GDPR & UK Data Protection Policy

FXCRM complies with the EU General Data Protection Regulation (Regulation 2016/679) and the UK GDPR as retained under the Data Protection Act 2018. This policy explains how we process personal data of EU/EEA and UK data subjects, the lawful bases we rely on, and the rights available to you.

Depending on the context, FXCRM acts either as a data controller(for its own website visitors, marketing contacts, employees, and direct customers) or as a data processor (when hosting CRM instances and processing end-user data on behalf of licensed brokerage clients).

Controller: FXCRM Turnkey Systems Ltd

Registered address: London, United Kingdom

Data Protection Officer (DPO): dpo@fxcrm.net

EU Representative: appointed pursuant to Article 27 GDPR — details available on request.

FXCRM processes personal data under one or more of the following GDPR Article 6 bases:

• Contract — to onboard, service, and support customers under a written agreement
• Legal obligation — AML/CTF, tax, and regulatory reporting duties
• Legitimate interest — platform security, fraud prevention, service improvement
• Consent — marketing communications, non-essential cookies, optional integrations

Special category data (Article 9) is processed only where explicit consent has been obtained or where processing is necessary for the establishment, exercise, or defence of legal claims.

• Identity data (full name, date of birth, nationality, government ID numbers)
• Contact data (email, phone, postal address, IP address, device identifiers)
• Financial data (bank details, payment method metadata, trading history, tax IDs)
• KYC & biometric data (document images, liveness checks) — where you have consented
• Usage data (login logs, feature interactions, support tickets, session recordings)
• Marketing preferences and consent history

Under GDPR you have the right to:

• Access your personal data (Article 15)
• Rectify inaccurate or incomplete data (Article 16)
• Erasure ("right to be forgotten") subject to legal retention limits (Article 17)
• Restrict processing in defined circumstances (Article 18)
• Data portability in a structured, machine-readable format (Article 20)
• Object to processing based on legitimate interest or for direct marketing (Article 21)
• Withdraw consent at any time where consent is the legal basis
• Lodge a complaint with a supervisory authority (e.g. UK ICO, Irish DPC)
• Not be subject to solely automated decisions with legal or similarly significant effect

To exercise any right, contact dpo@fxcrm.net. We will respond within one calendar month, extendable by two further months for complex requests, and free of charge unless the request is manifestly unfounded or excessive.

FXCRM primarily hosts customer data in EU/EEA and UK data centres. Where personal data is transferred to third countries not covered by an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, supplemented by Transfer Impact Assessments and technical measures such as end-to-end encryption, pseudonymisation, and split-key architecture.

FXCRM engages carefully vetted sub-processors for hosting, KYC verification, payment processing, communications, and analytics. A full and current list of sub-processors, including their jurisdiction and processing purpose, is maintained and provided to customers on request. We provide at least 30 days' notice of any intended change, allowing customers to object.

FXCRM implements the technical and organisational measures required by Article 32 GDPR:

• AES-256 encryption at rest, TLS 1.3 in transit
• Role-based access control, MFA, hardware security keys for privileged roles
• ISO 27001 aligned information security management
• Continuous vulnerability scanning, annual penetration testing, and red-team exercises
• Segregated environments, immutable audit logs, and 15-minute point-in-time recovery

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. Regulated financial records are retained for a minimum of five years after the end of the client relationship. Marketing consents lapse after 24 months of inactivity unless renewed.

FXCRM will notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach likely to result in a risk to the rights and freedoms of individuals, and will notify affected data subjects without undue delay where the risk is high. Full internal breach registers are maintained regardless of notification threshold.

If you believe FXCRM has not handled your personal data in accordance with the GDPR, please first contact our DPO. You also have the right to lodge a complaint directly with your national supervisory authority (for example, the UK Information Commissioner's Office at ico.org.uk).