Summary of how we use your data

We respect your privacy and are committed to protecting it as described in this notice.

We use your personal data to provide, improve and administer the Exchange trading platform, to enter into and perform the terms of service with our users, and to comply with regulatory requirements.

Data is shared with our vendors, and when we have a good faith belief that doing so is necessary to comply with regulatory enquiries or requirements.

Our privacy notice sets out more details of this processing, including details of your data protection rights, and your right to object to certain processing.

What does this notice cover?

This notice describes how Exchange PTY LTD and its affiliates (referred to as Exchange PTY LTD Group”, “we” or “us” in this notice) will collect, make use of and share (i.e. “process”) your personal data in connection with the Exchange website, apps and services (including API services).

This notice also describes data protection rights you may have (depending on applicable law), such as a right to object to some of the processing which the Exchange PTY LTD Group carries out. More information about your rights, and how to exercise them, is set out in the “Your rights” section.

What personal data do we process?

We process personal data about you when you interact with us, our websites, our apps or our services (including API services). This includes:

your name, email address / username, password and other login/security details (e.g. two-factor authentication token seed record), and login records;

your payment details / bitcoin and other cryptocurrency wallet address;

your account and portfolio details, such as live and historical orders, trades and positions, and balances;

your site and account preferences, including site notification, sounds and confirmation dialogs and leaderboard preferences;

any personal data you submit for ID verification purposes, and your self-reported location plus the geolocation of the IP address you connect from;

your marketing and other communication preferences, and a record of any consents you have given us;

information related to the browser or device you use to access our website or apps, as well as data that tells us which features of the website/app are popular, or suffer from issues we need to fix;

the content and details (e.g. date) of messages you send us (e.g. customer support queries); and

customer service notes and other records.

We will aim to mark data fields as optional or mandatory when collecting personal data from you via forms. Note, in particular, that to create an account, engage in transactions, and where necessary, prove your identity, the provision of personal data is typically mandatory: if relevant data is not provided, then we will not be able to do these things and provide the services you expect. You do not have to provide a name when creating an account, but this may limit our ability to verify your identity later, for instance if you have forgotten your password and are trying to recover your account.

We do not collect fingerprints, facial recognition data, or other biometrics. Where you enable biometric security (such as fingerprint or Face ID login), your biometrics will be handled by your device, not by us. We may receive photos of yourself and of your photo ID that you submit to us.

creating your account;

if necessary, verifying your identity;

taking deposits and fees, and paying out withdrawals;

allowing you to make trades, maintaining your account and trading history, and closing / auto-deleveraging / liquidating positions in accordance with our published policies and terms of service;

communicating with you; and

providing customer services;

As required by the Exchange PTY LTD Group or third parties to conduct their business and pursue their other legitimate interests, in particular:

to provide services you have requested;

to monitor, improve and protect the services on our website and apps, in particular by looking at how they are used, testing alternatives (e.g. by “A/B testing”, and running “beta” version trials), and by learning from feedback and comments you provide;

to personalise our website, apps and services;

to monitor customer accounts to prevent, investigate and/or report misconduct such as spam, misrepresentation, security incidents or crime (such as fraud), in accordance with applicable law, and to cooperate with authorities seeking to do the same;

to investigate any complaints received from you or from others;

in connection with legal claims, compliance, regulatory or investigative purposes (including disclosure in connection with legal process or litigation); and

to invite individuals to take part in market research and beta tests.

Where you give us consent (so far as that consent is required):

we will send you direct marketing in relation to our relevant products and services, or other products and services provided by us and carefully selected partners;

we place cookies, monitor email engagement, and use other similar technologies in accordance with our Cookies Notice and the information provided to you when those technologies are used;

on other occasions where we ask you for consent, we will use the data for the purpose which we explain at that time.

For purposes which are required by law, in particular:

in response to requests by relevant courts and public authorities, such as those conducting an investigation.

Fully-automated decision-making that could have significant effects on you

As the service documentation on our site and our terms of service explain, our trading platform applies certain automatic processes based on your trading positions and the resources on your account.

For example, most Exchange instruments are highly leveraged. To keep positions in these instruments, open, traders are required to hold a percentage of the value of the position on the exchange, known as the Maintenance Margin percentage. If you cannot fulfil your maintenance requirement, and liquidation is therefore triggered, we will cancel open orders on the current instrument, you will be partially or fully liquidated, and your maintenance margin can be lost. For more on that process, see here and the FAQ here.

Other significant automated decision-making that uses your personal data may also be employed, to protect accounts and to uphold our terms of service. In particular, if you attempt to log-in from a jurisdiction to which our services are restricted, your account may be automatically locked, and you will be invited to contact customer support to unlock it; as part of this, you may be asked to provide proof of ID and/or location outside a restricted jurisdiction. During an account lockout, you will be unable to view your positions, make any trades, or open/close any orders.

API usage and behaviour is monitored in order to protect our systems and to uphold our terms of service. Automated decision-making may be employed to manage your account’s API access or rate limit permits based on your API usage and trading behaviour (this may include limiting or preventing access and activity on your account).

Relying on our legitimate interests

To the extent required by law, we aim to carry out balancing tests when significant data processing activities are justified on the basis of our “legitimate interests”, as described above.

Withdrawing consent or otherwise objecting to direct marketing

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes, such as those set out above. In some cases, we are able to send or display marketing without your consent. You have an absolute right to opt-out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic message, changing your account settings, or by contacting us using the details set out below.

Your rights

Depending on applicable law (in particular, whether the laws of the UK or EEA countries apply), you may have the right to ask us for a copy of personal data about you; to correct or delete that personal data; restrict the processing of that personal data; and to obtain a copy of personal data about you that you provided to us (in connection with our agreement with you, or with your consent), in a structured, machine readable format, and to ask us to port this data to (i.e. share that data with) another organisation.

In addition, applicable law may provide the right to object to the processing of personal data about you, in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

You have the right to appeal the result of significant fully automated decisions. This should be done by emailing us within 3 working days from the date of the decision, which we will then review.

If these rights apply, they may however be limited, for example if fulfilling your request would reveal personal data about another person, would infringe the rights of another person or legal entity (including our rights), or if you ask us to delete or change data which we are required by law to keep (or have other compelling legitimate interests in keeping). We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch using the details set out below. If you have unresolved concerns, you typically have the right to complain to regulators, depending on applicable law. For example, in the EEA, your complaint can likely be taken to data protection authorities where you live, work or where you believe a breach may have occurred.