FXOpen Ltd hereinafter known as “the Company”, “the Firm” or “we”, is fully committed to compliance with the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679), which came into force on 25th May 2018.
The Firm is committed to protecting and respecting your privacy. This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed and stored by the Firm. Please read the following carefully to understand our views and practices regarding your personal data and how the Company will treat it. By using our website, you are agreeing to be bound by this Policy, however, you are free to withdraw your consent anytime by notifying us.
For the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’), the data controller is FXOpen Ltd.
Purpose of data processing
We are required to maintain certain personal data about individuals for the purposes of satisfying our operational and legal obligations (to open an account, client due diligence, money laundering prevention, transact business effectively and to safeguard your assets and your privacy). We recognise the importance of correct and lawful treatment of personal data as it helps to maintain confidence in our organisation and to ensure efficient and successful outcomes when using this data.
We only use personal information as legally appropriate to provide you with a high quality of service and security. We may use the personal data collected from you to verify your identity and contact information. We may also use this information to establish and set up your trading account, issue an account number and a secure password, maintain your account activity, and contact you with account information. This information helps us improve our services, satisfy financial regulation and inform you about new products, services or promotions that may be of interest to you.
Personal data may consist of data kept on paper, computer or other electronic media; all of which is protected under the GDPR.
Principles of data processing
All personal data is:
- Fairly and lawfully processed;
- Processed with specified legal basis;
- Adequate, relevant and not excessive;
- Not kept for longer than necessary;
- Processed in accordance with the individual’s (data subject’s) rights;
- Secure; and
- Not transferred to other countries without adequate protection.
Personal data we collect
We may collect and process the following data about you:
- Information that you provide by filling in forms on our Website;
- Up-to-date data about yourself and your identity, if you register your personal details for our services; and
- Details of your visits to our Website (including, but not limited to, traffic data, location data, weblogs and other communication data, and the resources that you access).
The types of personal data that we may process, for instance, include information about current, past and prospective clients and customers, website visitors, etc. with whom we have dealings. This information includes information required to communicate with you, including your name, mailing address, telephone number, email address, date of birth, ID and your location information.
We may also ask you for information when you report a problem with the Site. If you contact us, we may keep a record of that correspondence. We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them.
You have choices about the data we collect. When you are asked to provide personal data, you may decline. You are also entitled to have the Firm erase your personal data, cease further dissemination of the data and potentially have third parties halt processing of the data. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal however, if you choose not to provide data that is necessary to provide a service or feature or to withdraw the data that is still relevant to original purposes of processing, you may not be able to use that service or feature.
The data we collect depends on the context of your interactions with the Company, the choices you make, including your privacy settings, and the service and features you use.
We may share Website usage information about visitors to the Website with reputable advertising companies for targeting our Internet banner advertisements on this site and other sites. For this purpose, pixel tags (also called clear GIFs or web beacons), may be used to note the pages you've visited. The information collected by the advertising company using these pixel tags is not personally identifiable.
Reasons why we share your personal data
We share your personal data with your consent or as necessary to complete any transaction or provide any service you have requested or authorised. We also share data with:
- The Company’s affiliates and subsidiaries;
- With vendors working for us and / or on our behalf;
- When required by law or to respond to legal process;
- To protect our clients;
- And to maintain the security of our services; and to protect the Firm’s rights or property.
Our affiliates and partners
We may share information with affiliates if the information is required to provide the product or service you have requested, or to provide you with the opportunity to participate in the products or services our affiliates offer. We may also forge partnerships and alliances, which may include joint marketing agreements, with other companies who offer high-quality products and services that might be of value to our Customers.
To ensure that these products and services meet your needs and are delivered in a manner that is useful and relevant, we may share some information with partners, affiliates and alliances. This allows them to better understand the offers that are most relevant and useful to yourself. The use of your personal information is limited to the purposes identified in our relationship with the partner or affiliate.
The Firm may also use such reviews in other promotional material and media for the Firm’s advertising and promotional purposes. Please advise the Firm in writing should you not wish your data to be used in this manner.
Non-affiliated third parties
We do not sell, license, lease or otherwise disclose your personal information to any third party for any reason, except as described below.
We reserve the right to disclose your personal information to third parties when required to do so by law to regulatory, law enforcement or other government authorities. We may also disclose your information as necessary to credit reporting or collection agencies. We may also disclose your information to non-affiliated third parties if it is necessary to protect the Company's rights or property.
To help us improve our services to you, we may engage another business to help us to carry out certain internal functions such as account processing, fulfillment, client service, client satisfaction surveys or other data collection activities relevant to our business. We may also provide a party with Customer information from our database to help us to analyse and identify Customer needs and notify Customers of product and service offerings.
Use of the shared information is strictly limited to the performance of the task we request and for no other purpose. All third parties with which we share personal information are required to protect personal information in a manner similar to the way we protect personal information. We use a variety of legal mechanisms, including contracts, to help insure your rights and protections.
Restriction of responsibility
Access to personal data
All individuals who are the subject of personal data held by us are entitled to:
- ask what information we hold about them and why;
- ask how to gain access to it;
- be informed how to keep it up to date;
- have inaccurate personal data corrected or removed;
- to receive the personal data concerning them, which they have previously provided;
- prevent us from processing information or request that it is stopped if the processing of such data is likely to cause substantial, unwarranted damage or distress to the individual or anyone else, etc.;
- require us to ensure that no decision which significantly affects an individual is solely based on an automated process for the purposes of evaluating matters relating to him/her, such as conduct or performance;
- Be informed what we are doing to comply with our obligations under the GDPR.
If you cannot access certain information and personal data collected by the Firm, you can always contact the Company. We will respond to requests to access or delete your personal data within thirty  days.
Security of personal data
We maintain strict security standards and procedures with a view to preventing unauthorised access to your data by anyone, including our staff. We use leading technologies such as (but not limited to) data encryption, firewalls and server authentication to protect the security of your data. The Firm’s staff and other third parties, whenever contracted to provide support services, are required to observe our privacy standards and to allow us to audit them for compliance.
Breach of personal data
In the case of a personal data breach, the Company shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority- Information Commissioner's Office, UK (ICO) unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to ICO is not made within 72 hours, it shall be accompanied by reasons for the delay according to the Article 33 of GDPR.
Where personal data is stored and processed
Personal data collected by the Firm may be stored and processed in your region or in any other country where the Company or its affiliates, subsidiaries or service providers maintain facilities. Typically, the primary storage location is in the client’s region or in the UK, often with a backup to a datacentre in another region.
The storage location(s) are chosen to operate efficiently, to improve performance, and to create redundancies to protect the data in the event of an outage or other problem. We take steps to ensure that the data we collect under this privacy statement is processed according to the provisions of this statement and the requirements of applicable law wherever the data is located.
We transfer personal data from the European Economic Area to other countries, some of which have not been determined by the European Commission to have an adequate level of data protection. When we do, we use a variety of legal mechanisms, including contracts, to help ensure your rights and protections travel with your data.
Retention of personal data
The Company retains personal data for as long as necessary to provide the services, or for other essential purposes such as complying with our legal obligations, including as an authorised financial services provider, resolving disputes, and enforcing our agreements. Because these needs can vary for different data types in the context of various products, actual retention periods may vary significantly. The criteria used to determine the retention periods include, for example:
- The period of data processing needed to provide the services. This includes such things as maintaining and improving the performance of those services, keeping our systems secure, and maintaining appropriate business and financial records. This is the general rule that establishes the baseline for most data retention periods.
- The data subject's consent for a longer retention period. If so, we will retain data in accordance with the consent.
- The Firm is subject to a legal, contractual, or similar obligation to retain the data. Mandatory data retention laws can be applied in the applicable jurisdiction, government orders to preserve data relevant to an investigation, or data that must be retained for the purposes of litigation.
We encourage you to periodically check and review this policy so that you will always know what information we collect, how we use it, and to whom we disclose it. If you have any questions that this statement does not address, please email [email protected]
If you have a privacy concern, complaint or a question for the Data Protection Officer, please email [email protected] We will respond to questions or concerns within thirty  days.
Unless otherwise stated, the Firm is a data controller for personal data we collect through the services subject to this statement. The Company is a private limited company under Companies House number: 07273392. The Company’s Registered Address is Waverley House, 7-12 Noel Street, London, United Kingdom, W1F 8GQ, with a Trading Address at 80 Coleman Street, London, EC2R 5BJ.
The Firm’s Operations Officer / MLRO is also the person responsible for data protection as the Data Protection Officer. The address for correspondence is also 80 Coleman Street, London, EC2R 5BJ. Telephone: +44 (0) 203 3519 1224.