Privacy notice

Who is responsible

Trading Trust Index (“we”, “us”) is responsible, as controller, for the personal data described in this notice. We are based in Cyprus, and the General Data Protection Regulation (GDPR) and the data protection law of Cyprus apply to what we do.

We do not publish an email address. For any question or request about your personal data, use our contact form and choose “Privacy request about your personal data”. We have not appointed a data protection officer, as the law does not require one for what we do; the same form reaches the people who handle privacy.

At a glance

Submissions marked as spam are deleted after 30 days. The sections below explain each line.

When you visit the site

Like any website, ours receives technical information from your browser with every request: your IP address, the type of browser and device, the page you asked for and the time. Our hosting provider, Netlify, uses it to deliver the pages, keep the service secure and find faults, and keeps it in its logs for a short period. We do not use it to identify you or build a profile of you.

We use no analytics, advertising or tracking tools, no tracking pixels, and no cookies of our own; see our cookie notice. Our legal basis is our legitimate interest in running a secure website.

What you send us through our forms

• Contact form: your name, email address, what your message is about and the message, to reply to you and handle your request.
• Error reports and broker suggestions: what you tell us and, if you give it, your name and email address, to check and improve our research and, if you ask, to tell you what we did.
• Complaints about a broker: your account of a problem with a firm and any details you choose to give, such as your name, email address, country and the approximate sums involved. We use them to decide which firms and practices to research. We never publish a complaint or pass it to the firm, and we contact you only if you agree to it.
• Right of reply: the name, role and work email address of the person responding for a firm, and the response, to verify it and publish it as agreed.
• Verification applications and assessments: the company’s details and the name, role, company email address and phone number of the person applying, to handle the application, agree the scope and carry out the assessment. During an assessment we keep identity documents, account details and the names of staff we meet. They are kept private and never published; reports describe staff by their role only.
• Protection against abuse: when you send a form we keep a salted, one-way hash of your IP address, never the address itself, for up to two days, so that we can limit spam and repeated submissions.

Our legal bases are: our legitimate interests in running and researching an independent publication, answering the people who write to us and protecting our forms from abuse; your consent where we ask for it, such as agreeing to be contacted about a complaint, which you can withdraw at any time; taking steps at a company’s request before an assessment, and carrying out the agreement for it; and complying with our legal obligations, such as keeping business records.

Please do not send us more personal data than your message needs, or anyone else’s personal data that you are not entitled to share.

When we work with firms

Our partnership operations, including our discussions with firms about verification assessments and partnerships, are managed for us by Unita Media. When we speak with a firm, we and Unita Media handle the names, roles and work contact details of the people who represent it, and our correspondence with them, to answer their questions, agree terms and carry out any agreement. Our legal bases are our legitimate interest in running our business with firms, taking steps at a company’s request before an agreement, and carrying out the agreement.

Contributors

If you apply to write for us, we use what you send, including your name, email address, role and employer, expertise, links to your profiles and work, proposed topics and the ties to the industry you declare, to assess your application and vet you. Vetting includes confirming your identity and professional background. Our legal bases are taking steps at your request before an agreement, and our legitimate interest in publishing reliable educational content.

If we work together, we publish your name, the role and biography we agree, your photo if you provide one, the links you choose and your declared interests on your contributor profile and with your articles, as part of our agreement with you. You can ask us to update your profile at any time. Your articles stay published under your name after you stop contributing, so that the record of what we published stays accurate; if you want your profile changed or removed, ask us and we will weigh your request against that.

People named in our research

Our profiles, assessments and reports are about companies, but they can include personal data about people in their professional role: for example the names of directors, owners or senior managers as they appear in public registers, regulators’ decisions, court records, company filings and the press, which are also our sources. We publish this information because it is needed to show who runs and owns a firm that holds clients’ money, which is in the public interest. Our legal basis is our legitimate interest in publishing independent research, together with the freedom of expression and information that data protection law protects for publications like ours.

We do not publish private addresses or personal contact details. If you are named in our research and think something about you is wrong, out of date or should not be there, use our contact form or report an error. We will look into it and correct what is wrong, as our editorial standards require.

What we do not do

• We do not sell personal data, and we do not share it with the firms we cover.
• We do not send newsletters or marketing messages.
• We do not make decisions about you by automated means, and we do not profile you. Our trust scores are about firms, not people.
• We do not track you, so “Do Not Track” and Global Privacy Control signals from your browser have nothing to switch off. Other websites we link to have their own privacy notices.
• We do not tell firms who you are. When you follow a link from us to a firm’s website, the firm can see only that the visit came from Trading Trust Index: your browser passes on our web address, not the page you were reading, and our “Visit” and website links also carry our name and whether you came from a profile or a comparison.

Who processes it for us, and transfers

• Netlify hosts the website and runs it, including the forms you send us, and keeps the messages you send through them. It may process data in the United States and other countries where it runs servers.
• Unita Media manages our partnership operations: it speaks with firms about verification assessments and partnerships, and handles the contact details and correspondence of the people who represent them, including verification applications sent through our forms. It may process data in Cyprus.

Netlify and Unita Media act only on our instructions, under data processing agreements. Where personal data is processed outside the European Economic Area, the transfer relies on the safeguards in those agreements, such as the European Commission’s standard contractual clauses, or on an adequacy decision of the Commission.

Otherwise we disclose personal data only where the law requires it, for example to a court or a public authority, or where it is needed to establish, exercise or defend a legal claim.

How long we keep it

• What you send through our forms is kept in our account with our hosting provider, Netlify, where we read and handle it. If a message cannot be stored there, a backup copy is kept privately in the same account until we collect it into our own records, and for 12 months at most.
• Submissions marked as spam: deleted after 30 days.
• Other submissions: deleted 12 months after we finish handling them, unless we need them for a legal claim. Research that grows out of a submission is kept, without your personal details.
• Verification applications that lead to an assessment: kept with the assessment record for as long as the business relationship needs it, and business records for as long as tax and accounting law requires.
• Contributor applications that do not lead to an agreement: deleted 12 months after we decide. For contributors we work with: kept for as long as we work together, and the published profile while their articles are published.
• Business contacts at firms and our correspondence with them: kept for as long as the business relationship needs them and tax and accounting law requires; where no relationship follows, deleted 12 months after the last contact.
• Technical logs: kept by our hosting provider for a short period, then deleted.

Your rights

Under data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• have it corrected if it is wrong or incomplete;
• have it deleted, or its use restricted, in the cases the law sets out;
• object at any time to our use of it on the basis of our legitimate interests;
• receive the data you gave us in a portable format, where the law provides for it; and
• withdraw your consent at any time, where we rely on it, without affecting what we did before.

To use any of these rights, use our contact form and choose “Privacy request about your personal data”. It is free. We may ask you to confirm your identity first. Someone you authorise can make a request for you; we may ask them for proof of that. We reply within one month, or tell you within that month if a complex request needs up to two more. Some rights have limits: for example, we may keep publishing information about a firm’s directors where the public interest in our research outweighs the objection.

You can also complain to a data protection authority: in Cyprus, the Commissioner for Personal Data Protection (opens in a new tab), or the authority where you live or work. We would appreciate the chance to put things right first.

Children

Our site is meant for adults, and trading leveraged products is only for adults. We do not knowingly collect personal data from anyone under 18. If you think a child has sent us personal data, tell us through the contact form and we will delete it.

Security

The site is served only over encrypted connections. What you send through our forms is stored privately, is never published, and only the people who handle it can see it. No system is perfectly secure, but we take care to keep personal data safe and to keep as little as we need. If a personal data breach is likely to put your rights at risk, we will report it to the Commissioner and, where the law requires, tell you.

Changes to this notice

We will update this notice when what we do changes. The date at the top shows the last change.