Privacy policy

This Privacy Policy explains how Poly Rion ("Poly Rion", "the Company", "we", "us") handles the personal data of people who visit our website, open or apply for an account, use our client portal, trading platforms and mobile applications, or otherwise contact us ("you").

We act as the controller of your personal data: we decide why and how it is processed. This policy forms part of our Client Agreement. Please read it together with our Terms and Conditions, Risk Disclosure and AML & KYC Policy.

We may update this policy when our services, our suppliers or the law change. The current version is always published on this page with its revision date; where a change materially affects you, we will also tell you through the client portal or by e-mail before it takes effect.

Data you give us

When you register, verify your identity, fund your account or contact us, we collect:

• Identity and contact details: name, date of birth, country of residence, nationality, e-mail address, phone number and postal address.
• Verification documents: an identity document (passport, national ID card or driving licence), a proof of address and, where required, a selfie or liveness check and information on the source of your funds or wealth.
• Financial and suitability information: employment status, income, trading experience and the answers you give in our questionnaires.
• Payment details: the deposit and withdrawal methods you use, wallet and bank details in your own name, and the references of your transactions. We do not store full card numbers.
• Your communications with us: support tickets, chats, e-mails and call recordings.

Data we collect when you use our services

When you use the website, client portal, trading platforms and mobile applications, we record:

• Account and trading records: trading accounts, orders, positions, deals, balances, deposits, withdrawals, transfers and statements.
• Security and device data: IP address, device and browser type, operating system, sign-in times, active sessions and two-factor authentication settings.
• Usage data: pages visited, features used and errors, collected through essential cookies and, only with your consent, analytics cookies.

Data we receive from others

• If you choose "Continue with Google", Google shares your name, e-mail address and Google account identifier with us. We do not receive your Google password.
• If you were introduced by a partner (an Introducing Broker) or by a referral link, we record who referred you.
• Identity verification, sanctions-screening and fraud-prevention providers, and payment providers, tell us the result of their checks and the status of your payments.

We only process personal data where we have a lawful basis for it:

• To perform our contract with you — to open and run your accounts, execute your orders, process deposits, withdrawals and transfers, provide the client portal and applications and answer your requests.
• To comply with our legal obligations — identity verification (KYC), anti-money laundering and counter-terrorist financing checks, sanctions screening, record keeping, tax reporting and responding to competent authorities.
• For our legitimate interests — keeping your account and our systems secure, preventing fraud and abuse, recording communications, improving our services, handling complaints and defending legal claims.
• With your consent — sending you marketing, using optional analytics cookies, and any other purpose for which we ask your consent. You can withdraw consent at any time without affecting earlier processing.

If you do not provide data

Some data is required by law or by our contract with you. If you do not provide it, we may be unable to open your account, enable live trading or process a withdrawal.

Automated decisions

We use automated checks to screen applications and transactions, for example to match your details against sanctions lists or to flag unusual activity. A member of our team reviews any case where such a check would lead to your application being refused or your account being restricted.

We never sell your personal data. We share it only as far as necessary with:

• Service providers who work for us under contract: hosting and data storage, identity verification and screening, payment processing, e-mail and notification delivery, customer support tools and analytics.
• Liquidity providers, trading-platform and technology partners, where needed to execute and record your trades.
• Your Introducing Broker or referrer, who sees limited information about the accounts they introduced (such as name, country, account activity, deposits and trading volume) in order to receive commission. They never see your documents or passwords.
• Strategy providers and followers in copy trading, who see only the information shown on the copy-trading pages (for example a strategy's nickname and performance).
• Regulators, tax authorities, courts, law enforcement and other competent authorities when the law requires or allows it.
• Professional advisers, auditors and insurers, and a buyer or successor of our business in the event of a reorganisation, merger or sale, under a duty of confidentiality.

Our service providers may process your data outside your country of residence. Where the destination does not offer a level of protection recognised as adequate, we put appropriate safeguards in place, such as standard contractual clauses, and require the recipient to protect your data to the standard described in this policy.

We keep your data for as long as you hold an account with us and afterwards for as long as the law requires. Identification, transaction and communication records are kept for at least five years after our relationship ends, or longer where a law, an investigation or a legal claim requires it.

Data we hold only on the basis of your consent, such as marketing preferences, is deleted when you withdraw consent. When data is no longer needed, we delete or anonymise it.

No system is completely secure. Keep your login details private, enable two-factor authentication and tell us at once if you suspect someone has accessed your account.

• All connections to our website, portal, applications and APIs are encrypted.
• Passwords are stored only as salted hashes; we offer two-factor authentication and let you review and sign out your active sessions and devices.
• Verification documents are kept in private, access-controlled storage and are never published.
• Staff access is limited by role, protected by two-factor authentication and recorded in an audit log.
• We train our staff, test our systems and review our suppliers' security.

We use essential cookies and similar storage to keep you signed in, protect your session, remember your theme and language and remember your cookie choice. These cannot be switched off because the services do not work without them.

With your consent we also use Google Analytics, provided by Google, to understand how our website and client portal are used — for example which pages are visited and how visitors arrive. Google Analytics sets its own cookies (named _ga) and receives your IP address, device and browser information and the pages you view; we have switched off Google signals and advertising features. Analytics only starts after you choose "Allow all" in the cookie banner.

You can change your choice at any time with the "Cookie settings" link at the bottom of every page of our website; when you withdraw consent, measurement stops and the analytics cookies are removed. You can also block cookies in your browser settings.

Subject to the law that applies to you and to our record-keeping obligations, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate or incomplete data corrected;
• ask us to delete your data, where we are not required to keep it;
• restrict or object to processing based on our legitimate interests, and object at any time to direct marketing;
• receive data you provided to us in a structured, machine-readable format;
• withdraw any consent you have given; and
• complain to the data-protection authority in your country.

To exercise a right, open a ticket in the Support section of your client portal. We may ask you to prove your identity first, and we reply within one month; if a request is complex we may extend that period and will tell you why.

We send marketing messages only where the law allows it or you have agreed. Every marketing e-mail contains an unsubscribe link, and you can change your notification preferences in the client portal. Service messages — such as security alerts, statements, margin calls and changes to our terms — are not marketing and will still be sent.

Our services are for adults only. We do not knowingly collect data from anyone under 18; if we learn that we have, we will delete it and close any account opened.

If you have a question about this policy or about how we handle your data, open a ticket in the Support section of your client portal and choose the privacy topic. If you do not have an account, use the contact details published on our About page.