GDFS TRADE PRIVACY POLICY

01SCOPE OF THIS POLICY

This Privacy Policy applies to personal information collected or held by GDFS in connection with:

• our website;
• Client applications and accounts;
• Finger Trader;
• MetaTrader 4 (MT4);
• Client portals;
• financial and trading services;
• customer support;
• marketing and communications;
• identity verification and compliance procedures; and
• other services operated or made available by GDFS.

Some third-party services accessible through our platforms may maintain their own privacy policies.

02PERSONAL INFORMATION WE MAY COLLECT

The types of personal information we collect depend on your relationship with GDFS and the services you use.

We may collect:

Identity Information

This may include:

• full name;
• date of birth;
• gender, where relevant;
• nationality;
• country of residence;
• photograph;
• signature;
• passport information;
• driver licence information;
• national identification information; and
• other information required to verify your identity.

Contact Information

This may include:

• residential address;
• postal address;
• email address;
• telephone number; and
• other contact information.

Account Information

This may include:

• GDFS account number;
• username;
• account preferences;
• account status;
• trading platform information;
• communication preferences; and
• other information associated with your Client account.

Financial Information

This may include:

• bank account details;
• payment information;
• deposit and withdrawal records;
• financial position;
• income information;
• source of funds;
• source of wealth;
• transaction information; and
• other information reasonably required to provide financial services or satisfy regulatory requirements.

Trading and Transaction Information

When you use our services, we may collect information relating to:

• orders;
• executions;
• positions;
• transaction history;
• account balances;
• financial instruments;
• trading activity;
• trading preferences;
• platform activity; and
• other information associated with your use of our trading services.

Identity Verification and Compliance Information

We may collect information necessary for:

• Know Your Customer ("KYC") procedures;
• Anti-Money Laundering and Counter-Terrorism Financing ("AML/CTF") requirements;
• sanctions screening;
• fraud prevention;
• risk management;
• regulatory compliance;
• tax reporting; and
• other legal or compliance purposes.

This may include information obtained from identity verification providers, public databases, government sources and other lawful third-party sources.

Technical and Device Information

When you use our website, Finger Trader, MT4 or other digital services, we may collect:

• IP address;
• device identifiers;
• device type;
• operating system;
• browser information;
• application version;
• login information;
• language settings;
• time zone;
• network information;
• system logs;
• security logs;
• session information; and
• other technical information associated with your use of our services.

Usage Information

We may collect information about how you interact with our services, including:

• pages visited;
• features used;
• buttons or links selected;
• login activity;
• session duration;
• platform activity;
• errors;
• performance information; and
• other usage data.

Communications

We may retain communications between you and GDFS, including:

• emails;
• customer service enquiries;
• support requests;
• complaints;
• chat communications;
• telephone records, where applicable; and
• other correspondence.

Where permitted by law and where appropriate notice has been provided, telephone calls or electronic communications may be recorded for compliance, security, training or service-quality purposes.

03SENSITIVE INFORMATION

Certain information collected as part of identity verification, regulatory compliance or fraud-prevention procedures may constitute sensitive information under applicable law.

Where sensitive information is collected, we will collect and handle it only where permitted by applicable law and, where required, with your consent.

04HOW WE COLLECT INFORMATION

We may collect personal information directly from you when you:

• visit our website;
• submit an application;
• open an account;
• complete identity verification;
• use Finger Trader or MT4;
• deposit or withdraw funds;
• submit an order;
• contact customer service;
• complete a form;
• communicate with us; or
• otherwise use GDFS services.

We may also receive information from third parties, including:

• identity verification providers;
• financial institutions;
• payment service providers;
• banks;
• financial service providers;
• technology providers;
• market infrastructure providers;
• regulatory bodies;
• government agencies;
• fraud-prevention services;
• sanctions and screening databases;
• publicly available sources; and
• other service providers.

We will only collect information by lawful and fair means.

05WHY WE COLLECT PERSONAL INFORMATION

We may collect, hold, use and disclose personal information for purposes including:

• opening and administering Client accounts;
• verifying your identity;
• providing financial services;
• providing access to trading platforms;
• processing orders and transactions;
• processing deposits and withdrawals;
• providing market and account information;
• providing customer support;
• maintaining account security;
• detecting and preventing fraud;
• managing financial and operational risk;
• conducting AML/CTF and sanctions screening;
• complying with regulatory obligations;
• maintaining business and transaction records;
• responding to complaints;
• improving our services;
• maintaining and developing technology;
• monitoring system performance;
• conducting analytics;
• communicating with Clients;
• providing service notifications;
• protecting our legal rights;
• meeting legal, regulatory and tax obligations; and
• other purposes reasonably necessary for the operation of our business.

06IF YOU DO NOT PROVIDE INFORMATION

You are not generally required to provide personal information to browse publicly available areas of our website.

However, certain information is necessary for us to provide regulated financial services.

If you do not provide information requested for account opening, identity verification, regulatory compliance or another necessary purpose, we may be unable to:

• open your account;
• provide a particular service;
• process a transaction;
• process a withdrawal;
• complete identity verification; or
• continue providing services to you.

07ANONYMITY AND PSEUDONYMS

Where lawful and practicable, you may interact with GDFS without identifying yourself or by using a pseudonym.

However, financial services and regulated account activities generally require GDFS to verify the identity of the Client.

Accordingly, anonymous or pseudonymous access may not be available for account opening, trading, payment, withdrawal or other regulated activities.

08HOW WE USE PERSONAL INFORMATION

GDFS will generally use personal information for the purpose for which it was collected or for a related purpose permitted by law.

We may also use information where:

• you have provided consent;
• the use is required or authorised by law;
• the use is reasonably necessary for regulatory or compliance purposes; or
• another legal basis permits the use.

09DISCLOSURE OF PERSONAL INFORMATION

We may disclose personal information where reasonably necessary to provide our services or operate our business.

Recipients may include:

• banks;
• payment providers;
• financial institutions;
• brokers;
• execution venues;
• liquidity providers;
• custodians;
• market-data providers;
• technology providers;
• identity verification providers;
• KYC and AML service providers;
• fraud-prevention providers;
• cloud and hosting providers;
• communications providers;
• professional advisers;
• auditors;
• insurers;
• related corporate entities;
• government agencies;
• courts;
• law enforcement authorities;
• regulators; and
• other parties where required or permitted by law.

We do not sell personal information as a business model.

10TRADING PLATFORMS

GDFS may provide access to trading services through Finger Trader, MetaTrader 4 ("MT4") and other technology platforms.

Information generated through these platforms may include:

• account information;
• order information;
• transaction information;
• market activity;
• device information;
• login information;
• technical logs; and
• usage information.

This information may be processed by GDFS and relevant technology or financial service providers where necessary to operate the relevant platform and provide services to you.

11FINGER TRADER

Where you use Finger Trader in connection with your GDFS account, personal information and trading information may be processed through technology infrastructure used to provide Finger Trader services.

This may include information necessary for:

• authentication;
• account management;
• order transmission;
• market-data delivery;
• transaction processing;
• security;
• technical support; and
• service monitoring.

Technology providers supporting Finger Trader may process information on behalf of GDFS where necessary to provide the relevant services.

12METATRADER 4

Where GDFS provides access to MetaTrader 4 ("MT4"), information may be transmitted to or processed through infrastructure associated with MT4 and relevant service providers.

This may include account identifiers, order information, transaction information, technical information and other data required to operate the trading service.

Third-party technology providers may be subject to their own privacy and data-handling obligations.

13OVERSEAS DISCLOSURE AND PROCESSING

GDFS operates in an international financial and technology environment.

Personal information may therefore be disclosed to, accessed by, or processed by service providers or other recipients located outside Australia.

These may include jurisdictions in which our technology providers, financial institutions, market infrastructure providers, identity verification providers, cloud providers, related entities or other service providers operate.

Where practicable, GDFS will identify the countries in which overseas recipients are likely to be located.

The particular countries involved may vary depending on the services used by a Client and the third-party providers involved.

Where required by Australian privacy law, GDFS will take reasonable steps in relation to overseas disclosures of personal information.

14DATA STORAGE

Personal information may be stored electronically or, where necessary, in physical form.

Electronic information may be stored using:

• GDFS systems;
• secure data centres;
• cloud infrastructure;
• third-party service providers; and
• other technology infrastructure used in connection with our services.

Information may be stored or processed in Australia or overseas.

15DATA SECURITY

GDFS takes reasonable steps to protect personal information against:

• misuse;
• interference;
• loss;
• unauthorised access;
• unauthorised modification; and
• unauthorised disclosure.

Security measures may include, where appropriate:

• access controls;
• authentication mechanisms;
• encryption;
• network security;
• system monitoring;
• logging;
• security reviews;
• backup systems;
• internal access restrictions; and
• security procedures for employees and service providers.

No electronic system or internet transmission can be guaranteed to be completely secure.

Clients are also responsible for protecting their account credentials, devices and authentication information.

16DATA RETENTION

GDFS retains personal information for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable legal, regulatory, accounting, tax, dispute-resolution and record-keeping requirements.

Financial services and AML/CTF laws may require certain records to be retained for specified periods even after a Client account has been closed.

When personal information is no longer required and we are not legally required to retain it, GDFS will take reasonable steps to destroy or de-identify the information where appropriate.

17COOKIES AND SIMILAR TECHNOLOGIES

Our website and digital services may use cookies and similar technologies.

These technologies may be used to:

• maintain sessions;
• remember preferences;
• improve website functionality;
• analyse website usage;
• monitor performance;
• maintain security;
• detect fraud; and
• improve our services.

You may be able to control cookies through your browser or device settings.

Disabling certain cookies may affect the operation of some website or platform features.

Additional information may be provided in our Cookie Policy or cookie management interface.

18ANALYTICS

GDFS may use analytics services to understand how Clients and visitors use our website and digital services.

Analytics information may include:

• device information;
• browser information;
• IP address;
• pages viewed;
• session information;
• interaction data; and
• performance information.

Where appropriate, information may be aggregated or de-identified.

19DIRECT MARKETING

Where permitted by law, GDFS may use personal information to communicate with you about:

• GDFS services;
• new features;
• products;
• market information;
• events;
• educational content; and
• other information that may be relevant to our Clients.

You may opt out of direct marketing communications using the unsubscribe mechanism provided in the communication or by contacting GDFS.

Operational, security, regulatory and account-related communications may still be sent where necessary even if you opt out of marketing communications.

20AUTOMATED PROCESSING AND DECISION-MAKING

GDFS may use automated systems to assist with operational, compliance, security and risk-management processes.

Depending on the service and applicable law, automated systems may assist with matters such as:

• identity verification;
• fraud detection;
• AML/CTF monitoring;
• sanctions screening;
• account security;
• transaction monitoring;
• risk assessment; and
• service eligibility.

Where GDFS arranges for a computer program to use personal information to make, or substantially and directly contribute to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, GDFS will provide information about such arrangements where required by applicable privacy law.

Where appropriate, automated processes may be subject to human review.

21ACCESS TO YOUR PERSONAL INFORMATION

You may request access to personal information GDFS holds about you.

Requests may be made using the contact information at the end of this Privacy Policy.

We may need to verify your identity before providing access.

In certain circumstances permitted by law, GDFS may refuse or limit access.

If access is refused, we will provide an explanation where required by law.

22CORRECTION OF PERSONAL INFORMATION

GDFS takes reasonable steps to ensure that personal information it collects is accurate, complete and up to date.

You should notify us if your personal information changes or if you believe information held by GDFS is inaccurate.

You may request correction of your personal information by contacting us.

We may request supporting documentation where reasonably necessary to verify the requested correction.

23ACCOUNT INFORMATION

Clients may be able to review or update certain information directly through their account or Client portal.

Certain information, including verified identity information, may require additional verification before it can be changed.

24PRIVACY COMPLAINTS

If you believe GDFS has mishandled your personal information or breached applicable privacy requirements, please contact us.

Please provide sufficient information for us to understand and investigate your complaint.

GDFS will review privacy complaints and respond in accordance with applicable legal requirements and our internal procedures.

If you are not satisfied with our response, you may have the right to make a complaint to the Office of the Australian Information Commissioner ("OAIC") or another applicable regulatory authority.

25DATA BREACHES

GDFS maintains procedures for responding to suspected or actual data breaches.

Where a data breach is subject to notification requirements under applicable Australian law, GDFS will take the steps required by law, including notifying affected individuals and the relevant regulatory authority where required.

26CHILDREN

GDFS financial services are not intended for persons who are not legally eligible to open an account.

We do not knowingly provide trading accounts to children who do not satisfy applicable age and legal-capacity requirements.

27THIRD-PARTY WEBSITES AND SERVICES

Our website or platforms may contain links to third-party websites, applications or services.

GDFS is not responsible for the privacy practices of independent third parties.

You should review the privacy policy of the relevant third party before providing personal information directly to them.

28INTERNATIONAL CLIENTS

Clients may access GDFS services from jurisdictions outside Australia.

Privacy and data-protection rights may differ between jurisdictions.

Where additional privacy requirements apply to GDFS in relation to a particular Client or service, we will handle personal information in accordance with those applicable requirements.

29GOVERNMENT AND REGULATORY DISCLOSURE

GDFS may disclose personal information to regulators, government agencies, law enforcement authorities, courts or other authorised bodies where:

• required by law;
• authorised by law;
• required by a court or regulatory order;
• necessary for regulatory reporting; or
• otherwise legally permitted.

30BUSINESS TRANSFERS

If GDFS undergoes a corporate restructuring, merger, acquisition, financing, sale of business or transfer of assets, personal information may be disclosed or transferred as part of that transaction where permitted by law.

Any recipient will be required to handle personal information in accordance with applicable legal requirements.

31CHANGES TO THIS PRIVACY POLICY

GDFS may update this Privacy Policy from time to time to reflect:

• changes to our services;
• changes to our technology;
• changes to our information-handling practices;
• regulatory developments; or
• changes in applicable law.

The current version will be published on the GDFS website.

The "Last Updated" date at the beginning of this Privacy Policy indicates when the policy was most recently revised.

Where appropriate or required by law, we may provide additional notice of material changes.

32CONTACT US

For questions, requests or complaints relating to privacy or personal information, please contact:

GDFS Trade International Pty Ltd

Australian Financial Services Licence No. 480291

Customer Service: 400 120 3205

Email: [email protected]

Address: GEORGE HALIKIOTIS, 'Eakin McCaffery Cox', Level 28, 1 Market Street, Sydney NSW 2000, Australia

33FURTHER INFORMATION

Further information about privacy rights in Australia is available from the Office of the Australian Information Commissioner.