Privacy Policy

This Privacy Policy describes how Velovestor Ltd. (“Velovestor”, “we”, “us”, or “our”), a company registered in England and Wales with registered offices at 1 Canada Square, Canary Wharf, London, E14 5AB, United Kingdom, collects, uses, and protects your personal data when you use our trading platform and related services (“Services”).

We are committed to protecting your privacy and processing your personal data in accordance with applicable data protection laws, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and where applicable, the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection.

1. Information We Collect

1.1 Information You Provide Directly

• Account registration data: Full name, email address, date of birth, country of residence, and password.
• Identity verification (KYC) data: Government-issued identity documents (passport, national ID card, or driving licence), selfie photographs, and proof of address documents.
• Financial information: Bank account details, cryptocurrency wallet addresses, and payment method information for deposit and withdrawal processing.
• Communications: The content of messages you send to our support team, feedback forms, or any other direct correspondence.

1.2 Information Collected Automatically

• Usage data: Pages visited, features accessed, trading activity (assets traded, trade amounts, durations, outcomes), and session durations.
• Technical data: IP address, browser type and version, operating system, device identifiers, and referring URLs.
• Cookies and similar technologies: Session tokens, preference cookies, and analytics identifiers. Please refer to our Cookie Policy for full details.

2. How We Use Your Information

We process your personal data for the following purposes:

• Service provision: To create and manage your account, process transactions, provide trading functionality, and deliver customer support.
• Identity verification and compliance: To verify your identity, conduct anti-money laundering (AML) checks, and comply with Know Your Customer (KYC) obligations as required by applicable law.
• Security: To detect and prevent fraud, unauthorised access, and other malicious activity.
• Communication: To send you transactional notifications (trade confirmations, deposit/withdrawal updates), service announcements, and — where you have consented — promotional communications.
• Platform improvement: To analyse usage patterns, troubleshoot technical issues, and develop new features and functionality.
• Legal compliance: To fulfil our obligations under applicable laws, respond to lawful requests from regulatory or law enforcement authorities, and to establish, exercise, or defend legal claims.

3. Legal Basis for Processing

Where the UK GDPR applies, we process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Services you have requested (e.g., executing trades, processing deposits).
• Legal obligation: Processing required to comply with our legal and regulatory obligations (e.g., KYC/AML obligations, tax reporting).
• Legitimate interests: Processing for our legitimate business interests, such as fraud prevention, platform security, and service improvement, where these interests are not overridden by your rights.
• Consent: Where we have obtained your explicit consent, such as for the sending of marketing communications. You may withdraw your consent at any time.

4. Sharing Your Information

We do not sell your personal data. We may share your data with the following categories of third parties:

• Service providers: Payment processors, identity verification services, cloud infrastructure providers, and analytics platforms that process data on our behalf under strict confidentiality and data processing agreements.
• Regulatory and law enforcement authorities: Where required by law, court order, or regulatory obligation.
• Professional advisers: Solicitors, accountants, and auditors bound by professional confidentiality obligations.
• Business successors: In the event of a merger, acquisition, or sale of all or part of our business, subject to appropriate data protection obligations.

5. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention periods:

• Account and trading data: Retained for the duration of your account relationship and for a minimum of 5 years following account closure, as required by applicable AML and financial services regulations.
• KYC/identity documents: Retained for a minimum of 5 years from the date of account closure or the last transaction, in accordance with UK and UAE AML requirements.
• Marketing data: Retained until you opt out or withdraw consent.
• Support communications: Retained for 3 years from the date of last communication.

6. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

• Right of access: To request a copy of the personal data we hold about you.
• Right of rectification: To request correction of inaccurate or incomplete personal data.
• Right of erasure: To request deletion of your personal data, subject to our legal obligations to retain certain data.
• Right to restriction of processing: To request that we limit the way we use your data in certain circumstances.
• Right to data portability: To receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: To object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making: Not to be subject to decisions made solely by automated means that produce legal or similarly significant effects.

To exercise any of these rights, please contact us at privacy@velovestor.com. We will respond within one month of receipt of your request. We may require proof of identity before processing your request.

7. International Data Transfers

As an international organisation, we may transfer your personal data to countries outside the United Kingdom and the European Economic Area, including to our operations in the United Arab Emirates. Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO), or reliance on adequacy decisions where applicable.

8. Security

We implement robust technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include AES-256-GCM encryption for sensitive data at rest, TLS encryption for all data in transit, multi-factor authentication, and regular independent security audits.

Notwithstanding these measures, no method of electronic transmission or storage is 100% secure. We encourage you to use a strong, unique password for your account and to enable two-factor authentication.

9. Cookies

We use cookies and similar tracking technologies on our platform. For full details of the cookies we use, why we use them, and how to manage your preferences, please refer to our Cookie Policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. We will notify you of material changes by posting a notice on our platform or by sending an email to your registered address. The date of the most recent revision is shown at the top of this Policy. Your continued use of our Services following notification of changes constitutes acceptance of the updated Policy.

11. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the relevant supervisory authority:

• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
• United Arab Emirates: UAE Data Office — tdra.gov.ae

We would, however, appreciate the opportunity to address your concerns before you approach a regulator, and invite you to contact us in the first instance.

12. Contact

For any privacy-related enquiries, requests, or complaints, please contact our Data Protection team at:

Email: privacy@velovestor.com
Post: Data Protection Officer, Velovestor Ltd., 1 Canada Square, Canary Wharf, London, E14 5AB, United Kingdom