1. Who manages your personal information and who should you contact?

The entity managing your personal information is BrightFunded LLC, a Wyoming limited liability company operating under the brand name BrightFunded Futures (also referred to as "BrightFunded Futures", "we", "us", "our Company" or "Data Controller" in this document).

For any questions, or to exercise your rights related to the processing of your personal data, you can contact BrightFunded Futures by email at [email protected] or by post at the mailing address published on the Website.

2. What personal data do we gather about you and how do we obtain it?

This section gives an overview of the personal data we collect and how we collect it. The purposes of processing are explained in Section 3. Any data that allows us to identify you, directly or indirectly, or that relates to you, is personal data.

Data you provide to us. We collect data you provide when you register on the Website, use your Client Section, order Services, take part in our activities or programs, or contact customer support or our community and social media channels. This includes:

• Identification and contact data: first and last name, phone number, email address, physical address, date of birth, nationality, country of residence, username and password, and, if you act for a business, its business ID or tax registration number.

• Identity verification data: copies of your identity document and proof of address, and a photo or video of your face used for liveness and document matching checks.

• Payment data: billing details and information about the payment method you use. Card details are processed by our payment providers and are not stored in full by us.

• Reward and tax data: the bank or payout account details you give us to receive Rewards, and the tax forms and taxpayer identification numbers required to pay them.

• Communications: your messages, chats, emails and support history with us, recordings of calls or video calls where you are informed of the recording, complaints, survey responses and User Content you post.

  
  

Data we collect automatically. When you use the Services we collect device data (IP address, device type and identifiers, browser fingerprint, operating system, browser and internet service provider), approximate location derived from your IP address, Website usage data (date, time and duration of your visit, pages viewed, country of access) and Service usage data (login and logout times, account settings, Products purchased, simulated account size and trading strategy).

Data we receive from third parties. We receive some of your data from:

• Trading Platform and market data providers: data about your simulated transactions, such as the instrument and contract traded, order times, position size and simulated profit and loss.

• Identity verification and fraud prevention providers: the result of your identity verification and of sanctions and watch list screening.

• Payment and payout providers: the status of your payments and Reward payouts, and any chargebacks or payment disputes.

• Our affiliated companies: where you have already completed identity verification with one of our affiliated companies, the result of that verification.

• Social network operators: if you choose to connect a social media account with your account on our Website, your username, profile picture and the email address linked to that social network account.

To learn how these third parties process your personal data for their own purposes, please read their privacy policies.

Identity verification and biometric data. Identity verification is carried out for us by a third party provider, currently Sumsub. During verification, Sumsub may compare a photo or video of your face (a selfie and liveness check) with your identity document using facial recognition technology. This is done on our behalf, only to verify your identity and prevent fraud, and only with the consent you give at the verification step. We do not use this data for any other purpose, and neither we nor our provider sell it or profit from it. It is kept only as long as needed for verification and to meet legal obligations, and in any case is destroyed no later than three years after your last interaction with us, unless a longer period is required by law. Sumsub also processes your data under its own privacy notice, available on its website.

3. How do we use your personal data?

Account creation and registration

To create your account and give you access to the Client Section, we need to process your personal data.

• Personal data: identification and contact data, and data from social networks if you link them to your account.

• Processing ground: performance of the contract between you and BrightFunded Futures, or our legitimate interest.

Delivering the Services and fulfilling our contract with you

To provide the Services, including access to BrightFunded Accounts, tools and support, and to monitor simulated trading for compliance with the Product Specifications and our rules, we need to process your personal data. Some of these checks are automated and may result in a rule breach being recorded on your account. You may contact us to request a human review of any such decision.

• Personal data: identification and contact data, payment data, Service usage data, simulated trading data and data from social networks if you link them to your account.

• Processing ground: performance of the contract, or our legitimate interest. After we stop providing the Services, we keep processing personal data for a limited period to exercise and protect our rights, based on our legitimate interest.

Identity verification, compliance and fraud prevention

To verify your identity, apply our restricted jurisdictions rules, screen against sanctions lists, detect multiple accounts, VPN use and payment fraud, and prevent chargeback abuse, we need to process your personal data.

• Personal data: identification and contact data, identity verification data (including biometric data, with your consent), device and location data, payment data and simulated trading data.

• Processing ground: compliance with our legal obligations, our legitimate interest in preventing fraud and abuse, and, for biometric data, your consent.

Payments, Rewards and tax

To process your payments, pay Rewards and meet our tax reporting obligations, we need to process your personal data.

• Personal data: identification and contact data, payment data, and Reward and tax data.

• Processing ground: performance of the contract and compliance with our legal obligations.

Marketing communication about our products, services and events

If you are a current or former customer, we may occasionally send you marketing communications about our Services. We may also send you commercial messages based on your consent. Each email is identified as a business communication and contains an easy option to unsubscribe. As described in our Terms and Conditions, we may also publish your first name only, together with your country, simulated trading statistics and Rewards.

• Personal data: identification and contact data, Website usage data, simulated trading data and Reward data.

• Processing ground: our legitimate interest in maintaining customer relationships and promoting the Services, or your consent.

Customer support and communication

If you use our customer support, we process your personal data to help you and to improve the quality of our support.

• Personal data: identification and contact data, communications, and data from social networks if you contact us through them.

• Processing ground: our legitimate interest in ensuring customer satisfaction and supporting you in the use of the Services.

Legal compliance and protection of our rights

We process personal data to comply with laws, court orders and requests from public authorities, and to establish, exercise or defend legal claims.

• Personal data: any of the data described in this Policy, as relevant.

• Processing ground: compliance with our legal obligations and our legitimate interest.

4. How do we safeguard and store your personal data?

Your data may be stored on servers provided by third party hosting and cloud service providers with whom we have agreements. We use reasonable technical and organizational measures to protect your personal data against loss, misuse and unauthorized access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security incident affects your personal data, we will notify you where required by law.

5. How long do we keep your personal data?

We process your personal data to the extent and for the period needed to achieve the purposes described in this Policy, or as required by law. This includes the period of our relationship with you and, after it ends, the period needed to meet our legal, tax, accounting and anti money laundering obligations and to establish, exercise or defend legal claims. After that, the personal data is deleted or anonymized. Biometric data is kept only for the period described in Section 2.

6. Sharing and transferring data to third parties

We share or transfer your data to entities that help us provide the Services, including:

• The providers of the Trading Platforms and market data that allow you to carry out simulated trades.

• Our affiliated companies (any company that controls, is controlled by or is under common control with BrightFunded LLC, including its parent companies, subsidiaries and sister companies), which provide operational, technical, customer support, compliance and identity verification services on our behalf.

• Other third parties that help us run the Website and deliver the Services, such as hosting and cloud providers, our identity verification provider (currently Sumsub), fraud prevention providers, financial institutions, payment processors and payment agents, payout providers, customer support and communication tools, IT companies and system administrators, marketing, analytics and advertising partners, consultants, auditors and postal service providers.

Your simulated trade data may also be used by us and shared with our affiliates and partners for the purposes described in Clause 6.2 of our Terms and Conditions, including the replication of simulated trades in real markets. When we share it with partners other than our affiliates, we do so in a form that does not identify you.

We may also disclose your data: to entities you have consented to; to exchanges, regulators, law enforcement, courts and other public authorities where required by law, court order or another legally enforceable decision; to other industry participants and fraud prevention databases to detect and prevent fraud, as allowed by law; and to a buyer or successor in connection with a merger, acquisition or sale of assets.

Every entity to which we transfer personal data is contractually obliged to protect it in accordance with the law and to process it only as we instruct, unless it acts as an independent controller under its own privacy policy. We do not sell your personal data.

7. International transfers

BrightFunded Futures is based in the United States. Your personal data may be transferred to, stored in and processed in the United States and in other countries where our affiliated companies and service providers operate. These countries may have data protection laws different from those in your country. Where required by law, we use appropriate safeguards for these transfers, such as standard contractual clauses approved by the European Commission or the United Kingdom.

8. Your rights

As a user of the Services, you have a set of rights in relation to your personal data, depending on the law that applies to you:

Right to access. You have the right to request access to the personal data we hold about you. We will provide this information in a structured and easily accessible format.

Right to rectification. If you believe the personal data we hold is inaccurate or incomplete, you have the right to ask us to correct or complete it.

Right to erasure ("right to be forgotten"). You can ask us to delete your personal data, except where we need to keep it to comply with a legal obligation or for other legitimate purposes allowed by law.

Right to restrict processing. You may ask us to limit the way we use your personal data if you believe the data is inaccurate, our use of it is unlawful, or you have objected to our use of it.

Right to data portability. You have the right to receive a copy of your personal data in a format that allows its easy transfer to another controller.

Right to object. You have the right to object to the processing of your personal data for marketing purposes or in certain other circumstances.

Right to withdraw consent. Where we rely on your consent, you may withdraw it at any time. This does not affect processing carried out before the withdrawal.

Right to lodge a complaint. You have the right to lodge a complaint about our processing with the competent data protection authority.

Additional rights for residents of certain U.S. states. Depending on your state of residence (for example California, Colorado, Connecticut, Texas or Virginia), you may also have the right to know what personal data we collect, use and disclose; to access, correct or delete it; to opt out of the sale of your personal data, of targeted advertising and of certain profiling; and to limit the use of sensitive personal data. We do not sell personal data, and we use sensitive personal data (such as identity document numbers and biometric data) only to verify your identity, comply with the law and prevent fraud, never for advertising. Some cookies used for advertising on the Website may be considered "sharing" or "targeted advertising" under some state laws. You can opt out through the cookie settings on the Website or by contacting us. Where required by law, we treat a Global Privacy Control signal from your browser as a valid opt out request. We do not respond to "Do Not Track" signals. We will not discriminate against you for exercising any of these rights.

How to exercise your rights. Send your request to [email protected]. We will verify your identity before acting on your request and will respond within the time required by applicable law. You may use an authorized agent where the law allows it, and we may ask for proof of that authorization. If we decline your request, you may appeal our decision by replying to our response, and we will inform you of the result of your appeal.

9. Cookies and similar technologies (Cookie Policy)

This section is our Cookie Policy. We and our partners use cookies, pixels and similar technologies on the Website to:

• make the Website work and keep it secure, including to detect fraud and multiple accounts (strictly necessary cookies, which cannot be switched off);

• remember your preferences and settings;

• understand how visitors use the Website and improve it (analytics cookies);

• track referrals from our affiliates and partners; and

• measure our marketing and show you relevant advertising on other websites (advertising cookies).

Except for strictly necessary cookies, we use cookies according to the choices you make in the cookie settings on the Website, where the law requires your consent. You can change your choices at any time in the cookie settings or in your browser. Blocking some cookies may affect how the Website works.

10. Text messages

If you give us your phone number and agree to receive text messages, we may send you service and marketing messages by SMS or messaging apps. Your consent is not a condition of any purchase. Message and data rates may apply. You can stop receiving marketing messages at any time by replying STOP or by contacting us.

11. Children

The Services are not intended for anyone under 18 years of age, and we do not knowingly collect personal data from them. If we learn that we have collected personal data from a person under 18, we will delete it.

12. Third party websites and platforms

The Website and the Services may contain links to, or work together with, third party websites and platforms, including Trading Platforms. Their own privacy policies apply to the data they collect, and we are not responsible for their practices.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the email address you have provided or by placing a prominent notice on the Website.

14. Contact

For any question about this Privacy Policy or our processing of your personal data, contact BrightFunded Futures at [email protected].