True North Tech L.L.C-FZ is the operator of the CMC Markets Funded website and simulated evaluation business. According to the current corporate documents, the company is a Meydan Free Zone limited liability company with Formation Number 2646504, business licence number 2646504.01, registered address at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E., issued on 9 March 2026 and expiring on 8 March 2027 unless renewed.

For the purposes of this Policy, references to “we”, “us” and “our” mean True North Tech L.L.C-FZ, except where this Policy states that another party, such as a relevant CMC Markets entity, acts independently under its own documents.

This Policy applies to personal data we process when you:

• visit the Website or use the Client Area;
• create an account, place an order or purchase a challenge;
• use the Evaluation Program, Reward Stage or related tools;
• communicate with us through support, chat, email, forms or social channels;
• complete verification, sanctions, anti-fraud or payout checks;
• request a Reward or refund; or
• ask to be referred to a CMC Markets entity or otherwise interact with an optional referral path.

This Policy does not govern third-party websites or apps after you leave our Website, including any separate website or onboarding flow operated by a relevant CMC Markets entity, payment processor, trading platform provider or other third party.

Depending on the service you use, we may collect and process the following categories of information:

• Identity and account data: name, date of birth, username, login credentials, account ID, nationality, business details, legal-entity details and records of consent or acceptance.
• Contact data: email address, telephone number, country, language and communication preferences.
• Corporate and verification data: company registration details, beneficial-owner information, authorised-user details, identification documents, proof of address, liveness checks, tax or residency documentation and source-of-funds or source-of-wealth information where required.
• Payment and payout data: card or processor metadata, transaction references, billing details, wallet addresses, bank account details, payout method information and fraud-screening results.
• Device, technical and usage data: IP address, browser type, device identifiers, operating system, cookies, session data, geolocation signals, access logs, page activity and diagnostic data.
• Simulated trading and program data: account configuration, trading performance, symbols traded, orders, trades, drawdown metrics, risk flags, consistency checks, payout history, program status and review outcomes.
• Support and communications data: messages, tickets, complaint history, call records where used, chatbot interactions, survey answers and internal notes created while handling requests.
• Compliance and risk data: sanctions screening results, politically exposed person indicators, wallet screening, chargeback history, device-linking indicators, network analysis and anti-abuse markers.

We may use personal data to:

• create and manage your account and provide the Services you requested;
• process purchases, payments, refunds, credits and Reward requests;
• provision, operate and secure the Website, Client Area and trading platform access;
• apply program rules, detect prohibited trading practices and prevent abuse;
• conduct sanctions, anti-money laundering, anti-fraud, KYC and KYB checks;
• communicate with you about your account, orders, support requests, legal notices and platform events;
• personalise parts of the user experience and improve navigation, onboarding and customer support;
• monitor service performance, investigate incidents and manage complaints or disputes;
• carry out analytics, reporting, forecasting, internal research and business intelligence;
• evaluate simulated trading data for service improvement, internal risk management and internal discretionary strategy analysis;
• comply with legal, regulatory, tax, accounting, sanctions, fraud-reporting and record-keeping obligations; and
• where lawful and appropriate, manage an optional referral or hand-off to a relevant CMC Markets entity.

Where a privacy law requires us to identify a legal basis for processing, we may rely on one or more of the following, depending on the context:

• performance of a contract or steps taken at your request before entering into a contract;
• compliance with a legal obligation, including sanctions, fraud prevention, tax, accounting and law-enforcement obligations;
• our legitimate interests, including fraud prevention, service security, analytics, dispute handling, product improvement, internal risk management and business administration, where those interests are not overridden by your rights;
• consent, where consent is required or where we choose to rely on it, including for optional referrals, certain marketing or non-essential cookies; and
• establishing, exercising or defending legal claims.

Where consent is the basis used, you may withdraw it at any time, but that will not affect processing already carried out before withdrawal became effective.

Because CMC Markets Funded is a simulated-only evaluation business, a large part of the information we process relates to simulated trading, behavioural patterns, device use, challenge progress, payout eligibility and platform integrity.

We may analyse this information manually, automatically or with AI-assisted tools to identify abuse, monitor risk, apply rules, assess eligibility for Rewards, improve the user experience, and determine whether simulated behaviour appears genuine, coordinated, abusive or otherwise inconsistent with the purpose of the Services.

Where legally permitted, we may also aggregate or anonymise such data and use it for statistics, product development, forecasting, reporting, service optimisation, fraud prevention, internal risk models, internal discretionary trading analysis or similar business purposes. Aggregated or anonymised data may continue to be used after termination of your account.

Nothing in this Policy gives you ownership of our analytics models, internal scoring logic or internal discretionary decisions about whether or how any simulated trading data is used inside our business.

We may share personal data with the following categories of recipients where reasonably necessary and lawful:

• trading platform providers, CRM providers, hosting providers, software vendors and infrastructure providers;
• payment processors, banks, electronic money institutions, wallet providers and payout partners;
• KYC, KYB, fraud-screening, sanctions-screening, geolocation, wallet-screening and device-intelligence providers;
• customer support providers, communication tools, AI-assisted workflow providers, translation providers and ticketing systems;
• analytics, consent-management, security, logging and monitoring providers;
• professional advisers such as lawyers, accountants, auditors and insurers;
• regulators, tax authorities, law-enforcement agencies, courts and competent authorities where required or appropriate;
• acquirers, investors, successors or other counterparties in connection with a business reorganisation, financing or sale, subject to confidentiality and lawful processing requirements; and
• a relevant CMC Markets entity, but only in the limited circumstances described in Clause 8 below.

We do not sell personal data in the ordinary sense of selling customer lists for general third-party marketing.

CMC Markets Funded is contractually and operationally separate from CMC Markets plc, CMC Markets UK plc and other CMC Markets group entities. Those entities do not become operators of our simulated prop service simply because they may provide support to us or because the CMC Markets name is used under separate permission arrangements.

Where an optional referral path is made available, you may choose to ask us to refer you to the relevant CMC Markets entity for its regulated services. That hand-off is optional, jurisdiction dependent and subject to your explicit consent, your eligibility and the acceptance criteria of the relevant CMC Markets entity.

If you opt into that path, we may share the minimum information reasonably required to facilitate the referral, such as your contact details, jurisdiction, referral identifier, opt-in record and other information necessary for onboarding, suitability, appropriateness or compliance handling by that entity.

Where permitted by law and by separate commercial arrangements, we may receive fixed-fee referral payments, variable remuneration, commissions, revenue share or other compensation linked to qualifying client activity. The existence of such compensation does not make the relevant CMC Markets entity jointly liable for our Services, payouts, refunds or customer support obligations.

Once you engage directly with a relevant CMC Markets entity, that entity's own legal and privacy documents govern its processing of your information for its regulated services.

Because we operate digitally and may use international processors and platforms, your personal data may be processed in the United Arab Emirates and in other countries where our providers, infrastructure, support teams or relevant counterparties operate. Those countries may include, depending on the workflow, the United Kingdom, EEA states, Canada, Australia, Singapore and other locations used by our service providers.

Where applicable law requires transfer safeguards, we will use safeguards that are appropriate in the circumstances, which may include contractual protections, vendor due diligence, access controls, minimisation, encryption and transfer-risk assessments.

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including for contract performance, fraud prevention, sanctions compliance, dispute resolution, tax and accounting rules, record-keeping, evidence preservation and legal claims.

Retention periods may vary depending on the data type. For example, account records, transaction records, support records, compliance logs and payout records may be kept longer than routine website analytics data. Where data is aggregated or anonymised so it no longer identifies you, we may retain and use it for longer periods.

We use a combination of technical, organisational and contractual measures designed to protect personal data against unauthorised access, misuse, loss, alteration or disclosure. These may include role-based access controls, logging, encryption where appropriate, vendor due diligence, security monitoring, restricted access to compliance materials and incident-response processes.

No system can be guaranteed to be completely secure. You are also responsible for keeping your account credentials, device access and email account secure.

We use cookies and similar technologies for security, session continuity, functionality, analytics and, where permitted, marketing or attribution. For detailed information, please read our Cookie Policy.

Depending on your location and the law that applies to you, you may have rights to request access to, correction of, deletion of, restriction of, objection to or portability of your personal data, and you may have the right to withdraw consent where consent is relied upon.

We may need to verify your identity before responding. We may also limit or decline a request where an exemption applies, where the request would adversely affect the rights of others, where we must keep certain records for legal reasons or where the data is no longer capable of being linked to you.

We may send service messages that are necessary for the operation of your account, purchases, support tickets, security events, legal notices, program updates or payout processing.

Where marketing consent is required, we will rely on consent or another lawful basis that is available under applicable law. You can usually opt out of non-essential marketing communications by using the unsubscribe function in the message or by contacting us through the channels published on the Website.

Our Services are not intended for children. You may not use the Services unless you meet the minimum age and eligibility requirements stated in our Terms and Conditions.

We may update this Privacy Policy from time to time to reflect changes in law, regulation, service design, fraud patterns, technology, business structure, vendor arrangements or operational practices. When we do, we will update the “Last updated” date at the top of this page and may provide additional notice where appropriate.

If you have questions about this Privacy Policy or would like to exercise a relevant privacy right, please contact us using the details published on the Website or in the Client Area. To help us process requests efficiently, include your full name, registered email and the nature of your request.

If your request relates to an optional CMC Markets referral after you have already engaged directly with the relevant CMC Markets entity, that entity may need to handle part of your request under its own legal documents.