduct market research.

DISCLOSURE OF INFORMATION

Through our engagement with you, we may disclose your personal information as part of our service offering or to fulfil our legal obligations. In this respect, your personal information will be disclosed in the following situations:

• where required by law or competent court;
• where requested by Financial Services Regulatory Authority of Saint Lucia (FSRA) or any other regulatory authority having control or jurisdiction over the company or the Client or their associates or in whose territory the Company has Clients;
• to relevant authorities to investigate or prevent fraud, money laundering, or other illegal activity;
• to such an extent as reasonably to execute orders and for purposes ancillary to the provision of the services;
• to credit reference and fraud prevention agencies, third authentication service providers, banks and other financial institutions for credit checking, fraud prevention, anti-money laundering purposes, identification, or due diligence checks of the Client. To do so, they may check the details the Client supplied against any particulars on any database (public or otherwise) to which they have access. They may also use the Client's details in the future to assist other companies for verification purposes. A record of the search will be retained by the Company;
• to the Company's professional advisors, provided that in each case the relevant professional shall be informed about the confidential nature of such information and commit to the confidentiality herein obligations as well;
• to other service providers who create, maintain or process databases (whether electronic or not), offer record keeping services, email transmission services, messaging services or similar services which aim to assist the Company in collecting, storing, processing and using Client information, or getting in touch with the Client, or improving the provision of the Services under this Agreement.
• to other service providers for statistical purposes in order to improve the Company's marketing, in such a case the data will be provided in an aggregate form;
• to market research call centres that provide telephone or email surveys with the purpose to improve the services of the Company, in such a case only the contact details the data will be provided;
• where necessary in order for the Company to defend or exercise its legal rights to any court or tribunal or arbitrator or Ombudsman or governmental authority;
• at the Client's request or with the Client's consent;
• to an Affiliate of the Company or any other company in the same group of companies to which the Company belongs;
• to successors or assignees or transferees or buyers, with five (5) business days prior written Notice to the Client.

We require organisations outside the Company who handle or obtain personal information to acknowledge the confidentiality of this information, undertake to respect any individual's right to privacy and comply with all the relevant data protection laws and this Privacy Policy.

LEGAL BASIS FOR DATA PROCESSING AND YOUR CONSENT

We will process your personal data for the purposes and to the extent that is necessary for the performance of an agreement to which you are a party or to take steps at your request prior to entering into an agreement. When you desire to become our Client, you have a statutory and contractual obligation to provide and keep up to date and accurate the personal data required to conclude an agreement.

Failure to provide such data will not allow us to commence or continue our business relationship.

We may also process some of your personal data of the legal base of your freely given consent.

When and how do we obtain your consent?

We may process your personal data for one or more lawful bases of processing ("Lawful Basis") depending on the specific purpose for which we are using your data.

The Lawful bases are the following:

• to perform our contractual obligations towards you;
• to be compliant with the legal and regulatory requirements;
• to pursue our legitimate interests;

When the use of your personal information requires your consent, such consent declaration will be provided to you during the account opening procedure and is also available on the Company's website(s). We shall rely on the provided consent as its legal basis for processing your personal data.

As a natural person, when your personal data requires consent for use, the Company will request your consent to be given freely, specifically, and with full information, allowing you to make a clear and unambiguous decision by statement or affirmative action indicating agreement to the processing.

Furthermore, your consent cannot be bundled with non-negotiable terms and conditions, as this would imply that you have not freely provided your consent. However, in certain circumstances, the Company may process your data without obtaining your consent. These circumstances include, but are not limited to, the following:

• processing is necessary to comply with a legal obligation to which the Company is subject;
• processing is necessary to protect your vital interests or the vital interests of another natural person;
• processing is required for the performance of a task carried out in the public interest or in the exercise of public authority vested in the Company;
• processing is necessary for the pursuit of legitimate interests by the Company or a third party, except when such interests are outweighed by your interests or fundamental rights and freedoms that require the protection of personal data.

You have the right to withdraw your consent at any time by contacting us by phone or email at dpo@cloackx.com. The withdrawal of consent will not affect the legality of data processing that occurred before the withdrawal.

Is it compulsory for you to provide your personal data?

The disclosure of personal data is compulsory inter alia in the following situations: to conclude and perform the contract for the provision of brokerage services; it is legally required or necessary for the execution of the service agreement; responding to your complaint, claim or data request. Without the required personal data we will not be able to proceed to conclude, continue and/or perform the contract or effectively address your inquiries.

MANAGEMENT OF YOUR PERSONAL INFORMATION AND SAFEGUARD MEASURES

We have taken all the appropriate technical and organisational measures to ensure that your personal data is secured. Moreover, the Company has established internal educational training for its employees to mitigate any risks that may affect your data. The employees that are processing your data are being trained to respect the confidentiality of customer information and the privacy of individuals.

The Company enhanced its internal procedures to prevent any unnecessary event. We have implemented procedures in respect to safeguarding your data. Only employees and/or partners/tied agents or processors that need to have access to the information to enable the continuity of the agreement between you and the Company, have access to such information.

Furthermore, we hold personal data and other relevant information in a combination of secure computer storage, secure servers, and from time to time and if it is deemed necessary, we will store them in paper-based files. The Company has taken all necessary steps to protect the personal information that it holds from misuse, loss, unauthorised access, modification, or disclosure.

While we will use all reasonable efforts to safeguard your personal information, you acknowledge that the use of the Internet is not entirely secure, and for this reason we cannot guarantee the security or integrity of any personal data transferred from you or to you via the Internet.

The Company appointed a Data Protection Officer to ensure that our management of personal information is in accordance with this Privacy Notice and the applicable legislation.

HOW LONG WE HOLD YOUR INFORMATION

We shall keep your personal data for as long as the Company has a business relationship with you (natural person). Once the business relationship has ended, we may keep your data for up to five (5) years in accordance with the Laws governing the Company.

We may keep your personal data for longer than five (5) years for legal, regulatory and/or any other obligatory reason. Retention periods will be determined considering the type of information that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable time.

We hold personal information in hard-copy and soft-copy formats. We use secure computer storage facilities for soft-copies and implement a security access policy for hard-copies. The Company has measures in place to protect the personal information we hold from misuse, loss, unauthorised access, modification, or disclosure.

YOUR RIGHTS

Right to be informed

You have the right to be informed about the collection and use of your personal data.

• You have the right to know the purposes for processing your personal data, your retention periods for that personal data, and who it will be shared with.

Right to access your personal data

• To receive a copy of your personal data, and other supplementary information, by completing a Data Subject Access Request (DSAR), you will get a response without delay and within one month of receipt of the request.

Right of Rectification

• You can have inaccurate personal data rectified or completed if it is incomplete.
• You can make a request for rectification verbally or in writing.
• In certain circumstances, the company can refuse a request for rectification.

Right to erasure or to be forgotten

• The right to erasure is also known as 'the right to be forgotten'.
• The right is not absolute and only applies in certain circumstances.

Right to request the restriction or suppression of your personal data

• This is not an absolute right and only applies inter alia in the following circumstances: the accuracy of your personal data is contested by you, and we need to verify it within a reasonable period; your personal data has been processed unlawfully, and you have opposed the erasure and restrictions; we no longer need your personal data for the purposes of the processing, but we still need to keep them for the establishment, exercise or defence of legal claims; you have objected to the processing of your personal data, and the verification whether we have legitimate grounds for the processing of your data is pending.
• When processing is restricted, we only store personal data, but not use it.

Right to data portability

• You can obtain and reuse your personal data for your own purposes across different services.
• This right allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability.
• The right only applies to information an individual has provided to a controller.

Right to object

• to the processing of your personal data in certain circumstances.
• You have an absolute right to stop your data being used for direct marketing.

Right to automated decision making.

• Automated individual decision-making (making a decision solely by automated means without any human involvement); and
• Profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.
• We can only carry out this type of decision-making where the decision is: Necessary for the entry into or performance of a contract; or Authorised by domestic law applicable to the controller; or Based on the individual's explicit consent.

You can send all your requests to dpo@cloackx.com, and we will respond accordingly within one month. However, if your request is particularly complex, it may take us longer than one month to respond. In such cases, we will notify you within one month of receiving your request and keep you informed of the progress.

Please note that in certain situations, when a request is deemed obviously groundless, extreme, or recurring, we may charge you a reasonable fee. If such a situation arises, we will inform you of the fee, and you will need to accept it before we process your request.

QUESTIONS

If you have any questions regarding this Policy, wish to access or change your information or have a complaint, or if you have any questions about security on our website, you may email us at dpo@cloackx.com. Furthermore, in case you are not happy with the quality of services we have provided you with in regard to the personal data processing, you as a natural person have the right to lodge a complaint with the supervisory authority.

UPDATES

We may change this Policy at any time at our discretion without any prior notice to you. We will post any and all updates on our website and for this reason you are advised to look for updates from time to time.