Privacy Policy(2018)The Company, Xtrade Europe Ltd. (ex. XFR Financial Ltd) (hereinafter referred to as the "Company") is concernedwith protecting the privacy of any personal information that you may choose to provide to us (“Personal Data ”ashereinafter defined). The Company will attempt to ensure that the use of your Personal Data is compliant with
the General Data Protection Regulation (EU) 2016/679 (“GDPR”). Accordingly, Company issues this policy toinform you of our use of your Personal Data.
We understand the importance of maintaining the confidentiality and privacy of Your Information. By entrusting
us with your information, we would like to assure you of our commitment to keep such information private. We
have taken measurable steps to protect the confidentiality, security and integrity of Your Information.
This Privacy Policy provides an overview of how [insert the name of Company] (the “Company”) processes yourpersonal data and sets out the information that the Company must provide to you for the purpose of the EU
General Data Protection Regulation (“GDPR”) which is applicable as of 25 May 2018.
By accessing our Company’s website including using any of the communication channels to contact us, weconsider that you have read, understood and accepted the terms of this Privacy Policy and how we process any
information you disclose to us. Moreover, you agree that this Policy, including any amendments will govern how
we collect, store, use, share and in any other form process your personal data and your rights during our
relationship and after its termination.
The information contain herein supersedes any information in relation to the processing of personal data that isincluded in any of the existing Agreements/Client Agreement and associated forms on matters that are coveredby this Privacy Policy. The Company may revise or update this policy from time to time. The new version of thisPolicy will be available on the Company’s website.
As per the relevant sections of the Law 2016/679, if you are a natural person, the Company is the personal dataprocessor and controller of your personal data in relation to the processing activities which your personal data
undergo as stated further below.
For the purposes of this statement:
(a)

(b)

(c)

Personal Data shall mean any operation or set of operations which is performed on personal data or
on sets of personal data, whether or not by automated means, such as collection, recording,organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure bytransmission, dissemination or otherwise making available, alignment or combination, restriction,
erasure or destruction;
Controller shall mean the natural or legal person, public authority, agency or other body which, alone
or jointly with others, determines the purposes and means of the processing of personal data; where
the purposes and means of such processing are determined by Union or Member State law, thecontroller or the specific criteria for its nomination may be provided for by Union or Member State law;
Processor shall mean a natural or legal person, public authority, agency or other body which processes
personal data on behalf of the controller;

Company is committed to providing a safe, responsible and secure environment.
1.

Introduction

1.1 This Privacy Policy sets out the way in which Company ("we" or "us), being the ‘Controller’ of your Personal
Data, determines the purposes and means of the Processing of your Personal Data and/or authorizes
another natural or legal person, public authority, agency or other body to process your Personal Data on
its behalf (the ‘Processor’ of your Personal Data) , as well as the steps we take to protect such data.
1.2 By utilizing our Services, you acknowledge that you have read, and agree to, the terms of this Privacy Policy
and that you consent to our use of your Personal Data for the purposes set out in paragraph 3 of this Privacy
Policy. If you do not wish to provide your Personal Data on the basis set out in this Privacy Policy, you should notenter the relevant information on the Website or provide your Personal Data to
us otherwise. However, if you do not provide your Personal Data, you may not be able to use all of the Services
we offer.

1.3 This website www.xtrade.eu is operated by Company “Xtrade Europe Ltd” registered at Vasileos
Konstantinou 140, 3080, Limassol, Cyprus.

1.4 Definitions:1.4.1 “You” or the “Data Subject” means the user who is using the Company's services and who may choose
to provide his/her Personal Data to the Company and/or whose Personal Data may be subject toProcessing (as hereinafter defined)
1.4.2 Personal Data” means any information relating to an identified or identifiable natural person (‘Data
Subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular
by reference to an identifier such as a name, an identification number, location data, an online
identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic,
cultural or social identity of that natural person. “Processing” means any operation or set of operations
which is performed on Personal Data or on sets of Personal Data, whether or not by automated means,such as collection, recording, organization, structuring, storage, adaption or alteration, retrieval,consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment
or combination, restriction, erasure or destruction.
1.4.3 “Visitor” means an individual other than a user, who uses the public area, but has no access to therestricted areas of the Site or Service.
1.5 Principle:
This policy is based on the following data protection principles:The processing of personal data shall take place in a lawful, fair and transparent way ;The collecting of personal data shall only be performed for specified, explicit and legitimate purposes
and not further processed in a manner that is incompatible with those purposes;



The collecting of personal data shall be adequate, relevant and limited to what is necessary in relation
to the purpose for which they are processed;The personal data shall be accurate and where necessary,
kept up to date;
Every reasonable step shall be taken to ensure that personal data that are inaccurate having regard to
the purposes for which they are processed, are erased or rectified without delay;
Personal data shall be kept in a form which permits identification of the data subject for no longer than
it is necessary for the purpose for which the personal data are processed;
All personal data shall be kept confidential and stored in a manner that ensures appropriate security;
Personal data shall not be shared with third parties except when necessary in order for them toprovide services upon agreement;
Data subjects shall have the right to request access to and rectification or erasure of personal data, or
restriction of processing, or to object to processing as well as the right of data portability, as long as such
requests do not conflict with the laws of the Republic of Cyprus.







2. Collection of information
2.1 As part of the Company’s client account opening procedures and ongoing obligations, needs to abide with thelegislative framework currently in place with the Cyprus Securities and Exchange Commission (‘CySEC’).
Specifically, the Company shall comply with its legal obligations under the AML Law (Law 13(I)/2018), as amended,and the AML Directive (Directive DI144-2007-08 of 2012) for the establishment on the Client’s economic profileand prevention of money-laundering as well as abide with the relevant record keeping obligations under theEuropean Commission Delegated Regulation (EU) 2017/565 (‘Delegated Regulation’) and Law 87(I)/2017 forestablishing the suitability and appropriateness of each Client based on the services offered by each CIF andrecordings of telephone conversations, client transactions, FATCA and CRS.
The Company based to the above-mentioned, is obliged to request, collect and maintain for at least five (5) years
the following:(a) Name and Surname(b) Date of Birth

(c)
(d)
(e)
(f)
(g)
(h)
(i)
(j)
(k)
(l)
(m)
(n)
(o)
(p)
(q)

Place of Birth
Nationality
Copy of the Passport and/or of the Identity Card
Utility bill (including the full address of the client)Tax Identification Number
Tax Residence
Telephone number
Email
Employer’s nameProfession
Industry of Employment
Gross Annual Income
Net Worth
Anticipated Turnover
Bank Account Details

The Company may collect the said information directly from you (during the account opening procedure) and/orfrom other persons including for example, credit reference agencies, fraud prevention agencies, banks, otherfinancial institutions, third authentication service providers and the providers of public registers.
The Company may also collect Your Information in regard to your use of our website(s), such as pages visited,frequency, duration of visit and trading activities. The Company also keeps records of your trading behaviour,
including a record of:a) Products you trade and their performanceb) Historical data about the trades and investments you have made including the amount investedc) Historical data about your payment activities and your withdrawal activities.
Further to the above, the Company may also request further information to improve its Service to you (Existingor Potential Clients) or our activities (if you are our Provider for Trading Data) under our relevant Agreement, as
the case may be, or comply with Applicable Regulations.
The Company records any communications, electronic, by telephone, in person or otherwise, that we have withyou in relation to the services that were provided by the Company to you and the relationship with you. The said
recordings will be the Company’s sole property and will constitute evidence of the communications between the
Company and you.

3. Use of Information
3.1 The Company will process, use, store and handle your Personal Data in accordance with the General data
Protection Regulation 2016/679 and the Processing of Personal Data (Protection of the Individual) Law of 2001,
as amended or replaced from time to time.
Your personal data (not publicly available information and/or already possessed by the Company without abiding
with the provisions of the general data protection regulation), will be collected and processed explicitly andspecifically only for the purposes that have been collected for (‘purpose limitation’) while the Company must
require only the information necessary in relation to the purposes for which they have been collected.
We may transfer your personal information outside the European Economic Area. If we will make such a transfer,
we will ensure that the transfer is lawful and that there are appropriate security arrangements in place tosafeguard your personal data as provided by Applicable Regulations. In furtherance, the Company follows theEuropean Commission instructions in respect to this matter and it shall ensure that the third country that yourdata may be transferred is recognised by the EU Commission, as adequate in respect to the protection of yourpersonal data.
We will process your Personal Data to enable us:(a) to verify your identity in order to comply with the current Cypriot and European AML legislations, andwith the obligations we have towards CySEC to perform the obligatory KYC verifications andcompliance procedures.
(b) to establish your trading account, issue you an account number and a secure password, maintain youraccount activity and contact you with account information, among other reasons. This information
also helps us improve our services to you, customize your browsing experience and inform you about
additional products, services or promotions that may be of interest to you.
(c) to provide our services to you and enable you to use them;(d) to manage and administer the website and platform;(e) to send you newsletters and other relevant and targeted promotional communications;(f) to notify you of changes we have made or plan to make to the Website and / or platform;(g) to send you emails as necessary;(h) to request feedback from you on any transaction effected by you through our platform;(i) to deal with enquiries, complaints and feedback from you and our service providers;(j) to provide third parties with statistical anonymized information about our users;(k) to analyze and improve the services offered on the Website.
3.2 If at any time you wish us to stop processing your Personal Data for the above purposes, then you must contact
us and we will take the appropriate steps to stop doing so. Please note that this may mean that your Account will
be closed. You may contact us by sending an email to compliance@xtrade.com
3.3 To ensure a good quality of service, and in compliance with our legal obligations, we need to monitor any
communication you have with us whether in writing or by electronic mail (“recordings”) or any inbound andoutbound calls done by any member of the Company. Any recordings remain the property of the Company andwill be used only for the purposes listed above.

3.4 In the event that the purposes for processing change, then we will notify you as soon as practicable and seek
any additional consent that may be required.
3.5 All your personal data is retained 5 years after the deactivation of your account. In some cases, when theregulator – the CySEC requires, we may retain your data for maximum 7 years after the deactivation of youraccount.
Should you close your account with us, Xtrade Europe Ltd. will retain your information, but only use it to comply
with regulatory requirements and legal obligations.
4. Disclosing your Personal Data
4.1 Except to the extent required by any applicable law or governmental or judicial body, we will only disclosesuch of your personal data to our third-party companies as is required for us or them to perform our or theirservices to you.
4.2 Except as described in 4.1, we will not intentionally disclose the Personal Data that we collect or store on theService to third parties without your prior explicit consent.
4.3 We will use all reasonable endeavours to ensure that any companies to whom we disclose your confidential
information is compliant with the GDPR (or an equivalent standard) as regards its use and storage of your PersonalData.
4.4 In the event that we sell or buy any business or assets, we may disclose your personal data and transaction
data to the prospective seller or buyer of such business or assets. If substantially all of the assets of the Company
are acquired by a third party, personal data and transaction data held by it about its customers will be one of thetransferred assets.
4.5 We will disclose your Personal Data if we are under a duty to disclose or share your personal data andtransaction data in order to comply with any legal obligation, or in order to enforce or apply our Terms andConditions and other agreements; or to protect the rights, property, or safety of the Company, our customers, orothers. This includes exchanging information with other companies and organizations for the purposes of fraud
protection and credit risk reduction.
4.6 If at any time you wish us to stop processing your Personal Data for the above purposes, then you must contact
us and we will take the appropriate steps to stop doing so, to the extent we are permitted by law. Please notethat this may mean that your Account will be closed. You may contact us atcompliance@xtrade.com
4.7 As part of using your personal information for the purpose set put above, we may disclose your information
to:








Service providers and specialist advisers who have been contracted to provide us with IT, financial,
regulatory, compliance, accounting and/or other services.
Partners or Tied Agents with whom the Company has closed relationships and who are exclusively
working for the Company.
Regulatory Authorities.
Anyone authorised by you.
Relevant authorities to investigate or prevent fraud, money laundering or other illegal activity.
Trade Repository or similar.
The Company’s employees so as to exercise their duties to further the Agreement between us, or toassure the efficient functioning of our Platform, the Automatic Orders and the Trading Data functions.

The Company requires from organizations outside the Company who handle or obtain personal information toacknowledge the confidentiality of this information, undertake to respect any individual’s right to privacy andcomply with all the relevant data protection laws and this privacy policy.

5. Data Subject Rights
5.1 We respect your privacy rights and provide you with reasonable access to the Personal Data that you may
have provided through your use of the Services. Your principal rights under the GDPR are as follows:
a.
b.
c.
d.
e.
f.
g.
h.

the right for information;
the right to access;the right to rectification;
the right to erasure; the right to be forgotten;
the right to restrict processing;
the right to object to processing;
the right to data portability;
the right to withdraw consent;

You shall have the right to exercise any of those rights, as long as such requests do not conflict with the lawsof the Republic of Cyprus.

If you want to exercise any of those rights, you should contact our Data Protection Officer (DPO) through thecontact information listed below: dpo.cyprus@xtrade.com
Phone number: +357 25030742
You should put your request in written with your own words and send it to the DPO by e-mail. We will
acknowledge your request within seventy-two (72) hours and handle it promptly. We are going to process andreply to your request within a month, with a possibility to extend this period for particularly complex requests inaccordance with Applicable Law. We will retain your Personal Data for as long as your account is active, as needed
to provide you services, or to comply with our legal obligations, resolve disputes and enforce our agreements.
You may contact Xtrade for any reason under this Privacy Statement, or otherwise, as follows:
Contacts “Xtrade”: Address: Vasileos Konstantinou 140, 3080, Limassol, Cyprus, Tel. No. +357 25030742, Fax.
No. + 357 25030727, Email: dpo.cyprus@xtrade.coma.

the right to lodge a complaint with a supervisory authority which is the Commission for personal dataprotection in Cyprus you may exercise through the contact information listed below:

DATA COMMISSIONER OF THE REPUBLIC OF CYPRUS
Address:
1 Iasonos str., 1082 Nicosia
P.O.Box 23378, 1682 Nicosia(t) +357 22818456(f) +357 22304565(e) commissioner dataprotection.gov.cy(w)
http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/home_en/home_en?ope
ndocument
5.2 You may decline to share certain Personal Data with us, in which case we may not be able to provide to you
some or all of the features and functionality of the Service.
5.3 At any time, you may object to the processing of your Personal Data, on legitimate grounds, except if
otherwise permitted by applicable law.
5.4 In accordance with Applicable Law, we reserve the right to withhold personal data if disclosing it would
adversely affect the rights and freedoms of others.

5.5 We may use your personal data for the purposes of automated decision-making, including profiling. Whensuch processing takes place, we will request your explicit consent and provide you with the option to opt-out. We
will use automated decision making in order to fulfill obligations imposed by law, for instance, for determining
the appropriate maximum leverage at which you will be permitted to trade, for which you may not receive explicit
notification. You have the right not to be subject to a decision based solely on automated processing, including
profiling, which produces legal effects concerning you and/or significantly affects you. at any time by contacting
us at compliance@xtrade.com. Subject to GDPR Article 22(1)-(4), you cannot exercise your right to object to theprocessing of your personal data for automated decision-making purposes if the decision:is necessary for entering into, or performance of, a contract between you and the Company.

Company has no control over the content of third party sites and accepts no responsibility or liability for them orfor any loss or damage that may arise from your use of them. When accessing a third party website, you areadvised to check such website’s terms of service and privacy policy to ensure compliance with applicable laws.
9. Minors and Children’s Privacy
9.1 Protecting the privacy of minors is especially important. Our Service is not directed to children under the ageof 18, and we do not knowingly collect Personal Data from children under the age of 18. If you are under 18 yearsof age, then please do not use or access the Service at any time or in any manner. If we learn that Personal Data
has been collected on the Service from persons under 18 years of age, then we will take the appropriate steps todelete this information. If you are a parent or guardian and discover that your child under 18 years of age has
obtained an Account on the Service, then you may alert us at compliance@xtrade.com and request that we delete
your child’s Personal Data from our systems.
10. Security
10.1 We take appropriate security measures to protect against loss, misuse and unauthorized access, alteration,
disclosure, or destruction of your information. Company has taken steps to ensure the ongoing confidentiality,
integrity, availability, and resilience of systems and services processing personal information, and will restore theavailability and access to information in a timely manner in the event of a physical or technical incident.
0u.s2ur rN
oonm
eistakhr.orW
e1yon
r rw
adneotfth
cnuinsriostiytognoufoaavrneayrntitnehfeotrIhnmte
oealueyscntororotsnbtiocerseatcoocrneasgtsheee,diSs, ed1ri0svc0icl%
oew
atlrseaonscesam
aattrsinouencth,yoinufm
otreamtnhasotm
idointotfm
oes,seaednc,duaryletoe.urW
eddeo,cosaornantot
destroyed by breach of any of our physical, technical, or organizational safeguards. If you believe your Personal
Data has been compromised, please contact compliance@xtrade.com.
10.3 If we learn of a security systems breach, we will inform you of the occurrence of the breach in accordancewith applicable law.
11. Privacy Settings
11.1 Although we may allow you to adjust your privacy settings to limit access to certain Personal Data, please beaware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of otherusers with whom you may choose to share your information. We cannot and do not guarantee that information
you post on or transmit to the Service will not be viewed by unauthorized persons. We have taken the necessary
steps to protect your Personal Data as much as possible in transit by utilizing physical, electronic, and procedural
safeguards to guard your personal data.
When you open an account with us, you are issued a unique account number and a password. Only a limited
number of Xtrade Ltd. employees who have a need to know this information will have access to it in accordancewith our internal regulations. Remember that you are ultimately responsible for maintaining the secrecy of youraccount login information. We strongly recommend that you do not disclose this information to anyone.
On our websites and online account application we use technology to encrypt information transmitted by or toyou. We use SSL certificates to authenticate our websites and secure trading and customer-facing applications,allowing you to verify that you are connected to our websites. Our servers are encrypted so is the communicationin our internal network. We conduct regular internal audits of our business practices and procedures, examining
confidentiality standards and information access in order to protect your Personal Data.

Changes to this Privacy Statement and Opting Out In the event Xtrade Ltd. materially changes this Privacy
Statement, the revised Privacy Statement will promptly be posted to our websites and you will receive an internal
message in your personal account on the trading platform as well as an e-mail.
12. Data Retention and International Transfers
12.1 The data that we collect from you may be transferred to, and stored at, a destination outside the European
Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us

or forone of our suppliers. By submitting your personal data, you agree to this transfer, storing or processing. We
will take all steps reasonably necessary to ensure that your data is treated securely and in accordance withthis privacy policy.
12.2 All information you provide to us is stored on our secure servers.
12.3 Unfortunately, the transmission of information via the internet is not completely secure. Although we will doour best to protect your personal data, we cannot guarantee the security of your data transmitted through ourWebsite; any transmission is at your own risk. Once we have received your information, we will use strict
procedures and security features to try to prevent unauthorised access.
12.4 We transmit personal data, encrypted with TLS 1.2 for web transactions, and an AES256 for DB encryption
which is sufficient to ensure the utmost possible security to your information during the transmission. HTTPS(TLS / SSL) email access is another method by which we provide maximum security for your personal data.
We maintain physical, electronic and procedural safeguards in connection with the collection, storage anddisclosure of personally identifiable customer information. Our security procedures mean that we may
occasionally request proof of identity before we disclose personal information to you.



Is authorized by Union or Member State law to which the Company is subject and which also lays down
suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; oris based on your explicit consent.

6. Your Consent
6.1 The use of your personal information requires your consent, such consent will be provided in accordance with
the Client Agreement that it is provided to you during the account opening procedure and is also available on the
Company’s website(s). The Company shall rely on the provided consent as its legal basis for processing yourpersonal data. You have the right at any time to withdraw that consent by contacting us via phone or via email at
dpo.cyprus@xtrade.com
Where you are a natural person and the use of your personal data requires your consent, the Company will
request for your consent to be provided freely, specific, informed and an unambiguous indication of your desires,
which by statement or by clear affirmative action, signifies agreement to the processing.
If at any case you feel compelled to consent or you will endure negative consequences if you do not, then yourconsent will not be valid. Additionally, your consent shall not be bundled-up as a non-negotiable part of terms
and conditions, because such action would indicate that you haven’t freely provided your consent.
6.2 In certain circumstances the company can process your data without your consent. The following are
considered to be the most relevant:Processing is necessary for compliance with legal obligation to which the controller is subject.
Processing is necessary for the performance of a contract to which the person is party, or in order totake measures of the person’s request prior entering into a contract.
Processing is necessary in order to protect the vital interests of the data subject.
Processing is necessary for the performance of a task carried out in the public interest or in the exerciseof public authority or a third party to whom the data are communicated.
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by thethird party to whom the personal data are communicated, on condition that such interests override therights, interests and fundamental freedoms of the persons.

7. Contacting us
7.1 For full details about the Company group members and where they operate please contact us at:
 Tel. No. +357 25030742



Fax. No. + 357 25030727

7.2 If at any time you believe that we have not adhered to this Privacy Policy, please contact us atcompliance@xtrade.com, and we will seek to promptly determine and correct the problem.
8. Advertising and Use of Cookies
We collect browser and cookie information when you first navigate to our websites. We use cookies to give you
a better customer experience and for use of access. Certain cookies will allow you to leave and re-enter our
Websites without re-entering your password. This will be monitored by a web server.
For more information on the use of cookies and how you can control their use, please refer to our cookies policy.
8.1 If you register with us or if you continue to use the Website, you agree to our use of cookies.
8.2 You further agree to use the Website and our services only for lawful purposes.
8.3 From time to time you may find links to third party websites on the Website. These links are provided for yourinformation only and are not recommended by www.xtrade.eu.

14. Change of Information
14.1 You may the Company at any time that Your Information has changed or that you wish the Company todelete information we hold about you by emailing us at info@.com. We will change or delete Your Information inaccordance to your instructions, except to the extent that we are required to hold Your Information for regulatoryor legal purposes, to provide you with the Services you have requested or to maintain adequate business records.
15. Right of access15.1 As a natural person you have the right to obtain a copy of any personal information which we hold about
you and to advise us of any perceived inaccuracy. Additionally, you may also request the reasoning of holding
such information. To make a request, please contact us, verifying your identity and specifying what information
you require. You may contact us via e-mail at [insert email address].

16. Data Protection Officer
16.1. Company has appointed a Data Protection Officer (“DPO”) who is responsible for matters relating to privacy
and data protection.
Company's DPO can be reached at:
dpo.cyprus@xtrade.com
Phone number: +357 25030742
We will process and reply to your request in 30 days.
17. Changes to this Privacy Policy
17.1 Please note that this Privacy Policy may change from time to time. If we change this Privacy Policy in waysthat affect how we use your Personal Data, we will advise you of the choices you may have as a result of thosechanges. We will also post a notice that this Privacy Policy has changed.