PrivacyPolicy.

Introduction

This policy explains how xtbsolution handles personal data for website visitors, account holders and platform users. It follows GDPR, UK GDPR and similar laws where they apply, and should be read alongside our Terms and Conditions and any notice given when data is collected.

Who we are

xtbsolution is a trading name of [LEGAL ENTITY NAME], registered in [JURISDICTION] under number [REGISTRATION NUMBER], with its registered office at [ADDRESS] and regulated by [REGULATOR]. That company is the data controller. Our Data Protection Officer handles privacy requests at [email protected] (subject: "Data Protection").

Information we collect

As a regulated provider we collect data for identity verification, suitability checks and anti-money-laundering compliance, including:

• Identity and contact details, ID documents and verification photos or video
• Financial information such as income, source of funds and bank or card details
• Trading knowledge and experience
• Transaction history
• Technical and usage data
• Call recordings, chat transcripts and correspondence
• Marketing preferences

We do not intentionally collect special category data. A religious preference is recorded only if you request a swap-free account.

How we collect your information

Directly from you (forms, uploads, funding, trading and contact); automatically through cookies and logs; and from third parties such as identity verification, fraud and sanctions screening, credit reference agencies, payment providers, introducing brokers, affiliates and public sources.

How we use it and our legal basis

We rely on four legal bases:

• Contract: account administration, order handling, deposits, withdrawals and support.
• Legal obligation: identity and sanctions checks, appropriateness assessments, regulatory reporting and complaints.
• Legitimate interests: security, fraud and market-abuse prevention, service improvement and analytics, risk management and legal claims.
• Consent: marketing where required and non-essential cookies. You can withdraw consent at any time.

Cookies and similar technologies

We use cookies to run the site securely, remember preferences, analyse use and, with consent, measure marketing. Categories: strictly necessary, performance and analytics, functionality, and marketing. Manage them through the cookie banner or your browser; blocking some may affect how the site works.

How we share your information

We do not sell personal data. We may share it with group companies; service providers (IT, hosting, verification, payments, support and advisers); banks and execution venues; introducers or affiliates who referred you; regulators and authorities where legally required; and prospective buyers in a merger or restructuring under confidentiality. Third parties may process data only on our instructions.

International transfers

Because our clients and providers are global, data may be processed outside your home country. We rely on adequacy decisions, approved standard contractual clauses or other lawful safeguards. Ask us for details.

Data retention

We keep data only as long as needed for its purposes and our legal, tax and reporting duties: generally five to seven years after the relationship ends depending on jurisdiction, and longer where needed for complaints, investigations or claims. Data is then deleted or anonymised.

How we protect your information

Encryption in transit and at rest, access controls, two-factor authentication, network monitoring, security testing and staff training. No system is completely secure, so please protect your credentials, enable two-factor authentication and report suspected unauthorised access promptly.

Your rights

Depending on where you live, you may request access, correction, erasure (subject to legal retention), restriction, portability, objection (including to direct marketing) and withdrawal of consent. Email [email protected]; we may need to verify your identity and aim to respond within one month. You may also complain to your local data protection authority, though we ask that you contact us first.

Marketing communications

We send marketing where permitted or with your consent. Opt out any time via unsubscribe links, portal settings or by contacting us. Opting out does not stop essential account messages such as margin notices, statements and regulatory notices.

Children's privacy

Our services are for adults aged 18 or over (or the age of majority where higher). We do not knowingly collect data from minors and delete it promptly if discovered.

Third-party websites

Links to external sites, plug-ins and apps may collect data under their own policies. We don't control those practices, so please read each site's privacy policy.

Changes to this policy

We may update this policy to reflect changes in our practices, technology or the law. The "Last updated" date shows the latest revision, and significant changes are communicated by email or through the client portal.

Contact us

Questions go to our Data Protection Officer at [email protected], or by post to the registered office listed in section 2.