Privacy Policy

Last updated: July 27, 2026

This Privacy Policy describes how Trading Zones (the "Operator") collects, processes, stores and protects the personal data of Users of the Trading Zones Pro and Trading Zones Markets applications (the "Platform"). This Policy complies with the General Data Protection Regulation (GDPR, Articles 13–14).

1. Data controller

The controller of personal data is:

LUCRUM MEDIA COMPANY SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. Boryńska 8B
44-240 Żory, Poland

NIP: 6511751012
REGON: 542122284
KRS: 0001181306

For matters concerning the protection of personal data, Users may contact the Operator through the contact channels available on the Platform.

2. What data we collect

The Operator processes the following categories of Users' personal data:

2.1. Data provided during registration

Email address.
Username / display name.
Password (stored in hashed form, not in plaintext).
Company details (for B2B accounts): company name, NIP, address.

2.2. Data collected automatically

IP address and browser data (User-Agent).
Session and activity data on the Platform.
Cookies and similar technologies (details in section 8).
Device data: device type, operating system, screen resolution.

2.3. Transaction data

Subscription and payment history.
Selected plan and billing period.
Payment method (processed by third-party payment providers - the Operator does not store payment card numbers).

2.4. Analytics activity data

Instruments and markets followed by the User.
Alert and notification settings.
Platform interface settings.

3. Purposes of data processing

Users' personal data is processed for the following purposes:

Providing the Services: account registration, providing analytics features, generating reports.
Billing: managing subscriptions, payments and invoices.
Communications: market notifications, alerts and information about changes to the Platform.
Security: preventing abuse and detecting unauthorized access.
Improving the Services: analyzing how the Platform is used to develop it.
Legal compliance: fulfilling legal obligations, including tax and accounting obligations.

4. Legal bases for processing

Personal data is processed on the basis of:

Article 6(1)(b) GDPR - necessity for the performance of a contract (providing the Services).
Article 6(1)(c) GDPR - legal obligation (invoicing, tax laws).
Article 6(1)(f) GDPR - the Operator's legitimate interests (security, Platform development, preventing abuse).
Article 6(1)(a) GDPR - the User's consent (newsletter, marketing notifications - where consent has been given).

5. Recipients of data

Users' personal data may be shared with the following categories of recipients:

Outseta LLC - a subprocessor processing Users' account, subscription, payment and marketing communications data on behalf of the Operator (under Article 28 GDPR). Data may be stored on servers in the United States subject to Standard Contractual Clauses. Outseta's privacy policy: outseta.com/privacy-policy.
Payment service providers (payment processors).
Cloud service providers (hosting, databases).
Market data providers (for technical purposes, without identifying data).
Analytics tool providers (in aggregated form).
Government authorities (where legally required).

The Operator does not sell Users' personal data to third parties.

6. Data retention periods

Users' personal data is retained for as long as necessary to fulfil the purposes for which it was collected:

Account data: until the User deletes the account or the contract is terminated.
Transaction data and invoices: for the period required by tax and accounting laws (up to 5 years).
System logs and security data: for 12 months.
Marketing data: until consent is withdrawn.

7. Users' rights

Under the GDPR, Users have the following rights: access to their data, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

Users have the right to:

Access to data - obtain information about what data is being processed.
Rectification - correct inaccurate or incomplete data.
Erasure ("right to be forgotten") - request the erasure of data, unless processing is required by law.
Restriction of processing - request the restriction of processing in certain circumstances.
Data portability - receive data in a structured, commonly used format.
Objection - object to processing based on legitimate interests.
Withdrawal of consent - withdraw consent at any time where processing is based on consent.

Users also have the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (UODO).

8. Cookies and tracking technologies

The Platform uses cookies and similar technologies for the following purposes:

Cookie type	Purpose	Retention period
Essential	Login, user session, security	Session / up to 30 days
Functional	Interface settings, preferences	Up to 12 months
Analytics	Visit statistics, behavior analysis	Up to 12 months
Marketing	Content personalization, advertising (only with consent)	Up to 6 months

Users can manage cookies in their browser settings. Disabling essential cookies may prevent them from using some Platform features.

9. Data security

The Operator applies appropriate technical and organizational measures to protect personal data, including:

Encryption of data in transit (HTTPS/TLS).
Password hashing (bcrypt or equivalent).
Data access controls (permissions, authorization).
Regular backups and system monitoring.
Security audits and penetration testing.

Despite these safeguards, the Operator cannot guarantee complete security. In the event of a personal data breach, the Operator will notify Users and the supervisory authority in accordance with the GDPR.

10. Transfers of data outside the EEA

Users' personal data may be processed by service providers located outside the European Economic Area (EEA). In particular, account, subscription and payment data is processed by the Outseta system (Outseta LLC), whose servers may be located in the United States. In such cases, the Operator provides appropriate safeguards, including Standard Contractual Clauses approved by the European Commission or other legal instruments that guarantee a level of data protection consistent with the GDPR.

11. Profiling and automated decision-making

The Operator does not use automated decision-making that produces legal effects concerning Users or similarly significantly affects them. Analytics data may be used to improve Platform features, but is not used for investment profiling or credit risk assessment.

12. Children's data

The Platform is not intended for persons under the age of 18. The Operator does not knowingly collect children's personal data. If it is found that a child's data has been collected, the Operator will promptly delete it.

13. Changes to the Privacy Policy

The Operator reserves the right to update this Privacy Policy. Users will be informed of material changes through the Platform or by email. The date of the last update appears at the beginning of this document.

14. Contact

For matters concerning the protection of personal data, Users may contact the Operator through:

LUCRUM MEDIA COMPANY SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. Boryńska 8B
44-240 Żory, Poland

NIP: 6511751012
REGON: 542122284
KRS: 0001181306

The contact form available on the Platform.
The email address available on the Platform website.
The FAQ section on the Platform.