Privacy Policy for Harpdex

1. Information we collect

1.1 Information you provide

When you create an account or access the Service, we may obtain the following information:

• Identity details: first name, surname and date of birth.
• Contact details: email address, phone number and home address.
• Financial details: broker API keys, whether read-only or execution-enabled, investment preferences and risk controls. We do not store complete broker passwords or card numbers.
• Profile information: username, preferred trading methods and alert preferences.
• Communications: messages you send through support channels or by email.

1.2 Information collected automatically

When you use the Service, some technical information is recorded automatically:

• IP address, browser type and version, and operating system.
• Pages viewed, features used, time spent on the Service and clickstream data.
• Device identifiers and, where applicable, mobile advertising identifiers.
• Cookie and tracking-tool information (see our Cookie Policy).

1.3 Information obtained from third parties

We may receive information from identity-verification providers, fraud-monitoring services and analytics partners. Where appropriate, we may combine it with existing records to support security and data accuracy.

2. Uses of information

We may use collected information to:

• Create, manage and provide your account and the Service.
• Process trading signals and automated instructions through connected brokers.
• Personalise the experience and present relevant market information.
• Deliver service communications, including confirmations, trading updates and security notifications.
• Send marketing communications where you have agreed or applicable law allows it.
• Detect, investigate and prevent fraud or other unlawful activity.
• Satisfy applicable legal and regulatory obligations.
• Develop, test and enhance Service functionality using aggregated and anonymised data.

3. Legal bases for EEA and UK users

For users in the European Economic Area or United Kingdom, we process personal information on the following legal bases:

• Contract necessity: to provide the Service you request when registering.
• Legitimate interests: such as protecting the Service, preventing fraud and improving the product.
• Legal obligation: including duties arising under financial regulation and tax law.
• Consent: for marketing and optional cookies, which you can withdraw at any time.

4. Disclosure of information

We do not sell personal information. We may share it with:

• Service providers: cloud-hosting, email, analytics and support suppliers that are contractually required to safeguard your information.
• Connected brokers and exchanges: only the API directions required to execute the strategy you set up.
• Government and public bodies: when required by law, court order or necessary to protect our legal rights.
• Business transfers: as part of a merger, acquisition or asset sale, provided the successor remains bound by this policy.

5. International transfers

Harpdex operates internationally. Your personal information may be sent to and processed in locations outside Australia, including the United States and the European Union. Where relevant, we use approved Standard Contractual Clauses to protect cross-border transfers.

6. Data retention

We retain personal information while your account is active or for as long as needed to provide the Service. Following closure, selected records may be kept for up to seven years to satisfy financial regulatory requirements. Aggregated, anonymised analytics may be retained indefinitely.

7. Your privacy choices and rights

Depending on where you live, you may have the right to:

• Request access to the personal information we hold.
• Ask us to amend inaccurate or incomplete information.
• Request erasure of your information, sometimes referred to as the “right to be forgotten”.
• Object to particular processing or ask that it be restricted.
• Receive your information in a structured, machine-readable format so it can be transferred.
• Withdraw consent at any time, without affecting processing carried out lawfully before withdrawal.

To submit a rights request, contact us at [email protected]. We generally respond within 30 days.

8. Information security

Our controls include TLS 1.3 encryption in transit, AES-256 encryption at rest, multi-factor authentication, role-based access and yearly independent penetration testing. No technology can be promised entirely secure. Choose a strong, unique password and enable two-factor authentication.

9. Cookies and related technologies

Cookies and similar tracking tools help us operate and enhance the Service. More detail is provided in our Cookie Policy.

10. Information about children

The Service is not designed for people under 18, and we do not knowingly collect children’s personal information. If you think a child has provided personal data, contact us so we can remove it promptly.

11. Updates to this policy

This Privacy Policy may be amended from time to time. We will communicate material changes by website notice or email. Continuing to use the Service after the effective date means you accept the updated policy.

12. Contacting us

For privacy questions or to exercise your rights, contact our Data Protection Officer:

• Email: [email protected]
• Postal address: Harpdex Pty Ltd, 1 Martin Place, Sydney NSW 2000, Australia, Australia
• EU representative: Harpdex, 1 Martin Place, Sydney NSW 2000, Australia