How we handle your data.

We collect the following categories of personal data. We only collect what we need for the purposes set out in Section 2; we do not collect sensitive personal data (such as biometrics, health, or political opinions) except where strictly required for KYC.

Account information: full name, email address, phone number, date of birth, nationality, country of residence, and account credentials (username, password).

KYC and identity information: government-issued photo ID number, BVN, address, photograph of the ID, and a selfie holding the ID. We may also collect the issuer, issue date, and expiry date of the ID.

Financial information: bank account details (account number, bank name, account holder name) used for payouts, and transaction history.

Trading data: every order placed, every modification, every position opened or closed, your equity curve, your drawdown metrics, and your platform session metadata (login time, IP address, device fingerprint).

Communications: any message you send us through the contact form, email, WhatsApp, or social media; the metadata of those messages (timestamp, channel); and any call recordings of support calls (with your consent at the start of the call).

Technical data: IP address, browser type and version, device type, operating system, referring URL, pages visited, and cookies (see Section 5).

We use the personal data we collect for the following purposes. Each purpose is grounded in a legal basis under the NDPR — either your consent, the performance of a contract with you, a legal obligation we are subject to, or our legitimate interests in running a secure and compliant platform.

To operate the Platform and provide our services: creating and maintaining your account, processing your challenge purchase, evaluating your trading performance, operating the funded account, and processing payouts.

To verify your identity and comply with anti-money-laundering (AML) and counter-terrorism-financing (CTF) laws: performing KYC, screening against sanctions lists, and monitoring for suspicious transaction patterns.

To prevent fraud and protect the integrity of the Platform: detecting duplicate accounts, coordinated trading, prohibited strategies, account takeovers, and unauthorised access.

To communicate with you: sending service announcements, payout confirmations, policy updates, and (where you have opted in) marketing communications. You can opt out of marketing at any time by clicking "unsubscribe" in any marketing email or contacting support.

To improve the Platform: analysing usage patterns, identifying bugs, and developing new features. Where possible we use aggregated, de-identified data for these purposes.

To comply with legal obligations: responding to lawful requests from regulators, tax authorities, and law-enforcement agencies; maintaining records as required by Nigerian law; and enforcing our Terms.

Under the NDPR, every piece of personal data we process must be grounded in one or more of the following legal bases. We document the legal basis for each processing activity in our internal records of processing.

Consent: where you have given us clear, affirmative consent to process your data for a specific purpose (for example, marketing emails or call recording). You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Contract: where processing is necessary to perform the contract you have entered into with us (for example, processing your payout requires processing your bank details).

Legal obligation: where processing is necessary to comply with a legal obligation to which we are subject (for example, KYC under AML regulations, record-keeping under tax law, or responding to a court order).

Legitimate interests: where processing is necessary for our legitimate interests in operating a secure and profitable business, provided those interests are not overridden by your fundamental rights and freedoms. We balance our interests against yours on a case-by-case basis and document the assessment.

We use cookies and similar technologies to operate the Platform, remember your preferences, and understand how you use our services. The full list of cookies we use, their purpose, and how to opt out is documented in our Cookies Policy. We summarise the categories here:

Strictly necessary cookies: required for the Platform to function (session cookies, authentication tokens, load-balancing cookies). These cannot be disabled because the Platform would not work without them.

Performance cookies: collect aggregated, de-identified usage data (pages visited, time on page, error messages). We use this data to identify and fix bugs and to understand which features are most useful.

Functional cookies: remember your preferences (language, theme, time zone) so you don't have to set them every time you visit.

Marketing cookies: track your visit across our site and (with your consent) across other sites to build a profile of your interests and show you relevant advertising on other platforms. We do not currently use marketing cookies on the Platform; if we add them in future we will request your consent first.

We do not sell your personal data. We share it only with the categories of recipient listed below, and only the minimum amount necessary to fulfil the purpose of the sharing.

Payment processors: PalmPay and any banking partner involved in processing your payout. They receive your name, bank account details, and the payout amount.

Identity-verification partners: regulated KYC vendors who perform the ID and BVN checks. They receive your name, date of birth, ID number, and the photograph of the ID. They return to us a verification status (verified / not verified) — we do not receive the underlying biometric data.

MetaQuotes: the operator of the MetaTrader 5 platform. They receive your MT5 account ID and the trading activity on that account.

Cloud infrastructure providers: hosting and storage providers that hold our database backups. They receive encrypted personal data; they are contractually prohibited from using it for any purpose other than providing the storage service.

Professional advisors: our lawyers, accountants, and auditors, where they need access to personal data to provide their services to us. They are bound by professional confidentiality obligations.

Regulators and law enforcement: where we are legally required to disclose the data, or where disclosure is necessary to protect our rights or the safety of others.

We require all third-party recipients by contract to handle your data with the same care we do, and to use it only for the specific purpose for which we shared it. We do not transfer your data to any country the NDPR has not approved as providing adequate protection except where the transfer is necessary for the performance of a contract with you (for example, processing a payout via an international banking partner) and appropriate safeguards are in place.

We take the security of your personal data seriously. We use a combination of technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These measures include:

Encryption in transit (TLS 1.3) and at rest (AES-256) for all personal data.

Role-based access controls so that only staff with a legitimate need can access personal data, and only the minimum data necessary.

Multi-factor authentication on all staff accounts with access to personal data.

Regular penetration testing by an independent third-party security firm.

24/7 monitoring of our infrastructure for suspicious activity.

A documented incident response plan and a designated Data Protection Officer who oversees any data breach notification within the NDPR-mandated 72-hour window.

Despite our efforts, no system is 100% secure. If we become aware of a data breach affecting your personal information, we will notify you and the relevant supervisory authority in accordance with the NDPR.

We retain your personal data only for as long as necessary to fulfil the purposes for which we collected it, including (but not limited to) the purposes of satisfying any legal, accounting, or reporting requirements.

Account and trading data: retained for the lifetime of your account plus 7 years after closure, in line with Nigerian tax law and AML record-keeping requirements.

KYC data: retained for 5 years after the end of the business relationship, in line with the Money Laundering (Prohibition) Act 2011 (as amended).

Marketing data: retained until you opt out, after which we delete it from our active systems within 30 days (and from backups within 90 days).

Support communications: retained for 3 years for quality and training purposes, after which they are anonymised.

On expiry of the retention period we either delete the data or anonymise it so it can no longer be associated with you. Anonymised data may be retained indefinitely for statistical and research purposes.

Under the NDPR you have the following rights in respect of your personal data. We will respond to all verified requests within 30 days. There is no charge for making a request, although we may charge a reasonable fee for requests that are manifestly unfounded or excessive.

We are based in Nigeria and your personal data is primarily stored and processed in Nigeria. Some of our service providers (cloud hosting, KYC vendors, payment processors) may be located in other countries. When we transfer your personal data outside Nigeria, we ensure the transfer is permitted under the NDPR by one of the following mechanisms:

The destination country has been adjudged by the NDPC to provide an adequate level of data protection.

We have put in place binding contractual clauses with the recipient that oblige them to handle your data to the same standard as the NDPR requires.

You have given explicit consent to the transfer after being informed of the possible risks.

The transfer is necessary for the performance of a contract with you or for the implementation of pre-contractual measures taken at your request (for example, processing a payout via an international banking partner).

A list of the countries we transfer data to and the safeguard used for each is available on request from our Data Protection Officer.

The Platform is not intended for use by anyone under the age of 18 (or the age of legal majority in their jurisdiction, whichever is higher). We do not knowingly collect personal data from anyone under that age.

If we become aware that we have collected personal data from a person under 18 without verifiable parental consent, we will delete that data as soon as possible. If you believe we have collected data from a person under 18, please contact our Data Protection Officer immediately.

The Platform may contain links to third-party websites or services we do not control (for example, links to MT5 documentation or our liquidity provider's website). This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices of any third party.

We encourage you to read the privacy policy of every third-party service that collects your personal data. Where a third-party service is essential to operating the Platform (for example, the MetaTrader 5 platform or our payment processor), we have a data-processing agreement with that service that obliges them to handle your data to the same standard as this Policy.

We may update this Privacy Policy from time to time. Material changes will be communicated by email to your registered address and by a Platform banner at least 14 days before the changes take effect. Non-material changes (typographical corrections, clarification of existing provisions) may be made without prior notice.

The current version of this Policy is always available at /privacy. The "Last updated" date at the top of the page indicates when the most recent changes were made.

If you have any questions about this Privacy Policy, wish to exercise any of your rights, or want to lodge a complaint, please contact our Data Protection Officer (DPO). The DPO is responsible for overseeing our compliance with the NDPR and is your point of contact for all data-protection matters.