Privacy Policy

1.1 Your privacy and the security of your Personal Data are important to us. This Privacy Statement("Statement") describes how Aurex Limited, its affiliates, and related entities (collectively “Aurex” “Company”, “we” or “us”) collect and process personal data about you during and after using Aurex’s services. This Privacy Statement, together with any agreement between us and any documents and other policies referred to in such agreement (together our "Terms of Use") applies to the use of Aurex’s website, app, extranet, sandbox, software, systems and services.

1.2 This Statement applies to Aurex Limited with company no. 810627-1 registered in Seychelles. This statement will remain in effect.

1.3 We encourage you to read this Privacy Statement carefully and to use it to understand our views and practices regarding personal information and how we will treat it, to help you make informed decisions. By using Aurex’s services, you accept and consent to the practices described in this Statement and Aurex’s underlying Privacy Policy.

1.4 This Statement applies to all Personal Data we obtain, handle, process, store or transfer (to third parties) personal data, regardless of the media on which that data is stored, including but not limited to Aurex’s website, pilots, development sandboxes or during interactions you may have with us through various other mediums e.g., webinars, user groups, events, registered users.

1.5 We will only process your personal data in accordance with our Privacy Policy unless otherwise required by Applicable Law. This Statement sets out the personal data protection rules and legal conditions that we must follow when we obtain, handle, process, transfer or store personal data. We take steps to ensure that the personal data that we collect about you is adequate, relevant, not excessive, and processed for limited purposes.

1.6 Aurex is the Data Controller for the data collected and processed in connection with Personal Data obtained when you visit our website, during the registration and application process, and throughout your continued use of Aurex’s services in the Seychelles, European Economic Area (EEA) and the United Kingdom (UK).

1.7 The Data Protection Officer (“DPO”) of Aurex (in its capacity as the Data Controller) is responsible for ensuring compliance with all Applicable Legislation and this Statement.

1.8 Certain capital terms that are used, and not otherwise defined, in this Statement, such as the terms “Controller”, “Data Subject”, “Personal Data”, “Processor” and “Processing” shall have the meaning given to these terms in the following:

2.1 For the purposes of this Statement, personal data means any information about an identifiable individual (“Personal Data”). Personal Data excludes anonymous or de-identified data that is not associated with a particular individual. To carry out our activities and obligations pertaining to the Service we offer to you, we may collect, store and process the following categories of Personal Data:

2.2 Personal Data you give us:

2.2.1 We collect most of the Personal Data that we process directly from you:

• Registration and contact details: Personal Data such as name, mailing address, income, telephone number, tax ID, payment information, profession, employment or business information, and other information necessary to connect to Aurex.
• (Electronic) Identification data: Personal Data to verify your name, address, email, phone number, government-issued identification, age and biometric data.
• Trade or Payment Information: Information you give to us using a payment instrument, meaning any payment device accepted on any Aurex platform, such as a debit or credit card, Wallet, Trade or Corporate Account.
• Data received in the context of performance of Service: Information you choose to enter into your Service-related account about you or third parties or by filling in forms or submitting data via Aurex’s Services, such as your user ID, email, mobile number, profile picture, gender, preferred language, IP address, or personal description which may include sensitive Personal Data that may reveal personal characteristics such as your imported contacts or biometric data.
• Communications with Aurex: If you contact us or establish correspondence with us, we may keep a record of it (e.g., by email or chat). This may include interactions with us, including any user content. User content may consist of recipient username, name or email, chat content, and images, audio, documents, and files you attach.

2.3 Personal Data we collect about you, including from other sources:

2.3.1 Each time you access or use Aurex’s Services we may automatically collect the following information:

• Technical information, including the type of device you use, a unique device identifier, network information, the type of operating system and browser you use, time zone settings, and other device-related information;
• Device identification information for fraud prevention purposes (referred to in the application at the time of installation of a device);
• Details of your access or use of any of Aurex’s Services including, but not limited to traffic data, weblogs and other communication data, whether this is required for our own purposes or otherwise and the resources that you access;
• Login details;
• Date, time and duration of access including pages viewed;
• Event logs (e.g., changes in passwords).

2.4 Personal Data collected from third parties:

2.4.1 We work closely with third parties (e.g., business partners, sub-contractors in technical, delivery services, advertising networks, analytics providers and search information providers) and as such may collect the following information:

2.4.2 Identity Verification: We will verify your corporate address and personal data of your directors, your authorised persons, as well as any partner, persons with significant control over your business, or beneficial owners in order to confirm your identity. We may also pass the aforementioned personal data to a credit reference agency, which may keep a record of that information. This is done only to confirm your identity and does not contain information from Credit Reporting Agencies. We do not perform credit checks and therefore your credit rating will be unaffected.

2.4.3 Information related to legal requirements: Aurex maintains relations with financial institutions which are required to assist in the fight against money laundering activities and the funding of terrorism by obtaining, verifying, and recording identifying information about all customers. We may therefore legally consult other sources to obtain information about you, any sender, and any recipient.

2.4.4 Providing services to Aurex: In order to provide the Services to you, Aurex works with suppliers and correspondent banking service providers from whom we may collect Personal Data, including:

• banking and lending partners, banking intermediaries and international payment-service providers; or
• suppliers who provide us with IT, payment and card delivery services, which includes but is not limited to: Microsoft, Sum & Substance Limited, Mambu Tech Ltd, Comply Advantage, and ION Trading UK Limited, Metatrader.
• We also use cookies to distinguish you from other users of Aurex's Services. This helps us to provide you with an enhanced experience when you access or use Aurex's Services. Please refer to our Cookie Policy.

3.1 We only process your Personal Data where Applicable Law permits or requires it, including (i) where the processing is necessary for entering a business relationship with you as well as the specific Service and transactions you agree to, (ii) where the processing is necessary to comply with a legal obligation that applies to us as the Controller of your Personal Data, (iii) where your data is processed for our legitimate interests or the legitimate interests of third parties, (iv) where the processing is necessary to protect your vital interests, or (v) where your informed consent has been provided if Applicable Law requires consent.

3.2 Personal Data processing for pre-contractual and contractual purposes

3.2.1 We may process your Personal Data that we consider necessary to fulfil our pre-contractual and contractual obligations to you and without which you will not be able to use the Service.

3.2.2 These generally include the following necessary categories of Personal Data:

• Registration and contact information and identification information;
• Personal details including name and contact information when you contact us or use the Service;
• Complying with legal obligations;
• Transaction information, information connected to your account;
• Information from credit reviewing agencies and other financial institutions;
• Technical usage data, device information and location data.

3.2.3 The specific data processing purposes are determined in accordance with specific Services and the underlying contractual terms and conditions.

3.3 Personal Data processing for our legitimate interests

3.3.1 We may process your personal data for our own legitimate interests, including for the following purposes:

• To prevent fraud, carry out risk analysis and management;
• To ensure network and information security, including, but not limited to preventing unauthorised access to our computer and information systems;
• To support internal administration with our affiliated entities;
• To determine your eligibility for, and to communicate with you about pre-approval of Services you may qualify or that may be of interest for you;
• To use your Personal Data to allow us to further evaluate, improve and promote our business and Aurex’s Services.

3.4 Personal Data processing which requires your consent

3.4.1 With your consent we may collect and process the following special categories of Personal Data when you voluntarily provide them for the following legitimate business purposes. Where we have a need to process special categories of data for purposes identified in our specific Services and the underlying contractual terms and conditions, we will only do so only after providing you with notice and, if required by law, obtaining your prior, express consent. We will always treat special categories of Personal Data as confidential and we will only share such Data internally where there is a specific and a legitimate purpose for sharing the data and if required by law, obtaining your prior, express consent. As set out in our Data Protection and Retention Policy, we have implemented appropriate physical, technical, and organisational security measures designed to secure your Personal Data against accidental loss and unauthorised access, use, alteration, or disclosure.

3.5 Anonymised Personal Data processing

3.5.1 We may also use your Data on an aggregate or anonymous basis (such that it does no longer identify any individual clients) for various purposes, where permissible under Applicable Laws and regulations.

3.6 Additional processing of your Personal Data

3.6.1 Notwithstanding the above, we will use your Personal Data for the following purposes:

• We may associate any category of information with any other category of information and will treat the combined information as Personal Data in accordance with this Statement for as long as it is combined.
• If we have received your Personal Data from someone who asked for your consent to share that information with us, we may rely on that consent (to the extent we are allowed to by law), or one of the other grounds noted above.

4.1 We will only disclose your Personal Data to third parties where required by law or services and to manage our relationship with you, designated agents, or third-party service providers who require such information to assist us with administering obligations with you, including third-party providers. These third-party providers may be located outside your home jurisdiction.

4.2 Sharing of Personal Data for legitimate purposes

4.2.1 We may also disclose your Personal Data for the following additional legitimate purposes, where permitted or required by Applicable Law:

• If we are under obligation to disclose or share your Personal Data in order to comply with any legal or regulatory obligation or request. When we disclose your personal aforementioned reasons, we will take reasonable steps to ensure that we only disclose the minimum Personal Data necessary for the specific purpose and circumstances;
• In the event of a novation of the Services from Aurex to another;
• If we sell or buy any business or assets, in which case we will disclose your Personal Data to the prospective seller or buyer of such business or assets, if necessary to complete the transaction. In these circumstances, we will limit Data sharing to what is absolutely necessary, and we will anonymize the data where possible;
• Where the Data is publicly available.

4.3 Sharing of Personal Data to carry out our contractual obligations

4.3.1 We may also share your data to carry out our obligations arising from any contracts entered into between you and us:

• To notify you about changes to our Services;
• To ensure that content from Aurex’s Services is presented in the most effective manner for you and for your devices;
• To administer Aurex’s Services and for internal operations, including troubleshooting, data analysis, testing research, statistical and survey purposes;
• As part of our efforts to keep Aurex’s Services safe and secure;
• To maintain our own accounts and records;
• To support and manage our employees, as our use of your information for all of these purposes will be necessary for our legitimate interests of providing Aurex’s Services appropriately and efficiently, maintaining accurate records and ensuring our systems run correctly;

4.3.2 We may also process your Personal Data for us to comply with a legal obligation.

4.4 Sharing of Personal Data due to business acquisition

4.4.1 If Aurex is acquired by a third party, substantially all of its assets are likewise acquired, in which case Personal Data held by it about its customers will be one of the transferred assets, in order to:

• Protect against fraud
• Enforce or apply the Terms of Use or to investigate potential breaches;
• Protect the rights, property or safety of Aurex, our members, or others (which may include exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

4.5 Sharing of Personal Data to comply with Legal Requirements

4.5.1 We may be required from time to time to disclose or share information with regulatory and law enforcement authorities and judicial bodies if necessary to comply with legal requirements.

4.6 Sharing of Personal Data with External Parties

4.6.1 We may enter into agreements with third parties including but not limited to business partners, service providers who perform functions on our behalf (including external consultants and professional advisers such as lawyers, auditors, and accountants), outsourced IT providers, analytics and search engine providers, necessary for the performance of our contract with you. Such third-party outsourcing may include solutions such as software as a service, cloud computing, external hosting, deployment management, technical service provision or similar solutions. Under these agreements we may share your information with these external parties, to the extent that use of your information for these purposes is necessary for our legitimate interests or for the legitimate interests of those external parties.

4.6.2 Key Suppliers

4.6.3 In order to help us provide you with the best service, we share your personal data with a few key suppliers and correspondent banking service providers, to process your information on our behalf. These key suppliers and service providers.

4.6.4 Other third parties

4.6.5 As mentioned above, we may share your personal information with other third parties where it is necessary to provide you with our services and to manage our relationship with you. These include:

• Analytics providers and search information providers to help us improve our website or app.
• Customer-service providers, survey providers and developers, to help us provide our services to you.

4.6.6 Communications service providers, to help us send you emails, push notifications and text messages.

4.7 Transfer of Personal Data Outside of the Seychelles

4.7.1 Your Data may be transferred to, and stored at, a destination outside the Seychelles, within and outside the European Economic Area (“EEA”). It may also be processed by staff operating outside United Kingdom or the EEA who work for us, our affiliates, or for one of our affiliates or partners. These staff may be engaged in the fulfilment of your request, order or reservation, the processing of your details and the provision of support services. By submitting your personal data or using Aurex’s Services, you agree to this transfer, storing or processing.

4.7.2 We utilise standard contract clauses approved by the Information Commission Seychelles, European Commission, adopt other means under European Union law, and obtain your consent to legitimise data transfers from the EEA to and destinations outside the EEA. Aurex will take all steps reasonably necessary to ensure that your personal information is treated securely and in accordance with this Notice.

4.7.3 All information you provide to us is stored on our secure servers. We use, and our third-party suppliers use, encrypted transport layer security technology in our transactions.

4.7.4 Transfer of Personal Data outside of the Seychelles

4.7.5 The aforementioned external parties may be located anywhere in the world and may require the transfer of information to countries which do not have data protection laws as strict as those in in the Seychelles, United Kingdom and the EEA. The Customer may, upon request, obtain a list of countries concerned. Such list may change from time to time.

4.7.6 The aforementioned solutions provided by external parties will be governed by Applicable Law relevant to the jurisdiction in which they are carried out or where the third-party provider may be located. This may lead to additional obligations and responsibilities including, but not limited to, the disclosure of information.

4.7.7 Aurex has put in place policies and internal risk procedures to ensure that the necessary steps are taken to assess and manage any risks that arise from such outsourcing. Amongst other things, the Company ensures that security measures are in place to maintain the confidentiality and integrity of its information and data.

4.8 Personal Data Access or Correction

4.8.1 Individuals wishing to access or correct the information that we hold about them can do so by contacting our Data Protection Officer at [email protected]

5.1 We will hold your information for as long as is necessary to fulfil the purpose we collected it for, as required by our statutory, accounting, or reporting obligations and in accordance with our legitimate interests as a data controller.

5.2 We will not retain your personal information for longer than is necessary for the practices described in this Statement. To determine the appropriate retention period for personal data, we consider applicable legal requirements, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes we process your personal data for, and whether we can achieve those purposes through other means. We specify the retention periods for your personal data in our data retention policy.

5.3 Under some circumstances we may anonymize your personal data so that it can no longer be associated with you. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent. Once you are no longer using our services, we will retain and securely destroy your personal data in accordance with our data retention policy and Applicable Laws and regulations.

6.1 We maintain physical and electronic safeguards that comply with applicable legal standards to secure the confidentiality of your information, including personal information from unauthorised access and use, alteration, and destruction.

6.2 We maintain strict security systems designed to prevent unauthorised access to your personal data by anyone, including our staff.

6.3 We will always strive to ensure that your personal data will be protected against unauthorised or accidental access, processing, or erasure. We maintain this commitment to data security by implementing appropriate physical, electronic, and managerial measures to safeguard and secure your personal data.

6.4 Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your Data transmitted to Aurex’s Services; any transmission is at your own risk. Once we have received your Data, we will use strict procedures and security features to try to prevent unauthorized access.

6.5 It is your responsibility to ensure that all of your users accessing Aurex’s Services are aware of your security obligations in doing so. We may require your users to provide certain security credentials and/or to answer certain questions (e.g., a memorable word) in order to validate such user and grant access to Aurex’s Services. You are responsible for ensuring that all users possess valid security credentials.

7.1 It is important that the Personal Data we hold about you is accurate and current. You have the right to be informed about the processing of your personal information in order to exercise your rights. Please keep us informed if your personal data changes during our Service to you. By law you may have the right to request access to, correct, and erase the Personal Data that we hold about you, or object to the processing of your Personal Data under certain circumstances. You have the right to move, copy or transfer your personal information (“data portability”) in a machine-readable format. For any of these, please email or write to us using the contact details within this Statement. We may request specific information from you to help us confirm your identity and your right to access, and to provide you with the Personal Data that we hold about you or make your requested changes.

7.2 You have the right to object to the processing of your personal information if it is being used because:

• we deem it necessary for our legitimate interests,
• we use it to enable us to perform a task in the public interest or exercise official authority,
• we use it to send you direct marketing materials, or
• we use it for scientific, historical, research, or statistical purposes.

7.3 If you notify us that you object, using the contact details at the end of this Statement, we will respond within thirty (30) calendar days (subject to any extensions to which we are lawfully entitled). If your objection relates to us processing your personal information because we deem it necessary for your legitimate interests, we must act on your objection by ceasing the activity in question unless:

• we think that we have a compelling legitimate ground for processing which overrides your interests; or
• we are processing your information for the establishment, exercise, or defence of a legal claim.

7.4 Applicable Law may allow or require us to refuse to provide you with access to some or all of the personal data that we hold about you, or we may have destroyed, erased, or made your personal data anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal data, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

7.5 Aurex’s Services may, from time to time, contain links to and from the websites of our partners, advertisers, and affiliates. If you follow a link to any of these websites, please note that these websites are independent data controllers and as such have their own privacy policies. We do not accept any responsibility or liability for these policies from such independent controllers. Please check their policies before you submit any personal information to these websites.

7.6 Data Protection Legislation gives you the right to review personal information that we keep about you. You can request an overview of the personal information that we keep about you free of charge by emailing or writing to us using the contact details at the end of this Notice. We may ask you to verify your identity and for more information about your request. We will seek to act on your request within thirty (30) days (subject to any extensions to which we are lawfully entitled).

7.7 You are free at any time to withdraw the consent for the processing of your personal data. To withdraw your consent, if applicable, please contact us at [email protected]. The consequence might be that we can’t proceed with certain activity.