Privacy policy

When using our services we process personal data of our customers (“you”, “your” or the “Customer”). This Privacy Policy (the “Policy”) provides you with information about how your data are processed.

In this Privacy Policy, you will find information regarding the following:

1. Who is the controller of your personal data and whom to contact?
2. What information do we collect about you and how do we obtain it?
3. How do we use your personal data?
4. How do we store personal data and how are they secured?
5. How long do we process your data?
6. Data sharing and transfers to third countries
7. Your rights
8. Final provisions

The controller of personal data is HYRO TECHNOLOGIES FZ-LLC, a Free Zone Limited Liability Company incorporated in the Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates, with company number FDBC5283, commercial licence number 47034334, and registered address Compass Building, Al Shohada Road, Al Hamra Industrial Zone – FZ, Ras Al Khaimah, United Arab Emirates (hereinafter referred to as “we”, “our”, “our Company”, the “Provider”, or “Controller”). The Provider is the controller of personal data processed in connection with the Service and is your sole contracting party under the Terms and Conditions.

We are established in the Ras Al Khaimah Economic Zone free zone in the United Arab Emirates, and we comply with the data protection law applicable to us there. Where the General Data Protection Regulation (Regulation (EU) 2016/679) or the United Kingdom General Data Protection Regulation applies to the processing of your personal data, we comply with that Regulation in respect of that processing as well, and this Policy describes the rights it gives you.

For customers in the European Economic Area and the United Kingdom, card and other fiat payment methods are made available through Hyro Finance, j. s. a., a company incorporated in the Slovak Republic with company identification number (IČO) 55072275 and registered seat at Kopčianska 10, 851 01 Bratislava — mestská časť Petržalka, Slovak Republic (the “EEA Commercial Agent”). The EEA Commercial Agent is the Controller’s authorised commercial agent for the European market and receives payments for the Controller’s account. Where it processes personal data in order to conclude your entry into the Challenge Program and to handle payment and the return of a Refundable Challenge Deposit, it does so as a separate controller in respect of the payment relationship; in every other respect it processes personal data on the Controller’s behalf and only on the Controller’s instructions, as a processor.

The Controller has also appointed Hyro Finance, j. s. a., company identification number (IČO) 55072275, registered seat at Kopčianska 10, 851 01 Bratislava — mestská časť Petržalka, Slovak Republic, as its representative in the European Union under Article 27 of the General Data Protection Regulation. Where that Regulation applies to the processing of your personal data, you may contact the representative at the address above on any matter relating to that processing, including the exercise of any of the rights described in Section 7 of this Policy. The representative acts on the Controller's behalf in that capacity only. It is not the controller of the personal data processed in connection with the Service, and contacting it does not alter the Controller's responsibility for that processing or the narrower controllership described in the paragraph above.

HYROTRADER TECHNOLOGIES LTD, a company incorporated in the British Virgin Islands under company number 2166693 and registered at Intershore Chambers, Road Town, Tortola, British Virgin Islands, owns the platform software and the HyroTrader brand and operates the Funded Trader Phase as the Funded Trader Entity. It receives cryptocurrency payments for the Controller’s account. Where you enter into a Funded Trader Agreement with it, it processes your personal data as a separate controller for the purposes of that agreement and of the rewards paid under it.

You can contact us at HYRO TECHNOLOGIES FZ-LLC, Compass Building, Al Shohada Road, Al Hamra Industrial Zone – FZ, Ras Al Khaimah, United Arab Emirates, or at [email protected]

In this section, you can read general information about which of your personal data we collect and how we collect it. Detailed information on the purposes for which we process personal data is given in Section 3 of this Policy. All information on the basis of which we can directly or indirectly identify you or which is related to you is considered personal data.

We obtain most of the data we collect about you directly from you in connection with your use of our services. This includes, in particular:

1. other data, such as records of communication between you and our company or details of any warranty claims; and identity-verification data, where we are required to verify your identity, namely a government-issued photo identification document, a selfie or short live-video verification, proof of address, a source-of-funds declaration and, where applicable, a record of a video interview.
2. Data that we automatically collect when you use our services. These are data about your device (such as the IP address, device type, operating system, browser used, connection provider); website usage data (such as the date, time and duration of visit, a country from which you visit the website, website browsing history), and data on the use of services (such as the login and logout information, your account settings, the value of your fictitious capital, your account currency, business strategy).

Some data about you is provided to us by third parties, such as providers of trading platforms that you choose for use of our services, and social network operators if you decide to link your social networking accounts to an account on the website. This includes:

3. time of opening and closing the position, position size, profit and loss

We use personal data for the following purposes:

• Registration and user account

In order to use the services, you must register on the website and create your account, and for this purpose we process your personal data.

Personal data: identification and contact data; we may also process your data related to the settings of your user account.

Legal ground for the processing: Processing is necessary for the performance of the contract, and the provision of these personal data is required, as we cannot register your user account without them.

• Provision of services and exercise of rights and obligations under the contract between us and the customer

In order to be able to provide you with our services, i.e. in particular to provide you with the relevant access, tools and support, and to carry out trades, we need to process your personal data. For this purpose, the following shall apply:

Personal data: Identification and contact data and, in the case of paid services, also payment data, data on the use of the services, data on the simulated trades and, if you decide to link your social networks accounts with the account on the website, also data from social networks.

Legal ground for the processing: Processing is necessary for the performance of the contract on the basis of which we provide our services, or on the basis of our legitimate interest. After we stop providing you with services, we process personal information for a limited period of time. Such processing is necessary for the purposes of exercising and protecting our rights based on our legitimate interests.

• Marketing communication about our services and products or about events in which we take part

If you are our current or past customer, we may from time to time send you marketing communications that relate to our services. We may also send you commercial communications to the extent to which you give us your consent. Each of the e-mails sent will be marked as a business communication and each of them will contain a link with the help of which you can easily unsubscribe from the business communications. For this purpose, the following shall apply:

Personal data: Identification and contact data.

Legal ground for the processing: If we have provided you with our services, we may from time to time send you marketing communications based on our legitimate interest, namely keeping in touch with our customers. If you give us your consent to process your data for marketing purposes, then we process your data on the basis thereof.

• Customer support and communication

If you use our customer support services, we will process your personal data. For this purpose, the following shall apply:

Personal data: Identification data, contact data, other data and data from social networks, if you contact us through social networks.

Legal ground for the processing: Processing is based on our legitimate interest, namely in maintaining customer satisfaction and supporting the use of our services.

• Improving services

If you use some of our services, we will process your personal data in order to develop, test and enhance the services and improve their security. For this purpose, the following shall apply:

Personal data: Identification and contact data, data about your device, website usage data, data on the use of the services, and data on the simulated trades.

Legal ground for the processing: Processing is based on our legitimate interest, namely in improving our services.

• Analytics

To obtain information about how our website and our services are used, we analyse customer behaviour. For this purpose, the following shall apply:

Personal data: Identification data, contact data, payment data, data about your device, website usage data, data on the use of the services, and data on the simulated trades.

Legal ground for the processing: Processing is based on our legitimate interest, namely in ascertaining customer behaviour and estimating customer preferences.

Verification is carried out through Sumsub, a third-party identity-verification and compliance provider, together with our own internal procedures. Sumsub processes your personal data on our behalf and on our instructions, as our processor, for the purposes of identity verification and screening. Where Sumsub processes personal data as a controller for its own compliance purposes, that processing is governed by its own terms and privacy notice and not by this Policy.

Personal data: Identification and contact data, identity-verification data (a government-issued photo identification document, a selfie or short live-video verification, proof of address, a source-of-funds declaration and, where applicable, a record of a video interview), payment data, and data on the use of the services.

Legal ground for the processing: Processing is necessary for compliance with our legal obligations relating to know-your-customer, anti-money-laundering, counter-terrorism-financing and sanctions screening. Where those obligations do not apply to us directly, the processing is necessary for the performance of the contract between us and is based on our legitimate interest in preventing fraud and financial crime.

We process your personal data in an encrypted database on computers and other devices. In order to ensure protection against unauthorised access or unauthorised alteration, disclosure or destruction of the data that we collect and process, we have adopted organisational and technical measures to secure them, which we strictly adhere to.

Personal data are processed only as long as necessary for the purposes described or as required by law.

1. Contract performance: max. 10 years from termination.
2. Marketing without consent: max. 5 years.
3. Service improvement: usually max. 6 months.
4. Legal obligations: according to applicable regulations (e.g. tax 10 years). Identity-verification, anti-money-laundering and sanctions-screening records are retained for the period required by applicable law, which may be longer than the periods above.
5. Based on consent: for the period specified in consent.

We make your data available or transfer them to persons that help us provide our services, in particular the following persons:

1. The trading platform provider, in order to enable you to perform the simulated trades.
2. payment system operators, payment service providers and financial institutions, identity-verification and compliance providers, providers of customer support tools and services

In addition, we may transfer your data to persons in respect of which you give your consent thereto, as well as in the cases where it is our obligation under the law or under a judicial or any other legally binding decision. Each such entity to whom personal data are transferred is contractually obligated to protect your personal data in accordance with legal provisions and to process the data exclusively according to our instructions.

Certain third parties collect personal data for their own purposes as controllers. In such a case, their own rules for the processing of personal data shall apply.

The specific recipients we currently use include: the provider of the trading platform or terminal you select, in order to enable you to perform the simulated trades; Sumsub, which carries out identity verification and screening as described in Section 3; the EEA Commercial Agent and the payment service providers it uses, in order to take card and other fiat payments and to make any return of a Refundable Challenge Deposit; the Funded Trader Entity, in order to receive cryptocurrency payments and, where you enter into a Funded Trader Agreement, to operate the Funded Trader Phase and pay rewards; and our hosting, cloud, communication, analytics and customer-support suppliers.

We are established in the United Arab Emirates, and some of the suppliers we use are established outside the European Economic Area and the United Kingdom. Your personal data is therefore processed in the United Arab Emirates and may be processed in other countries outside the European Economic Area and the United Kingdom.

Where personal data is transferred out of the European Economic Area or the United Kingdom by us, or by a supplier established in either of those areas, and that transfer requires a safeguard under Chapter V of the General Data Protection Regulation or of the United Kingdom General Data Protection Regulation, the transfer is made using a safeguard permitted by that Chapter, or on another basis permitted by applicable law. You may ask us which safeguard applies to a particular transfer by writing to [email protected], and we will tell you.

Where you provide your personal data to us directly, that provision is not itself a transfer of personal data to a third country. A transfer of that kind requires a controller or processor subject to the General Data Protection Regulation to disclose personal data to a separate controller or processor outside the European Economic Area; when you send your data to us yourself, there is no such disclosing party. The preceding paragraph applies to the onward disclosures that we, or a supplier established in the European Economic Area or the United Kingdom, make.

You can exercise all your rights mentioned below, including your right to erasure of personal data and the withdrawal of your consent, by sending a request to us via email at [email protected], alternatively you can use our contact details in Section 1 of this Privacy Policy. There are no specific words that you must use in your request, but please be specific enough, so we can help you with your request (e.g. identify yourself, specify the right you wish to exercise, what action you wish us to take, details of what personal data you want erased/deleted, etc.)

In connection with the processing of personal data you have the following rights:

• Right of access to personal data

You can ask us at any time to send you a confirmation as to whether or not your personal data are being processed. If we process your data, we will provide you with further details on the processing. If you request it, we will also provide you with a copy of the personal data processed. Please note that the first copy is free of charge, but later copies will be provided for a small fee.

• Right to rectification of personal data

If we process your personal data inaccurately, you can notify us of this fact, and we will rectify the inaccurate personal data without undue delay. If you register on the Website, you will be able to rectify and amend your personal data yourself by editing your user account.

• Right to erasure of personal data (“right to be forgotten”)

You have the right to obtain from us the erasure of personal data concerning you without undue delay in the following cases:

• If the data are no longer necessary in relation to the purposes for which we have collected or otherwise processed them;
• If you withdraw your consent to their processing and, at the same time, there will be no other legal ground for their processing (this only applies in the cases where we process personal data on the basis of your consent);
• If you object and there are no overriding legitimate grounds for the processing, or if you object to the processing for direct marketing purposes; or
• If your personal data are processed unlawfully.

We will not be able to act on the request for the erasure of personal data if their processing is necessary for exercising the right of freedom of expression and information, for compliance with any of our legal obligations, for the performance of a task carried out in the public interest, for the establishment, exercise, or defence of our legal claims, or for other reasons provided for by law.

• Right to restriction of processing

In cases stated in article 18 of the GDPR, you have the right to obtain from us restriction of processing of your personal data for a certain period.

• Right to data portability and to the provision of data in a machine-readable format

In the case of automated processing based on your consent or performance of the contract, you have the right to receive the data in a structured, commonly used and machine-readable format and to have them transmitted by us to another personal data controller.

• Right to object

If we process personal data on the basis of our legitimate interest, you have the right to object to such processing. If you file such an objection, we will not be able to process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests or rights and freedoms, or for the establishment, exercise or defence of our legal claims.

In case we process your personal data for marketing purposes about our products and services, we will terminate the processing without undue delay upon receipt of the objection. In such a case, we will no longer be able to send you offers of our products and services.

• Right to withdraw consent

If processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on the consent given before its withdrawal.

• Right not to be the subject of automated decision-making

Except where processing is necessary for entering into, or performance of, a contract, where this is permitted by applicable law, or based on your express consent, you have the right not to be the subject of any decision which is based solely on automated processing, including profiling, which produces legal effects concerning you or similarly affects you to a significant extent.

How this applies to our services. The rules engine that operates the Service evaluates your challenge automatically against the parameters published in the Trading Rules for the programme you entered. A breach of a loss limit or of another published parameter can therefore end your challenge automatically, at the moment it occurs and without a person reviewing the decision first. That processing is necessary for the performance of the contract between us, under which your trading is assessed against those published parameters.

You may ask us to have such an outcome reviewed by a person, and you may contest it, by writing to [email protected] or by submitting a complaint under Section 24 of the Terms and Conditions. We will tell you the result of that review, and on request we will provide the trade log, the parameter values applied and the record of the determination.

• Right to lodge a complaint with the supervisory authority

If you believe that we are processing your data in violation of the relevant legal regulations, you can lodge a complaint with the relevant supervisory authority. We would ask you to raise the matter with us first at [email protected] so that we can try to resolve it, but you are not obliged to do so.

We are established in the United Arab Emirates and have no establishment in the European Union, so no single lead supervisory authority is designated for us. Where the General Data Protection Regulation applies to you, you may lodge a complaint with the supervisory authority of the Member State of your habitual residence, of your place of work, or of the place where you consider the infringement to have occurred. The list of national supervisory authorities is published by the European Data Protection Board on its website.

If you are in the United Kingdom, you may lodge a complaint with the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, or at ico.org.uk.

Where your entry into the Challenge Program was concluded by the EEA Commercial Agent and your complaint concerns the payment relationship in respect of which it acts as a separate controller, the competent supervisory authority for that relationship is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava, Slovak Republic, or at dataprotection.gov.sk.

We may change this policy unilaterally, but we will do so only when necessary and we will notify you about such change. You can find the latest version of this policy in your Client Section.

Effective Date and Versioning: Version 1.0 — effective 24 September 2026.