FOLTRAX Privacy Policy

This Privacy Policy explains how FOLTRAX TECHNOLOGY, trading as FOLTRAX (“FOLTRAX,” “we,” “us,” or “our”), collects, uses, discloses, stores, and protects personal data.

This Policy applies when you:

visit www.foltrax.com or any FOLTRAX website that links to this Policy;
create or use a FOLTRAX account;
access our web, desktop, mobile, research, strategy, analytics, or related services;
request platform access, product information, investment information, or support;
attend a FOLTRAX event or communicate with us; or
otherwise interact with FOLTRAX.

We refer to these websites, applications, platforms, tools, and related services collectively as the “Services.”

This Policy does not apply to information processed by third-party websites, payment providers, identity-verification providers, authentication providers, or other independent services. Those organisations process information under their own privacy policies.

1. Who Is Responsible for Your Personal Data

The controller responsible for the personal data described in this Policy is:

FOLTRAX TECHNOLOGY
[Registered address to be confirmed]
[Country of incorporation to be confirmed]
Email: [email protected]

Where another FOLTRAX entity acts as the controller for a particular product, jurisdiction, or client relationship, we will identify that entity in the applicable onboarding materials, agreement, or supplemental privacy notice.

2. Personal Data We Collect

The information we collect depends on how you interact with FOLTRAX and which Services you use.

2.1 Identity and contact information

We may collect:

full name, preferred name, title, and date of birth;
personal or business email address and telephone number;
residential, registered, or business address;
employer, job title, business function, and professional details;
country of residence, citizenship, and tax residence; and
information included in enquiries, access requests, applications, or event registrations.

2.2 Account and authentication information

When you create or access an account, we may collect:

account name, user ID, and profile details;
password hashes and other authentication data;
multi-factor authentication details;
account permissions, role, and organisation membership;
login history, session information, and security events; and
information received from an authentication provider if you use a third-party sign-in service.

Please do not share your password or other secret authentication information with us unless a specific FOLTRAX security workflow expressly requests it. FOLTRAX will never ask you to provide credentials for a cryptocurrency exchange, broker, custodian, bank account, or digital wallet.

2.3 Investor onboarding, compliance, and verification information

Where required to provide a Service, establish a business relationship, or comply with applicable law, we or our verification partners may collect:

government-issued identification information;
a photograph, selfie, or liveness check used for identity verification;
information about beneficial ownership, controllers, directors, or authorised representatives;
source-of-funds, source-of-wealth, occupation, and financial background information;
tax identification and tax residency information;
sanctions, politically exposed person, fraud, and adverse-media screening results;
investment experience, investor classification, risk profile, and eligibility information; and
supporting documents and verification records.

Some of this information may be considered sensitive personal data in certain jurisdictions. We process it only where permitted by law and when reasonably necessary for the relevant purpose.

2.4 Subscription and payment information

We may collect:

billing address, subscription tier, invoice, and payment status;
limited payment-card or bank information received from our payment provider;
records of purchases, subscriptions, refunds, and account credits;
records required for accounting, tax, audit, or regulatory purposes.

We generally use specialist payment providers and do not store complete payment-card numbers.

2.5 Information FOLTRAX does not collect from trading accounts

FOLTRAX does not connect to or access your cryptocurrency exchange, broker, custodian, bank, or digital-wallet accounts.

FOLTRAX does not request, collect, or store:

exchange, broker, custodian, bank, or wallet login credentials;
exchange API keys, API secrets, private keys, or wallet seed phrases;
actual account balances, holdings, or open positions;
order, execution, deposit, withdrawal, or transaction history; or
realised or unrealised profit and loss from your external accounts.

The Services do not place orders, execute trades, transfer assets, or make withdrawals through your external accounts.

2.6 Strategy, research, and platform information

We may process information you create, submit, or generate through the Services, including:

strategy objectives, rules, constraints, and configurations;
market, asset, factor, and time-horizon selections;
research queries and model parameters;
backtest, simulation, optimisation, and validation results;
watchlists, alerts, model-portfolio preferences, research assumptions, and risk parameters;
reports, dashboards, annotations, and exported files;
feedback provided about models, signals, or platform features; and
activity logs showing how platform tools are configured and used.

Depending on the circumstances, this information may be confidential business information rather than personal data. It will be treated as personal data when it identifies or can reasonably be linked to an individual.

2.7 Device, usage, and technical information

We may automatically collect:

IP address and approximate location derived from it;
device type, browser, operating system, and language;
device and advertising identifiers, where permitted;
referring page, pages viewed, features used, and navigation paths;
date, time, duration, frequency, and pattern of use;
application logs, crash reports, diagnostic data, and performance information;
cookie and consent preferences; and
information used to detect suspicious, fraudulent, or unauthorised activity.

2.8 Communications and support information

We may collect the content and metadata of communications you send to us, including emails, support requests, meeting notes, survey responses, call records, and messages submitted through website forms.

If we record a telephone or video call, we will provide notice where required by law.

2.9 Marketing and preference information

We may collect:

newsletter and product-update preferences;
event, research, or content interests;
consent and opt-out records;
responses to campaigns or invitations; and
information about how you interact with our communications.

2.10 Information from other sources

We may receive information from:

your employer, organisation, adviser, authorised representative, or account administrator;
identity-verification, fraud-prevention, sanctions-screening, and compliance providers;
payment, authentication, and identity-verification providers;
analytics, fraud-prevention, compliance, and public-record sources;
analytics, advertising, and referral partners;
business partners and affiliates; and
publicly available sources, including company websites, professional directories, and regulatory registers.

If you provide personal data about another person, you must be authorised to do so and must provide them with information about this Policy where appropriate.

3. How We Use Personal Data

We may use personal data to:

3.1 Provide and operate the Services

create, authenticate, and administer accounts;
provide platform tools, research, analytics, strategies, reports, and requested functionality;
process subscriptions and payments;
provide customer service and technical support;
maintain records, backups, availability, and service continuity; and
communicate service, security, account, and administrative notices.

3.2 Support quantitative research and platform functionality

process strategy configurations, research requests, and model-portfolio settings;
generate backtests, simulations, model outputs, risk analytics, and reports;
monitor model and platform performance;
identify errors, anomalies, or degraded results;
improve the quality, reliability, explainability, and usability of the Services; and
develop new FOLTRAX products and features.

Unless we disclose otherwise, FOLTRAX does not use personal data to make solely automated decisions that produce legal or similarly significant effects about an individual. Model outputs and investment analytics may be automated, but they are not a substitute for professional judgment and do not constitute a guarantee of performance.

3.3 Maintain safety, security, and market integrity

verify identities and account authority;
protect accounts, infrastructure, and information;
detect and prevent fraud, cyberattacks, abuse, sanctions evasion, money laundering, and other unlawful activity;
investigate suspected breaches of our terms or policies;
enforce access controls and platform limits; and
manage operational, compliance, legal, and financial risk.

3.4 Comply with law and protect rights

conduct KYC, anti-money laundering, sanctions, tax, suitability, or eligibility checks where applicable;
respond to lawful requests from regulators, courts, law-enforcement agencies, tax authorities, and other competent bodies;
comply with accounting, audit, reporting, recordkeeping, and financial-services obligations;
establish, exercise, or defend legal claims; and
protect the rights, property, safety, and legitimate interests of FOLTRAX, our users, and others.

3.5 Communicate and market

respond to enquiries and manage client or prospective-client relationships;
provide research, market commentary, product information, invitations, and updates;
personalise content and communications;
measure the effectiveness of communications; and
obtain feedback and conduct surveys.

You may opt out of marketing emails at any time by using the unsubscribe link or contacting us. You will still receive necessary service, account, security, and legal communications.

3.6 Corporate administration

manage our business, affiliates, personnel, suppliers, insurance, audits, and professional advice;
conduct due diligence for financing, investment, reorganisation, merger, acquisition, or sale transactions; and
generate aggregated or de-identified statistics for business analysis and product planning.

We may use aggregated or de-identified information for any lawful purpose. We will not attempt to re-identify information that has been de-identified except to test whether our de-identification measures are effective or as otherwise permitted by law.

4. Legal Bases for Processing

Where the EU General Data Protection Regulation, UK data-protection law, or another law requires a lawful basis, we rely on one or more of the following:

Contract: processing is necessary to enter into or perform a contract with you.
Legal obligation: processing is necessary to comply with applicable law, regulation, court orders, or regulatory requirements.
Legitimate interests: processing is necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights. These interests may include operating and improving the Services, securing our systems, preventing fraud, managing client relationships, conducting business administration, and protecting legal rights.
Consent: you have provided consent for a specific purpose, such as certain cookies, marketing communications, or processing that requires explicit consent. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.
Substantial public interest or legal claims: where permitted, we may process certain sensitive information for fraud prevention, sanctions compliance, regulatory functions, or the establishment, exercise, or defence of legal claims.
Vital interests: in rare circumstances, processing may be necessary to protect the vital interests of an individual.

The legal basis that applies depends on the purpose, data, Service, and jurisdiction. You may contact us for more information about the basis used for a particular activity.

5. How We Disclose Personal Data

We may disclose personal data to the following categories of recipients.

5.1 Service providers

We use service providers for cloud hosting, security, authentication, communications, customer support, analytics, payments, identity verification, compliance screening, professional services, and other operational functions. They may process personal data only to provide contracted services and subject to appropriate confidentiality and data-protection obligations.

5.2 Payment, authentication, and verification providers

Where necessary to provide a requested Service, we may disclose limited information to payment processors, authentication providers, identity-verification providers, and compliance-screening providers.

FOLTRAX does not disclose your information to an exchange, broker, custodian, or wallet provider for account connection or trading purposes because the Services do not provide those functions.

These providers may act as processors on our behalf or as independent controllers under their own privacy policies, depending on the service and applicable law.

5.3 Affiliates

We may disclose personal data within the FOLTRAX group for service delivery, support, security, compliance, business administration, and the other purposes described in this Policy.

5.4 Professional advisers

We may disclose information to lawyers, accountants, auditors, insurers, consultants, and other professional advisers where reasonably necessary.

5.5 Authorities and other parties required by law

We may disclose information to regulators, courts, law-enforcement agencies, tax authorities, government bodies, self-regulatory organisations, or other competent authorities when required or permitted by law.

5.6 Corporate transactions

We may disclose information in connection with an actual or proposed financing, investment, reorganisation, merger, acquisition, joint venture, sale, insolvency, or transfer of all or part of our business or assets. A recipient will be required to use personal data consistently with applicable law and this Policy, unless you are notified otherwise.

5.7 With your direction or consent

We may disclose information when you direct us to do so, authorise a connection, request an integration, or otherwise provide consent.

FOLTRAX does not sell personal data for monetary consideration. As of the date of this Policy, FOLTRAX does not share personal data for cross-context behavioural advertising. If these practices change, we will update this Policy and provide any notices and opt-out mechanisms required by law.

6. Cookies and Similar Technologies

We and our service providers may use cookies, local storage, software development kits, pixels, and similar technologies.

These technologies may be used for:

Essential functions: authentication, session management, load balancing, and core site operation;
Security: fraud detection, abuse prevention, and account protection;
Preferences: language, region, accessibility, and cookie choices;
Analytics: understanding how visitors use the Services and improving performance;
Functionality: remembering settings and enabling enhanced features; and
Marketing: measuring communications or campaigns where permitted and, where required, with consent.

Where required, non-essential technologies will not be used until you provide consent. You may update your preferences using our cookie controls or browser settings. Blocking certain technologies may affect functionality.

7. International Data Transfers

FOLTRAX operates internationally. Personal data may be processed in countries other than the country where it was collected, including countries that may have different data-protection laws.

Where required, we use recognised safeguards for international transfers, which may include:

an adequacy decision;
standard contractual clauses;
the UK International Data Transfer Agreement or UK Addendum;
binding contractual and security requirements; or
another transfer mechanism permitted by applicable law.

You may contact us for information about the safeguards relevant to your data.

8. Data Security

We use administrative, technical, and physical safeguards designed to protect personal data against unauthorised access, use, alteration, disclosure, loss, or destruction. Depending on the nature of the data and Service, safeguards may include:

encryption in transit and at rest;
access controls and least-privilege permissions;
multi-factor authentication;
logging, monitoring, and anomaly detection;
secure development and vulnerability-management processes;
vendor and security assessments;
backup, resilience, and incident-response procedures; and
personnel confidentiality and security training.

No transmission or storage system is completely secure. You are responsible for using strong, unique passwords, protecting authentication devices, reviewing account permissions, and promptly notifying us of suspected unauthorised access.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain records, resolve disputes, enforce agreements, and meet legal, regulatory, tax, accounting, security, anti-fraud, and compliance obligations.

Retention periods vary according to:

the nature, sensitivity, and volume of the data;
the Service and duration of the relationship;
legal, regulatory, contractual, and limitation-period requirements;
the risk of harm from unauthorised use or disclosure;
whether the information is needed for security, fraud prevention, or legal claims; and
whether the purpose can be achieved through deletion, aggregation, or anonymisation.

When retention is no longer required, we will delete or anonymise the data. If immediate deletion is not technically feasible, such as for encrypted backups, we will securely isolate the data and delete it in accordance with our backup lifecycle.

10. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

receive information about how we process your personal data;
request access to and a copy of your personal data;
request correction of inaccurate or incomplete data;
request deletion of personal data;
request restriction of processing;
object to processing based on legitimate interests;
object to direct marketing;
withdraw consent;
receive certain data in a structured, commonly used, machine-readable format;
request transfer of certain data to another provider;
request information about safeguards used for international transfers;
request review of certain solely automated decisions;
opt out of the sale or sharing of personal information where applicable;
limit certain uses of sensitive personal information where applicable; and
complain to a competent data-protection authority.

These rights are not absolute. We may decline or limit a request where permitted by law, including when we cannot verify identity, must retain data to comply with law, or need the data to establish or defend legal claims.

To submit a request, email [email protected] with the subject line “Privacy Request.” We may request information reasonably necessary to verify your identity and authority. An authorised agent may submit a request where permitted by law, subject to appropriate verification.

We will not discriminate against you for exercising a privacy right.

10.1 European Economic Area, United Kingdom, and Switzerland

You may have the rights described above under applicable European or UK data-protection law. You may also lodge a complaint with the supervisory authority in your country of residence, place of work, or the location of the alleged infringement.

10.2 California residents

If FOLTRAX is subject to the California Consumer Privacy Act as amended, California residents may have rights to know, delete, correct, and obtain information about the categories of personal information collected, sources, purposes, and recipients. They may also have rights to opt out of sale or sharing and to limit certain uses of sensitive personal information.

FOLTRAX does not sell personal information for monetary consideration and does not currently share personal information for cross-context behavioural advertising.

We may process the following CCPA categories, depending on your relationship with us:

identifiers;
customer-record information;
commercial information;
internet or electronic-network activity;
geolocation derived from IP address;
professional or employment-related information;
financial information;
audio or visual information if calls are recorded;
sensitive personal information used for authentication, financial services, identity verification, or compliance; and
inferences drawn from account, usage, or preference information.

We use and disclose these categories for the business and commercial purposes described in Sections 3 and 5. We retain them according to Section 9.

11. Children

The Services are not directed to children. You must be at least 18 years old, or the age of legal majority in your jurisdiction if higher, to use Services that require an account.

We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact [email protected] so we can investigate and take appropriate action.

12. Third-Party Services and Links

The Services may contain links to or integrations with third-party services. FOLTRAX does not control those services and is not responsible for their privacy, security, accuracy, or availability.

Before creating an account with or providing information to a third party, review its terms, privacy policy, security practices, and requested permissions.

13. Confidentiality of Strategy and Client Information

FOLTRAX recognises that strategy configurations, model-portfolio information, research materials, and client communications may be commercially sensitive. This information relates only to content created or entered within FOLTRAX and is not imported from a connected exchange or trading account. We apply contractual and technical controls designed to restrict access and use this information only for authorised service, security, support, compliance, and improvement purposes.

Any ownership, confidentiality, and permitted-use terms governing client research or strategy content are also subject to the applicable service agreement.

14. Changes to This Policy

We may update this Policy to reflect changes in our Services, practices, technology, legal obligations, or business operations.

When we make changes, we will update the “Last updated” date. If a change is material, we will provide additional notice where required, such as through the Services, account notification, or email.

We encourage you to review this Policy periodically.

15. Contact Us

For questions, complaints, or privacy-rights requests, contact:

FOLTRAX Privacy Team
FOLTRAX TECHNOLOGY
[Registered address to be confirmed]
Email: [email protected]

If you contact us about a privacy concern, please provide enough information for us to understand the issue. We may ask for additional information to verify identity and protect account security.