Privacy Policy

This Privacy Policy explains how CFIN ("we", "us", "our") collects, uses, discloses, and protects your personal information when you use our algorithmic trading service.

Data Controller: CFIN is the data controller responsible for your personal data. We are committed to transparency and protecting your privacy rights.

Scope: This policy applies to all users of the CFIN platform, including visitors to our website, registered users, and subscription holders.

We collect the following categories of personal data:

1. Personal Information

• Name: First name and last name
• Contact Details: Email address, phone number (with country code)
• Address: Street address, city, postal code, country of residence
• Date of Birth: To verify you are at least 21 years of age
• Invitation/Referral Code: Required for registration (CFIN is invite-only). This code links you to the existing member who invited you and enables the referral discount program.
• Promo/Discount Codes: Any promotional codes applied to your account

2. Identity Verification (KYC) Data

• Government-issued photo identification (passport, driver's license, national ID)
• Proof of address documents (utility bills, bank statements)
• Tax identification number or equivalent
• Source of funds documentation (when required)
• Selfie photos for identity verification

3. Financial Information

• Payment Card Details: Processed securely by Stripe (PCI-DSS compliant)
• Subscription Information: Plan type, billing cycle, add-ons selected
• Billing History: Invoices, payment receipts, refund records
• Pricing Currency: Display currency preference (EUR/USD/GBP)

4. MT5 Trading Account Data

• MT5 Credentials: Login, password, server name (encrypted with AES-256)
• Account Metrics: Balance, equity, margin, margin level
• Trading Data: Open positions, pending orders, trade history
• Performance Data: Profit/loss, win rate, drawdown, trade statistics
• Account Currency: Base currency of your MT5 account

5. Technical & Usage Data

• IP Address: For security, fraud prevention, and geo-location
• Device Information: Browser type, operating system, device type
• Cookies: Session cookies, preference cookies, analytics cookies
• Usage Logs: Pages viewed, features used, time spent on platform
• Login History: Login timestamps, IP addresses, device fingerprints

6. Verification Data

• Email Verification: Verification codes sent to your email address to confirm ownership
• Address Verification: Address data verified via OpenStreetMap Nominatim API to confirm valid addresses
• MT5 Credential Verification: MT5 login credentials verified against broker servers to confirm account access
• Verification Timestamps: Records of when each verification was completed

7. Communication Data

• Email correspondence with our support team
• Chat messages and support tickets
• Feedback and survey responses
• Social media interactions

8. Information from Third Parties

• Payment Processor (Stripe): Payment confirmation, fraud signals
• MT5 Broker (Blueberry Markets): Account verification, trade execution confirmations
• MTAPI.io: Real-time trading data, account status
• OpenStreetMap Nominatim: Address validation and geocoding (publicly available data)
• Public Databases: For KYC/AML verification purposes

We process your personal data for the following purposes:

Service Delivery

• Provide, operate, and maintain the CFIN algorithmic trading service
• Connect to your MT5 account via MTAPI.io and execute trades
• Monitor account performance and generate real-time reports
• Deliver dashboard features, analytics, and performance metrics
• Apply EA (Expert Advisor) settings and trading parameters

Account Management

• Create and manage your CFIN user account
• Authenticate your identity when you log in
• Verify your email address via verification codes
• Validate your address using third-party geocoding services
• Verify your MT5 credentials against broker servers
• Process subscription upgrades, downgrades, and cancellations
• Remember your preferences (theme, currency, language)

Payment Processing

• Process monthly subscription payments via Stripe
• Calculate performance-based fees
• Generate invoices and payment receipts
• Handle refund requests (subject to our no-refund policy)
• Manage add-ons (withdrawal permissions, manual trading, linear growth, priority support)
• Apply referral discounts to your billing cycle
• Validate and apply promotional codes
• Track referral relationships for discount purposes

Compliance & Security

• Verify your identity (Know Your Customer - KYC)
• Comply with Anti-Money Laundering (AML) regulations
• Detect and prevent fraud, unauthorized access, and abuse
• Monitor for suspicious activity and security threats
• Report suspicious activities to authorities when required by law

Communications

• Send transactional emails (account notifications, payment confirmations, trading alerts)
• Notify you of important service updates, terms changes, or pricing adjustments
• Provide customer support and respond to your inquiries
• Send marketing communications (only with your consent - opt-out available)

Service Improvement

• Analyze usage patterns to improve platform features
• Optimize trading algorithm performance
• Conduct A/B testing for UX improvements
• Debug technical issues and fix bugs

Legal Obligations

• Comply with tax reporting requirements
• Respond to legal requests from authorities
• Enforce our Terms of Service and legal disclaimer
• Maintain records as required by financial regulations

Under GDPR, we process your personal data based on the following legal bases:

1. Contractual Necessity (Article 6(1)(b))

Processing necessary to provide the trading service you subscribed to:

• Account creation and management
• MT5 account connection and trade execution
• Performance monitoring and reporting
• Payment processing and billing

2. Consent (Article 6(1)(a))

Where you have explicitly consented to processing:

• Marketing communications and newsletters
• Optional analytics cookies
• Promotional offers and updates

You may withdraw consent at any time by contacting us or clicking "unsubscribe" in emails.

3. Legal Obligation (Article 6(1)(c))

Processing required by law:

• KYC/AML identity verification
• Tax reporting and record-keeping
• Responding to lawful requests from authorities
• Financial regulations compliance

4. Legitimate Interest (Article 6(1)(f))

Processing necessary for our legitimate business interests (balanced against your rights):

• Fraud detection and prevention
• Network and information security
• Improving service quality and features
• Analyzing usage patterns (anonymized data)
• Enforcing our Terms of Service

We may share your data with the following third parties:

1. Payment Processor

Stripe (PCI-DSS Level 1 Compliant)

• Data Shared: Payment card details, billing information, email address
• Purpose: Process subscription payments securely
• Location: USA (adequate protection under Privacy Shield successor)
• Privacy Policy: stripe.com/privacy

2. Email Service Provider

Resend

• Data Shared: Email address, name, email content
• Purpose: Deliver transactional and marketing emails
• Privacy Policy: resend.com/privacy

3. MT5 Connectivity Provider

MTAPI.io

• Data Shared: MT5 login credentials (encrypted), trading account data
• Purpose: Connect to your MT5 account and execute trades
• Security: End-to-end encryption, no data retention

4. Your MT5 Broker

Blueberry Markets (or your chosen broker)

• Data Shared: Trading signals, order execution requests
• Purpose: Execute trades on your behalf
• Note: Your broker has its own privacy policy governing their data handling

5. Address Verification Service

OpenStreetMap Nominatim

• Data Shared: Street address, city, postal code, country (for address verification during registration)
• Purpose: Validate that provided addresses are real and correctly formatted
• Privacy Policy: OpenStreetMap Foundation Privacy Policy
• Note: Nominatim is a publicly accessible geocoding service; no account-level data is shared

6. Cloud Infrastructure Providers

Hosting & Database Services

• Data Shared: All data stored in our databases
• Purpose: Securely host the CFIN platform
• Security: Encrypted at rest and in transit, access-controlled

7. Legal Authorities

• When Required: By law, court order, or regulatory request
• Purpose: Comply with legal obligations, prevent illegal activity
• Examples: Tax authorities, financial regulators, law enforcement

Third-Party Safeguards

All third-party service providers are:

• Contractually obligated to protect your data
• Prohibited from using your data for their own purposes
• Required to comply with GDPR and applicable data protection laws
• Subject to regular security audits

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy and comply with legal obligations:

Active Subscriptions

• Duration: Throughout your active subscription
• Data Retained: All personal data, trading data, and account information
• Purpose: Provide ongoing service

Cancelled Subscriptions

• Personal Data: Deleted within 30 days of cancellation (unless retention required by law)
• MT5 Credentials: Immediately deleted upon cancellation
• Exceptions: Data retained for legal compliance (see below)

Legal Retention Requirements

• Trading Records: 7 years (tax and regulatory compliance)
• KYC Documents: 5 years after account closure (AML regulations)
• Financial Records: 10 years (accounting and tax laws)
• Invoices & Receipts: 7 years (VAT and tax requirements)

Marketing Data

• Duration: Until you unsubscribe or request deletion
• Unsubscribe: Immediately removed from marketing lists

Technical Logs

• Access Logs: 90 days (security and debugging)
• Error Logs: 30 days
• Analytics Data: Anonymized after 12 months

Automated Deletion

We have automated systems in place to delete data when retention periods expire. However, you may request earlier deletion subject to legal restrictions (see "Your GDPR Rights" below).

1. Right of Access (Article 15)

You have the right to request a copy of all personal data we hold about you.

• We will provide this within 30 days of your request
• The first copy is free; additional copies may incur a reasonable fee
• Data will be provided in a structured, commonly used format (PDF or JSON)

2. Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete personal data.

• Update your profile information directly in your dashboard
• Contact us at privacy@cfin.be for data we hold that you cannot update yourself

3. Right to Erasure ("Right to be Forgotten") (Article 17)

You can request deletion of your personal data when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent (for processing based on consent)
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Exceptions: We may retain data when required by law (e.g., tax records, AML documentation).

4. Right to Restriction of Processing (Article 18)

You can request we limit how we use your data in certain circumstances:

• You contest the accuracy of the data (while we verify it)
• Processing is unlawful but you prefer restriction over deletion
• We no longer need the data, but you need it for legal claims

5. Right to Data Portability (Article 20)

You can request your data in a machine-readable format to transfer to another service:

• Applies to data provided to us (personal info, trading history)
• Provided in JSON or CSV format
• Available for data processed based on consent or contract

6. Right to Object (Article 21)

You can object to processing of your personal data:

• Marketing: Unsubscribe anytime (immediate effect)
• Profiling/Automated Decisions: Object to algorithmic decision-making
• Legitimate Interest Processing: We must cease unless we have compelling grounds

7. Right to Withdraw Consent (Article 7(3))

Where processing is based on your consent, you can withdraw it at any time:

• Marketing emails: Click "unsubscribe" in any email
• Cookies: Adjust cookie settings in your browser
• Account: Cancel your subscription anytime

8. Right to Lodge a Complaint

If you believe we have violated your data protection rights, you can file a complaint with:

• Belgian Data Protection Authority (APD/GBA): dataprotectionauthority.be
• Your national data protection authority (if you reside outside Belgium)

How to Exercise Your Rights

To exercise any of these rights, contact us at:

• Email: privacy@cfin.be
• Subject Line: "GDPR Request - [Type of Request]"
• Include: Full name, email address, specific request

We will respond within 30 days. If your request is complex, we may extend this by 60 days and will notify you.

We implement industry-standard security measures to protect your personal data from unauthorized access, disclosure, alteration, and destruction.

Technical Security Measures

• Encryption in Transit: All data transmitted over the internet is encrypted using TLS 1.3 (HTTPS)
• Encryption at Rest: Sensitive data (MT5 credentials, passwords) encrypted with AES-256
• Secure Password Storage: Passwords hashed using bcrypt with salting
• Database Security: Access-controlled databases with role-based permissions
• API Security: Rate limiting, authentication tokens, CORS policies
• DDoS Protection: Traffic filtering and mitigation

Organizational Security Measures

• Access Control: Only authorized personnel can access personal data (need-to-know basis)
• Employee Training: Staff trained on GDPR compliance and data protection
• Confidentiality Agreements: All employees and contractors sign NDAs
• Regular Audits: Quarterly security assessments and vulnerability scans
• Incident Response Plan: Documented procedures for data breaches

Payment Security

• PCI-DSS Compliance: Payment card data processed by Stripe (Level 1 certified)
• No Card Storage: We do NOT store full payment card details on our servers
• Tokenization: Payment tokens used instead of raw card data

User Security Responsibilities

You are responsible for:

• Keeping your login password secure and confidential
• Not sharing your MT5 credentials with third parties
• Logging out when using shared or public computers
• Reporting suspicious activity to security@cfin.be immediately

Data Breach Notification

In the unlikely event of a data breach affecting your personal data, we will:

• Notify you within 72 hours of discovering the breach
• Inform the Belgian Data Protection Authority (if required by law)
• Provide details of the breach, affected data, and remediation steps
• Offer guidance on protecting yourself (e.g., password reset)

CFIN uses cookies and similar tracking technologies to enhance your experience and analyze platform usage.

What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us remember your preferences and understand how you use our service.

Types of Cookies We Use

1. Essential Cookies (Always Active)

Purpose: Required for the website to function properly. Cannot be disabled.

• Session Cookies: Maintain your login session
• Security Cookies: Protect against CSRF attacks
• Load Balancing: Distribute traffic across servers
• Duration: Session (deleted when you close your browser) or 30 days

2. Preference Cookies (Optional)

Purpose: Remember your settings and preferences.

• Theme preference: Light/dark mode
• Currency selection: EUR/USD/GBP
• Language: Preferred language
• Duration: 1 year

3. Analytics Cookies (Optional - Requires Consent)

Purpose: Help us understand how users interact with the platform.

• Page views: Which pages are most visited
• Feature usage: Which features are used most often
• Performance metrics: Page load times, errors
• User flow: Navigation patterns
• Duration: 2 years

Note: Analytics data is anonymized and aggregated. No personally identifiable information is tracked.

4. Marketing Cookies (Optional - Requires Consent)

Purpose: Track effectiveness of marketing campaigns (if applicable).

• Referral source: How you found CFIN
• Campaign tracking: Which ads or promotions brought you here
• Duration: 90 days

Third-Party Cookies

We may allow trusted third parties to set cookies for:

• Stripe: Payment processing (essential)
• Analytics providers: Usage statistics (with consent)

Managing Cookies

You have full control over cookies:

• Cookie Consent Banner: Accept or reject non-essential cookies when you first visit
• Cookie Settings: Update your preferences anytime in your account settings
• Browser Settings: Block or delete cookies through your browser

Browser Cookie Controls

• Chrome: Settings > Privacy and Security > Cookies
• Firefox: Options > Privacy & Security > Cookies
• Safari: Preferences > Privacy > Cookies
• Edge: Settings > Cookies and site permissions

Warning: Blocking essential cookies may prevent you from using certain features of the CFIN platform.

For more details, see our Cookie Policy.

CFIN is based in Belgium (EU). However, some of our service providers are located outside the European Economic Area (EEA).

Transfers Outside the EEA

Your personal data may be transferred to and processed in:

• United States: Stripe (payment processing), hosting providers
• Other jurisdictions: Email service providers, analytics tools

Safeguards for International Transfers

When transferring data outside the EEA, we ensure adequate protection through:

1. Standard Contractual Clauses (SCCs)

EU-approved contract terms that require third parties to protect your data with GDPR-equivalent safeguards.

2. Adequacy Decisions

Transfers to countries recognized by the EU Commission as providing adequate data protection (e.g., UK, Switzerland).

3. Privacy Shield Successor (US)

For US-based processors (like Stripe), we rely on the EU-US Data Privacy Framework or similar mechanisms approved by EU regulators.

4. Contractual Obligations

All third-party processors are contractually required to:

• Implement appropriate technical and organizational security measures
• Process data only on our instructions
• Notify us of data breaches within 24 hours
• Assist with GDPR compliance (subject access requests, etc.)

Your Rights for International Transfers

You have the right to:

• Request information about which countries your data is transferred to
• Request a copy of the safeguards in place (SCCs, etc.)
• Object to transfers if you believe they are not adequately protected

Contact privacy@cfin.be for more information.

CFIN sends various types of emails. Some are essential for service delivery, while others are optional.

Transactional Emails (Cannot Opt Out)

These emails are necessary to provide the service you subscribed to:

• Account Verification: Confirm your email address during registration
• Payment Confirmations: Receipt of successful payments
• Payment Failures: Notification of failed payment attempts
• Trial Expiration: Notice before trial period ends
• Renewal Reminders: Upcoming subscription renewals
• Trading Alerts: Daily loss limit, loss streak warnings, margin warnings
• Account Changes: Password resets, email changes, subscription updates
• Security Alerts: Unusual login activity, account security issues

Legal Basis: Contractual necessity (GDPR Article 6(1)(b))

Service Updates (Cannot Opt Out)

Important notices about changes to the service:

• Terms of Service or Privacy Policy updates
• Pricing changes (minimum 30 days notice)
• Platform maintenance or downtime
• Critical security updates

Legal Basis: Legitimate interest and legal obligation

Marketing Emails (Optional - Requires Consent)

Promotional content you can opt out of anytime:

• New features and product updates
• Educational content (trading tips, market insights)
• Special offers and promotions
• Referral program updates

Legal Basis: Consent (GDPR Article 6(1)(a))

How to Unsubscribe from Marketing Emails

• Click the "Unsubscribe" link at the bottom of any marketing email
• Update your email preferences in your account settings
• Email us at support@cfin.be with "Unsubscribe" in the subject line

You will be removed from our marketing list within 48 hours.

Email Data Processing

When you receive an email from us:

• Open Tracking: We may track if you open emails (marketing only, not transactional)
• Click Tracking: We may track which links you click
• Purpose: Improve email content and measure campaign effectiveness
• Opt Out: Disable image loading in your email client to prevent tracking

Age Verification

During registration, we:

• Require you to provide your date of birth
• Verify you are at least 21 years old
• May request identity documents (passport, driver's license) to confirm age
• Reject registrations from individuals under 21

Why 21+?

Algorithmic trading involves significant financial risk. The 21+ requirement ensures:

• Legal capacity to enter into binding financial contracts
• Sufficient maturity to understand trading risks
• Compliance with financial regulations in various jurisdictions

If We Discover an Underage User

If we discover that a user is under 21, we will:

• Immediately suspend the account
• Delete all personal data (except as required for refund processing)
• Process a full refund of any payments made
• Notify the user via email

Parental Notice

If you are a parent or guardian and believe your child under 21 has provided personal information to CFIN, please contact us immediately at privacy@cfin.be so we can delete the data and close the account.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features.

How We Notify You of Changes

• Email Notification: For material changes that affect your rights, we will email you at least 30 days before the changes take effect
• Website Notice: A prominent banner will appear on the website notifying you of policy updates
• "Last Updated" Date: Always displayed at the top of this policy

Types of Changes

Minor Changes (No Notification Required)

Clarifications, typo corrections, formatting improvements - no impact on your rights.

Material Changes (Email Notification)

Changes that affect how we collect, use, or share your data, including:

• New categories of personal data collected
• Changes to data retention periods
• Additional third-party service providers
• Changes to your GDPR rights
• New purposes for data processing

Your Acceptance of Changes

By continuing to use CFIN after changes take effect, you accept the updated Privacy Policy. If you do not agree with the changes:

• You may cancel your subscription before the effective date
• We will process cancellation under the previous policy terms
• You may request deletion of your personal data (subject to legal retention requirements)

Version History

Previous versions of this Privacy Policy are available upon request at privacy@cfin.be.

For any questions, concerns, or requests related to this Privacy Policy or your personal data, you can reach us at:

Data Protection Officer (DPO)

• Email: privacy@cfin.be
• Subject Line: Use "Privacy Inquiry" or "GDPR Request"

General Support

• Email: support@cfin.be
• Response Time: Within 24-48 hours

Security Issues

• Email: security@cfin.be
• For: Suspected data breaches, vulnerabilities, unauthorized access

Postal Address

CFIN
[Business Address]
Belgium

Supervisory Authority

If you are not satisfied with our response to a privacy concern, you may lodge a complaint with:

Belgian Data Protection Authority (APD/GBA)
Rue de la Presse 35
1000 Brussels, Belgium
Website: dataprotectionauthority.be
Email: contact@apd-gba.be

Response Timeframes

• GDPR Requests: 30 days (may extend to 90 days for complex requests)
• General Inquiries: 24-48 hours
• Security Issues: Immediate acknowledgment, resolution depends on severity