Privacy Policy

Definitions

Personal data means any information relating to an identified or identifiable person, such as your name, contact details or transaction history. Processing means anything we do with that data, including collecting, storing, analysing and deleting it. The controller decides why and how data is processed; Cerfina is the controller for data described in this policy. Processors handle data on our instructions, such as the hosting provider that runs our servers.

Personal data we collect

We collect identity and contact data: first name, last name, email address, telephone number and country of residence. We collect account data: your login credentials, security settings and preferences. We collect verification data when required: identity documents, address documents and, where applicable, the biometric selfie check described in the AML and KYC policy. We collect transaction data: deposits, withdrawals, trading activity and their outcomes.

We also collect the content of requests you send us, such as support messages and complaints. We do not collect special category data beyond what verification legally requires, and we never ask for it for marketing purposes.

Usage data

When you use the website we receive technical data automatically: IP address, browser type and version, device type, approximate location derived from the IP, pages visited and the times of those visits. This comes from standard server logs and helps us keep the service secure, diagnose faults and understand aggregate usage.

Usage data is analysed in aggregate for product decisions, for example which help articles to write next. It is not used to build advertising profiles of you, and it is not sold.

Cookies

The site uses a small number of cookies. Strictly necessary cookies keep you signed in, maintain security tokens and remember form inputs. Preference cookies remember choices such as interface settings. Analytics cookies, if enabled, help us count visits and understand which pages fail to help. Marketing cookies exist only if you accept them, and they never follow you to unrelated websites.

You can control cookies through your browser and through the cookie preferences available on the site. Rejecting cookies does not lock you out of the service; it only limits features that genuinely need them, such as staying signed in between visits.

Controllers and processors

Cerfina is the controller for the data described here. We use processors under written agreements that bind them to process data only on our instructions and to protect it with appropriate security measures. Current categories include our hosting provider, our identity verification provider, our email delivery provider and payment processors.

Where a provider processes data outside the United Kingdom, transfers rely on appropriate safeguards such as international data transfer agreements. A current list of processor categories is available on request through the contact address at the end of this policy.

How your data is used

Identity and contact data are used to create your account, verify who you are and communicate with you. Account data keeps the service working and secure. Transaction data operates the platform: executing your instructions, producing your reports and meeting record-keeping obligations. Support message content is used to answer you and to improve our help material.

Aggregated, anonymised statistics may be used to describe how the platform is used, in the format that cannot identify any individual customer, for example how many users completed verification on the first attempt.

Legal bases for processing

Processing rests on four bases, applied by purpose. Contract: processing needed to provide the service you asked for, such as running your account and executing withdrawals. Legal obligation: processing required by law, such as identity verification and transaction monitoring under applicable UK anti-money-laundering requirements, and record keeping. Legitimate interests: processing that keeps the service safe and improves it, such as fraud prevention, security logging and aggregate analytics, balanced against your interests and rights. Consent: marketing emails and non-essential cookies, which are always optional and revocable.

Data retention

Identity and contact data are kept for the life of your account and for five years after it closes, the standard verification record period under applicable UK rules. Transaction data follows the same schedule. Support messages are kept for three years after resolution, longer where a complaint file must be preserved. Usage logs are kept for twelve months, security logs for up to two years.

When retention periods end, data is deleted or irreversibly anonymised. Where law requires a legal hold, such as an open investigation, deletion waits until the hold lifts, and only the data subject to the hold is affected.

Sharing and disclosure

We share data with the licensed entities that execute trades through the platform's connections, because they cannot execute your instructions without knowing who you are. We share with service providers under the processor agreements described above. We share with regulators, courts and law enforcement where legally required. We share with auditors and professional advisers under confidentiality duties.

We do not sell personal data, and we do not share it with data brokers or advertising networks. In the rare event of a business reorganisation, data may transfer as part of the assets, with notice to you beforehand where the law requires it.

Security of your data

Data is encrypted in transit and at rest, access is limited by role, and staff access to customer records is logged and reviewed. The Security page describes the controls on your account, including two-factor authentication and login alerts, and the broader protections around the platform.

No system is perfectly secure. If a breach ever affects your data, we will notify you and the regulator as the law requires, describe what happened in plain language and set out what we are doing about it.

Your rights

You have the right to access the personal data we hold about you and to receive a copy. You can ask for inaccurate data to be corrected, and incomplete data to be completed. In some circumstances you can ask for data to be erased, processing restricted, or your data ported to another provider in a machine-readable format. Where processing rests on legitimate interests, you can object to it, and where it rests on consent, you can withdraw that consent at any time.

Requests go to [email protected]. We respond within one month, which can extend by two months for complex cases, and we will tell you if we do. We may need to verify your identity before acting, using the standard checks described in the AML and KYC policy. If you are unhappy with our response, you can complain to the Information Commissioner's Office.

Service providers

The service depends on a small number of providers: hosting and infrastructure, identity verification, email delivery, payment processing and analytics. Each is bound by contract to use data only for our instructions, to meet security standards and to notify us of any incident affecting our data. We review these arrangements regularly, and a provider that fails its obligations is replaced.

Analytics

We use privacy-respecting analytics to understand how the site is used: which pages people read, where they get stuck and which forms fail. Analytics data is aggregate-first, individual page views are not used to identify you across other websites, and the analytics configuration does not enable cross-site tracking or advertising use.

Advertising and retargeting

We advertise on external channels, and those channels may measure the performance of our adverts. We do not transfer your personal data to advertising platforms for retargeting purposes. If we ever change that practice, the cookie preferences will say so before it happens, and the change will be opt-in.

Links to other websites

The site links to external resources, including the venues the platform connects to and regulator pages. Those destinations have their own privacy practices, which we do not control. This policy covers what happens on our domain and in our services, and your activity on other sites is governed by their terms and notices.

Children

The service is intended for adults and is not directed at children. We do not knowingly collect data from anyone under eighteen, and accounts cannot be opened by minors. If we learn that a child's data has reached us, we delete it promptly. If you believe this has happened, contact us at the address below.

Changes and contact

This policy may be updated to reflect changes in our practices, providers or the law. The current version is always published here, and material changes are announced in the dashboard before they take effect. Continuing to use the service after a change means you accept the updated policy.

Questions, requests and complaints about privacy go to [email protected], marked for the attention of the Client Support and Compliance team, or by post to 1 St Peter's Square, Manchester M2 3DE, United Kingdom. We answer every privacy message within one month at the latest, usually far sooner.