Personal data
“Personal Data” or “Personal Information” means any information relating to an identified or identifiable natural person, which may include, but is not limited to:
- identification and contact details, such as your name, username, email address, postal address, and date of birth, used to register for or log into a xato account; and
- identity-verification data, simulated trading activity data, purchase and payout data (including your Ethereum wallet address), device and location data, and usage metadata.
How we use your personal data
The table below explains why we use your Personal Data, our legal basis, and how long we keep it. Where a retention period runs from “the end of our relationship”, this means the date on which your account is closed or, if earlier, the date two (2) years after your last activity on xato. When a retention period ends, we delete or anonymize the relevant Personal Data, unless we need to keep it for longer to comply with a legal obligation or to establish, exercise, or defend a legal claim.
Purpose of the processing
To create and administer your xato account.
Categories of Personal Data
Your name, username, email address, postal address, date of birth, and account identifiers; your device data, such as your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique device identifiers, language settings, mobile device carrier, radio/network information (e.g., WiFi, LTE, 5G), and general location information such as city, state or geographic area when you access xato.
Legal basis
Performance of contract (Art. 6(1)(b) GDPR): you enter into a contract with us when accepting our Terms of Use.
Retention period
For as long as your account is active. If you have never traded an Evaluation or Funded Account, for two (2) years after the end of our relationship; otherwise, for five (5) years after the end of our relationship (for example, to handle questions or claims), unless a longer retention period applies to specific data as set out below.
Purpose of the processing
To process your purchase of an Evaluation.
Categories of Personal Data
Your name, email address, billing country and address, order details (Evaluation size, add-ons, price, currency, VAT, and date and time), transaction ID, payment status, and limited payment card information made available to us by our payment processor (such as card type, issuing country, and the last four digits). Your full card number and security code are collected directly by our payment processor (currently Checkout.com) and are not received by xato.
Legal basis
Performance of contract (Art. 6(1)(b) GDPR); compliance with tax and bookkeeping obligations (Art. 6(1)(c) GDPR); and our legitimate interest in preventing payment fraud (Art. 6(1)(f) GDPR).
Retention period
Seven (7) years from the end of the financial year in which the transaction took place, as required by Dutch tax record-keeping obligations.
Purpose of the processing
To verify your identity, age and eligibility (including sanctions screening) before your Funded Account becomes available for trading and before each payout, and to comply with our legal obligations. Identity verification is not required to trade an Evaluation. Approved and current verification is required before funded trading and for each payout. You must re-verify two (2) years after your last approved verification, or earlier if your identification document expires. We give thirty (30) days’ notice before restricting funded trading and payouts for scheduled re-verification. We may also require further compliance review.
Categories of Personal Data
Government-issued identification documents (such as a passport, driver’s license, or national identity card), a photograph or selfie, biometric data (such as facial geometry) processed through our identity-verification provider (currently Sumsub) to confirm that you are the person shown in your identification document, your verification status and results and the date of your last verification, information obtained through sanctions and politically-exposed-person screening, and records of your acceptance of the Funded Trader Agreement (including the version accepted and the date and time of acceptance).
Legal basis
Compliance with legal obligations (Art. 6(1)(c) GDPR), including applicable sanctions laws and tax obligations; performance of our contract with you (Art. 6(1)(b) GDPR), as approved verification and acceptance of the Funded Trader Agreement are conditions for funded trading and payouts; and our legitimate interest in preventing fraud and verifying eligibility (Art. 6(1)(f) GDPR). Biometric data is processed only where necessary for authentication or security purposes (Article 29 UAVG) or, where required, on the basis of your explicit consent (Art. 9(2)(a) GDPR).
Retention period
Verification status, results and other non-biometric records needed to document our checks: for as long as your account is active and for five (5) years after the end of our relationship. Identity documents, selfies and biometric data held in your Sumsub verification profile are retained for the current verification cycle, with re-verification required two (2) years after your last approved verification or earlier if your identification document expires. Once your new verification is approved, we arrange deletion of your previous Sumsub profile, including its biometric data. We also arrange deletion of your Sumsub profile when you close your xato account. Records of acceptance of the Funded Trader Agreement: for as long as the agreement applies and seven (7) years thereafter.
Purpose of the processing
To confirm your eligibility and enforce restricted jurisdictions.
Categories of Personal Data
Country of residence stated at registration or verification, your age attestation, IP address and derived country or region, payment card issuing country, and indicators of VPN, proxy, or remote-desktop use.
Legal basis
Compliance with legal obligations (Art. 6(1)(c) GDPR), including sanctions laws, and our legitimate interest (Art. 6(1)(f) GDPR) in complying with regulatory restrictions and enforcing our Terms of Use.
Retention period
For as long as your account is active and for five (5) years after the end of our relationship.
Purpose of the processing
To provide, administer, and evaluate your Evaluations and Funded Accounts and to track and display account performance, simulated trading activity, and compliance with the Program Rules based on your use of xato.
Categories of Personal Data
Your account identification data, including account ID and evaluation ID; your simulated trading and activity data, such as the orders you place, order history, position size, leverage, long/short positions, open and close dates and times, stop-loss and take-profit levels, instrument type, trading fees and funding payments, account balance, equity, risk-limit status (including pass and breach events), and account performance; and your online activity data, such as pages or screens you viewed on xato, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access.
Legal basis
Performance of contract (Art. 6(1)(b) GDPR): you enter into a contract with us when accepting our Terms of Use and, for Funded Accounts, the Funded Trader Agreement.
Retention period
For as long as your account is active and for five (5) years after the end of our relationship, as trading data may be needed to investigate Prohibited Trading, handle claims, and support payout records.
Purpose of the processing
To enter into and administer the Funded Trader Agreement and process payouts. Balances in Evaluations and Funded Accounts are simulated; payouts are contractual performance payments.
Categories of Personal Data
Funded Trader Agreement version and acceptance records, Profit Share calculations, payout requests (amount, date and time, status, and approval records), the Ethereum wallet address you supply or save for payouts, payout transaction IDs and blockchain transaction hashes, and wallet-screening results from our payout provider (currently Fireblocks). Payouts are made in USDT (ERC-20) on the Ethereum blockchain, a public ledger on which wallet addresses and transactions are permanently visible and cannot be erased by xato or anyone else.
Legal basis
Performance of contract (Art. 6(1)(b) GDPR); compliance with tax, bookkeeping, and sanctions obligations (Art. 6(1)(c) GDPR); and our legitimate interest in preventing fraud and misdirected payments (Art. 6(1)(f) GDPR).
Retention period
Seven (7) years from the end of the financial year in which the payout was made. Saved wallet addresses that were not used for a completed payout are deleted when you remove them or close your account.
Purpose of the processing
To answer your contact request or respond to your feedback and correspondences.
Categories of Personal Data
Feedback or correspondence, such as information you provide when you contact us with questions, feedback, product reviews, or otherwise correspond with us online.
Legal basis
Our legitimate interest (Art. 6(1)(f) GDPR) to answer your correspondence.
Retention period
The time needed to answer you and no longer than 3 years after the last contact with you.
Purpose of the processing
For marketing and advertising purposes.
Categories of Personal Data
Your contact details, your preferences for receiving communications about our activities, events, and publications, and, where you have consented, details about how you engage with our communications (such as whether you opened our marketing emails or clicked links within them).
Legal basis
Your consent (Art. 6(1)(a) GDPR) or, for emails about our own similar products and services sent to existing customers, our legitimate interest (Art. 6(1)(f) GDPR) in accordance with Article 11.7 of the Dutch Telecommunications Act, in which case you can opt out in every message.
Retention period
Until you withdraw your consent or opt out, after which your Personal Data is deleted from our marketing lists. We may keep a record of your opt-out so that we do not contact you again.
Purpose of the processing
To conduct surveys.
Categories of Personal Data
Your identification and contact details and your answers to surveys.
Legal basis
Our legitimate interest (Art. 6(1)(f) GDPR) to conduct surveys to improve our services and products.
Retention period
Up to 3 years after your answer to the survey.
Purpose of the processing
Analytics and product improvement: Developing xato and new products and services, including by studying how you use the Evaluation Dashboard and our application.
Categories of Personal Data
Usage logs and interaction data from the Evaluation Dashboard and our application.
Legal basis
Our legitimate interest (Art. 6(1)(f) GDPR) to improve xato and develop new products and services. Where this involves storing or reading information on your device that is not strictly necessary, we rely on your consent (Art. 6(1)(a) GDPR).
Retention period
Up to 12 months; anonymized thereafter. Anonymous data is no longer personal data, no retention period applies.
Purpose of the processing
Analytics and advertising on our marketing website: we use Google Analytics to understand how visitors use our marketing website, and the X Pixel and the Meta Pixel to measure the effectiveness of our advertising and to show relevant advertising on those platforms. These optional technologies remain switched off until you accept them through our cookie banner, and you can change or withdraw your consent at any time through “Cookie Settings” in the website footer. We are jointly responsible with the relevant platform provider for the collection and transmission of data through the X Pixel and the Meta Pixel; the platform provider is solely responsible for its further use of that data.
Categories of Personal Data
Device and browser information, IP address (which may be shortened), cookie and pixel identifiers, pages visited, referral source, interactions with our website and advertisements, and conversion events (such as sign-ups or purchases).
Legal basis
Your consent for optional analytics and advertising technologies on our marketing website (Art. 6(1)(a) GDPR).
Retention period
Google Analytics data: fourteen (14) months. Advertising pixel data: in accordance with the retention settings and policies of the relevant platform. Cookie lifetimes are shown in our cookie banner.
Purpose of the processing
Fraud prevention, security, enforcement: For compliance, fraud prevention, and safety, including to (a) protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims); (b) enforce the Terms of Use, the Program Rules, and the Funded Trader Agreement; (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity; (d) enforce restricted-jurisdiction and eligibility requirements, including through IP geolocation, payment card country checks, and VPN or proxy detection; and (e) detect Prohibited Trading, including through cross-account analysis of trading, device, network, and timing data.
Categories of Personal Data
Device and browser data, IP address and derived location, network information (including VPN or proxy indicators), account, trading, order, and timing data, payment and payout data, wallet-screening results from our payout provider, and verification data. IP addresses may be evaluated, together with other data, in case of attacks on the network infrastructure or other unauthorized use or misuse of xato, for the purpose of intelligence and protection, and if appropriate, used in criminal proceedings for identification and civil and criminal proceedings against the relevant users.
Legal basis
Our legitimate interest (Art. 6(1)(f) GDPR) to protect xato and its users against fraud, abuse, and Prohibited Trading, and compliance with legal obligations (Art. 6(1)(c) GDPR), including applicable sanctions laws. Enforcement decisions are subject to human review.
Retention period
As long as necessary for fraud detection, investigation, and enforcement, and no longer than five (5) years after the end of our relationship, unless a longer period is needed for ongoing legal proceedings.
Purpose of the processing
To create anonymous data.
Categories of Personal Data
All of the data processed, as mentioned above.
Legal basis
Our legitimate interest (Art. 6(1)(f) GDPR) to create anonymous data sets for research and business purposes.
Retention period
Anonymous data is no longer personal data, no retention period applies.
Purpose of the processing
To process your request to exercise your rights.
Categories of Personal Data
Your identification and contact details. Where needed, we may request you to provide an ID.
Legal basis
Our legal obligation (Art. 6(1)(c) GDPR) to handle requests to exercise your rights.
Retention period
The time needed to answer you and no longer than 5 years after the last contact with you (legal prescription).
Cookies and similar technologies
We use strictly necessary cookies and similar technologies to enable the core functionality of xato, such as maintaining user sessions, security, and your preferences; these do not require your consent. On our marketing website, we also use optional analytics and advertising technologies, namely Google Analytics, the X Pixel, and the Meta Pixel, as described in the table above. These optional technologies are only placed or activated after you accept them through our cookie banner, and you can change or withdraw your consent at any time through “Cookie Settings” in the website footer, without affecting the lawfulness of processing before withdrawal. Cookies are small pieces of data, usually text files, placed on your computer, tablet, phone or similar device when you use that device to access our services. In addition to using “Cookie Settings”, you can limit the collection of your online activity and device data by:
- Blocking cookies in your browser by following the instructions in your browser settings. For more information about cookies, including how to see the cookies on your device, manage them, and delete them, visit www.allaboutcookies.org.
- Using privacy plug-ins or browsers. Certain browsers and browser extensions can be configured to block third-party cookies and trackers.
We may use plug-ins from social networks on xato and/or maintain pages on social platforms, such as X, Instagram, LinkedIn, TikTok, Reddit, Telegram (including our Telegram bot), Substack, and other third-party platforms. When you activate plug-ins by clicking on them, the operators of the respective social platforms may record that you are on xato and may use this information. Additionally, when you visit or interact with xato-related pages on those social media platforms, the relevant platform provider’s privacy policy will apply to your interactions and their collection, use and processing of your personal information. You may provide us with information through xato, and we will treat such information in accordance with this Privacy Policy. We are not responsible for data collected by these individual social media platforms, and any processing of your personal data by social media platforms is solely their responsibility and occurs according to their privacy policies. Please check with them regarding their privacy policies. Where we operate a page or channel on a social platform, we may be jointly responsible with the platform provider for certain processing of visitor data, such as page statistics.
Sharing of personal information
We share your Personal Data only as described in this Privacy Policy, where you have consented, where we are legally obligated to, or where necessary to establish, exercise, or defend legal claims. The recipients of your Personal Data are:
Service providers. We share your Personal Information with companies that provide services on our behalf or help us operate xato, currently including Checkout.com (payment processing), Sumsub (identity verification and sanctions screening), and Fireblocks (payout processing and wallet screening), as well as providers of customer support, hosting, analytics, email delivery, marketing, and database management services. Where these providers process Personal Data on our behalf, they do so under a data processing agreement; some of them, such as our payment processor, may also process your data as independent controllers to meet their own legal obligations.
Group companies. We may share your Personal Information with companies in our group, if any, where necessary to provide xato and subject to this Privacy Policy.
Professional advisors. We may disclose your Personal Information to professional advisors, such as lawyers and auditors, where necessary in the course of the professional services that they render to us.
For compliance, fraud prevention and safety. We may share your Personal Information for the compliance, fraud prevention, and safety purposes described above, including with law enforcement authorities, regulators, tax authorities, courts, and other public authorities where required by law or necessary to establish, exercise, or defend legal claims.
Payments and payouts. Evaluation purchases are processed by our payment processor (currently Checkout.com), which collects your card details directly and shares them with card issuers, card schemes, and acquirers as needed to complete the transaction; xato does not receive your full card number or security code. Payouts under the Funded Trader Agreement are contractual performance payments (balances in Evaluations and Funded Accounts are simulated) and are processed by our payout provider (currently Fireblocks) in USDT (ERC-20) on the Ethereum blockchain. We share your wallet address, payout amount, and related transaction data with that provider. Payout transactions and wallet addresses are recorded on a public blockchain, are visible to anyone, and cannot be erased by xato or anyone else. The legal basis for these disclosures is the performance of our contract with you (Art. 6(1)(b) GDPR) and compliance with our legal obligations (Art. 6(1)(c) GDPR).
Business transfers. If we are involved in a merger, acquisition, reorganization, or sale of all or part of our business, your Personal Data may be transferred to the relevant counterparty, which will be bound to process it in accordance with applicable data protection law.
Your rights and choices
Opt out of marketing communications. You may object to direct marketing at any time by following the unsubscribe instructions in each marketing email or by contacting us. You may continue to receive service-related and other non-marketing emails. You can withdraw consent to optional cookies and pixels at any time through “Cookie Settings”.
Data protection rights. Subject to the conditions and limitations set out in the GDPR and other applicable law, you have the following rights:
- To access the Personal information we hold about you (including, if applicable, to receive it in a structured and commonly used machine-readable format);
- To request we correct any inaccurate Personal Data we hold about you;
- To request we delete any Personal Information we hold about you;
- To restrict the processing of Personal Data we hold about you;
- To object to the processing of Personal Information we hold about you, in particular where we rely on our legitimate interests;
- To withdraw your consent to the processing of Personal Data we hold about you, when we have relied on consent as the legal basis to process your Personal Information, without affecting the lawfulness of processing before withdrawal; and
- To lodge a complaint with the Dutch Data Protection Authority or the supervisory authority in the country where you live or work (see the “How to contact us” section below).
Please note that, prior to any response to the exercise of such rights, we may require you to verify your identity. We will respond to your request within one (1) month of receipt, which we may extend by two (2) further months where necessary, in which case we will inform you. We may have valid legal reasons to refuse your request and will inform you if that is the case. For more information on your rights, please contact us using the details in the “How to contact us” section below.
Automated decision-making
Certain outcomes on xato occur automatically under the Program Rules, such as an account being breached and disabled when its equity reaches a loss limit, or an order being rejected because of account limits. Our systems also flag patterns that may indicate Prohibited Trading. Decisions to withhold payouts, to apply enforcement measures for Prohibited Trading, or to terminate accounts on that basis are made or reviewed by a person. Where a decision based solely on automated processing produces legal or similarly significant effects for you, you may request human intervention, express your point of view, and contest the decision.
Where we obtain your personal data and whether you must provide it
Most Personal Data is provided by you or generated through your use of xato. We also receive Personal Data from our identity-verification provider (verification results and sanctions and politically-exposed-person screening), our payment processor (payment status and limited card information), our payout provider (payout status and wallet-screening results), public sources such as sanctions lists and public blockchains, and analytics and advertising providers where you have consented. Providing your account and purchase details is necessary to purchase an Evaluation, and completing identity verification and accepting the Funded Trader Agreement are necessary to trade a Funded Account and receive payouts. If you do not provide this data, we cannot provide those services to you.
International data transfers
We use service providers that may process your Personal Data outside the European Economic Area (“EEA”), including in the United States. Where we transfer Personal Data outside the EEA, we ensure that the transfer is based on an adequacy decision of the European Commission (including, for certified recipients in the United States, the EU-U.S. Data Privacy Framework) or on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, supplemented where necessary by additional measures, or, exceptionally, on a derogation under Article 49 GDPR. Where UK or Swiss data protection law applies, we rely on the equivalent UK or Swiss transfer mechanisms. Payout transactions are recorded on a globally distributed public blockchain. You can request information about, or a copy of, the relevant safeguards by contacting us as set out in the “How to contact us” section below.
The California Consumer Privacy Act or “CCPA” (Cal. Civ. Code § 1798.100 et seq.) affords consumers residing in California certain rights with respect to their personal information. If you are a California resident and the CCPA applies to xato, this section applies to you.
Notice to California residents
California Civil Code Section 1798.83 permits individual California residents to request certain information regarding our disclosure of certain categories of personal information to third parties for those third parties’ direct marketing purposes. To make such a request, please contact us using the information in the “How to Contact Us” section below. This request may be made no more than once per calendar year.
If you are a California resident, you have certain additional rights with respect to your personal information pursuant to the CCPA.
We are required to inform you of:
- What categories of information we may collect about you, including during the preceding 12 months: See the “Personal Data” section and the “Categories of Personal Data” column of the table above.
- The purposes for which we may use your personal information, including during the preceding 12 months: See the “Purpose of the processing” column of the table above.
- The purposes for which we may share your personal information, including during the preceding 12 months: See the section above “Sharing of Personal Information”. In addition, we may share the following categories of information with the following parties:
- Identity information: service providers such as identity-verification providers.
- Online identifiers and usage data: analytics and advertising providers (such as Google, Meta, and X), where you have consented to optional cookies and pixels.
- Financial information: payment and payout service providers (such as Checkout.com and Fireblocks).
- In the preceding 12 months, we have not sold personal information of consumers. Our use of advertising pixels on our marketing website may constitute “sharing” of personal information for cross-context behavioral advertising under the CCPA; you can opt out of such sharing by declining or withdrawing consent through “Cookie Settings”.
You have the right to request to know: (i) the categories of personal information we have collected about you in the last 12 months; (ii) the specific pieces of personal information we have about you; (iii) the categories of sources from which that personal information was collected; (iv) the categories of your personal information that we sold or disclosed in the last 12 months; (v) the categories of third parties to whom your personal information was sold or disclosed in the last 12 months; and (vi) the purpose for collecting and selling your personal information. These rights are subject to limitations as described in the CCPA. We may deny your request if we need to do so to comply with our legal rights or obligations.
We will not discriminate against any consumer for exercising their CCPA rights.
You may exercise these rights yourself or you may designate an authorized agent to make these requests on your behalf. To protect your information, we may need to verify your identity before processing your request, including by collecting additional information to verify your identity, such as government issued identification documents. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify you are the individual about whom we collected personal information. We will only use the personal information provided in the verification process to verify your identity or authority to make a request and to track and document request responses, unless you initially provided the information for another purpose. When we verify your agent’s request, we may verify your identity and request a signed document from your agent that authorizes your agent to make the request on your behalf. To protect your personal information, we reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on their behalf.
If you would like to exercise any of these rights, please contact us at the email in the “How to Contact Us” section below.
Other sites, applications and services
xato may contain links to other websites, mobile applications, and other online services (collectively, “Third Party Resources”) operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included in Third Party Resources that are not associated with us. We do not control Third Party Resources, and we are not responsible for their actions. Other websites and services follow different rules regarding the collection, use and sharing of your Personal Information. We encourage you to read the privacy policies of the Third-Party Resources you use.
Security practices
We implement appropriate technical and organizational measures to protect your Personal Data against manipulation, partial or complete loss, and unauthorized access, in accordance with Article 32 GDPR. No method of transmission over the internet is completely secure. Where required by law, we will notify you and the competent supervisory authority of a personal data breach.
Children
xato is not intended for, and may not be used by, anyone under 18 years of age. If we learn that we have collected Personal Information from a person under 18, we will close the relevant account and delete that Personal Information, except where we are required by law to retain it.
Changes to this privacy policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you in advance by email (if you have an account where we have your contact information) and by a prominent notice on xato, and we will update the “Last Updated” date. Where a change requires your consent under applicable law, we will ask for it.
Changes take effect on the date stated in the notice. We will not use your Personal Data for a new purpose that is incompatible with the purposes described in this Privacy Policy without informing you in advance and, where required, obtaining your consent.
How to contact us
If you have a concern about our privacy practices, including the way we handle your Personal Information, or wish to exercise your rights, please contact us at: admin@xato.com or by post at Xato B.V., Pedro de Medinalaan 83, 1086 XP Amsterdam, the Netherlands. We will respond without undue delay and in any event within one (1) month.
You can also report it to your local data protection authority that is authorized to hear those concerns. Contact details for certain data protection authorities can be found using the links below:
- For individuals in the EEA: https://edpb.europa.eu/about-edpb/board/members_en
- For individuals in the Netherlands: https://autoriteitpersoonsgegevens.nl/en
- For individuals in the UK: https://ico.org.uk/global/contact-us/
- For individuals in Switzerland: https://www.edoeb.admin.ch/en/contact-2
- For individuals in California: https://cppa.ca.gov/about_us/contact.html