Privacy Policy

1. Who we are

For the purposes of this Policy, references to “we”, “us” and “our” mean True North Tech L.L.C-FZ, trading as CMC Markets Funded, except where this Policy states that another party, including a separate regulated CMC Markets entity, acts independently under its own documents.

True North Tech L.L.C-FZ is the controller of your personal data.

2. Scope of this Policy

This Policy applies to personal data we process when you:

• visit the Website or use the Client Area;
• create an account, place an order or purchase a challenge;
• use the Evaluation Program, Reward Stage or related tools;
• communicate with us through support, chat, email, forms or social channels;
• complete verification, sanctions, anti-fraud or payout checks;
• request a Reward or refund; or
• ask to be referred to a CMC Markets entity or otherwise interact with an optional referral path.

This Policy does not govern third-party websites or apps after you leave our Website, including any separate website or onboarding flow operated by a relevant CMC Markets entity, payment processor, trading platform provider or other third party.

3. Categories of personal data we collect

Depending on the service you use, we may collect and process the following categories of information:

• Identity and account data: name, date of birth, username, login credentials, account ID, nationality, business details, legal-entity details and records of consent or acceptance.
• Contact data: email address, telephone number, country, language and communication preferences.
• Corporate and verification data: company registration details, beneficial-owner information, authorised-user details, identification documents, proof of address, liveness checks, tax or residency documentation and source-of-funds or source-of-wealth information where required.
• Payment data: card or payment processor details, transaction references, billing details and fraud-screening results, and, if you request a Reward, the payment details you give us to receive it.
• Device, technical and usage data: IP address, browser type, device identifiers, operating system, cookies, session data, geolocation signals, access logs, page activity and diagnostic data.
• Simulated trading and program data: account configuration, trading performance, symbols traded, orders, trades, drawdown metrics, risk flags, rule checks, payout history, program status and review outcomes.
• Support and communications data: messages, tickets, complaint history, call records where used, chatbot interactions, survey answers and internal notes created while handling requests.
• Compliance and risk data: sanctions screening results, politically exposed person indicators, wallet screening, chargeback history, device-linking indicators, network analysis and anti-abuse markers.

4. How we use personal data

We may use personal data to:

• create and manage your account and provide the Services you requested;
• process purchases, payments, refunds, credits and Reward requests;
• provision, operate and secure the Website, Client Area and trading platform access;
• apply program rules, detect prohibited trading practices and prevent abuse;
• conduct sanctions, anti-money laundering, anti-fraud, KYC and KYB checks;
• communicate with you about your account, orders, support requests, legal notices and platform events;
• personalise parts of the user experience and improve navigation, onboarding and customer support;
• monitor service performance, investigate incidents and manage complaints or disputes;
• carry out analytics, reporting, forecasting, internal research and business intelligence;
• measure and improve our advertising, using advertising cookies only where you have accepted them;
• send you emails about our challenges and offers, including a reminder if you start a purchase and do not finish it, unless you have told us not to;
• evaluate simulated trading data for service improvement, internal risk management and internal discretionary strategy analysis;
• comply with legal, regulatory, tax, accounting, sanctions, fraud-reporting and record-keeping obligations; and
• where lawful and appropriate, manage an optional referral or hand-off to a relevant CMC Markets entity.

5. Legal bases where applicable

Where a privacy law requires us to identify a legal basis for processing, we may rely on one or more of the following, depending on the context:

• performance of a contract or steps taken at your request before entering into a contract;
• compliance with a legal obligation, including sanctions, fraud prevention, tax, accounting and law-enforcement obligations;
• our legitimate interests, including fraud prevention, service security, analytics, dispute handling, product improvement, internal risk management and business administration, where those interests are not overridden by your rights;
• consent, where consent is required or where we choose to rely on it, including for optional referrals, certain marketing or non-essential cookies; and
• establishing, exercising or defending legal claims.

Where consent is the basis used, you may withdraw it at any time, but that will not affect processing already carried out before withdrawal became effective.

6. Simulated trading, behavioural and platform data

Because CMC Markets Funded is a simulated-only evaluation business, a large part of the information we process relates to simulated trading, behavioural patterns, device use, challenge progress, payout eligibility and platform integrity.

We may analyse this information manually, automatically or with AI-assisted tools to identify abuse, monitor risk, apply rules, assess eligibility for Rewards, improve the user experience, and determine whether simulated behaviour appears genuine, coordinated, abusive or otherwise inconsistent with the purpose of the Services.

Where legally permitted, we may also aggregate or anonymise such data and use it for statistics, product development, forecasting, reporting, service optimisation, fraud prevention, internal risk models, internal discretionary trading analysis or similar business purposes. Aggregated or anonymised data may continue to be used after termination of your account.

Nothing in this Policy gives you ownership of our analytics models, internal scoring logic or internal discretionary decisions about whether or how any simulated trading data is used inside our business.

7. How we share personal data

We may share personal data with the following categories of recipients where reasonably necessary and lawful:

• trading platform providers, CRM providers, hosting providers, software vendors and infrastructure providers;
• payment processors, banks and other payment providers;
• KYC, KYB, fraud-screening, sanctions-screening, geolocation, wallet-screening and device-intelligence providers;
• customer support providers, communication tools, AI-assisted workflow providers, translation providers and ticketing systems;
• analytics, consent-management, security, logging and monitoring providers;
• advertising and social media platforms, currently Meta and TikTok, which receive information about your visit and, if you accept their cookies in our banner, about sign-ups, checkouts and purchases, including details you type into forms in a hashed (scrambled) form, so that we can measure our advertising;
• affiliate networks, currently impact.com, which receive the order reference, the items bought, their value and the partner’s click identifier when a partner referred you;
• professional advisers such as lawyers, accountants, auditors and insurers;
• regulators, tax authorities, law-enforcement agencies, courts and competent authorities where required or appropriate; and
• acquirers, investors, successors or other counterparties in connection with a business reorganisation, financing or sale, subject to confidentiality and lawful processing requirements.

The main providers we use today are Amazon Web Services (hosting of our website and systems), Customer.io (email), Intercom (support chat, including its AI agent), Match-Trader (trading platform), Paymaxis (payments), Google (Analytics and Tag Manager), Usercentrics (consent management), Stape (tag delivery), Meta and TikTok (advertising, only with your consent), impact.com (affiliate tracking), Elementor Site Mailer (website emails such as password resets) and Hostinger (email mailboxes and servers). We will update this list when it changes.

8. CMC Markets relationship and optional referrals

8.1 True North Tech L.L.C-FZ operates CMC Markets Funded independently, in conjunction with CMC Markets. No CMC Markets company owns or controls True North Tech L.L.C-FZ.

8.2 We do not share your personal data with any CMC Markets company for its own purposes.

8.3 If we offer you an optional referral to a CMC Markets company for a separate regulated service and you ask us to make it, we will share only the information needed for that referral, and that company will handle your data under its own privacy notice.

8.4 Once you engage directly with a CMC Markets entity, that entity’s own legal and privacy documents govern its processing for the separate regulated service. We may receive referral remuneration or other commercial consideration under separate arrangements; that consideration does not make the relevant CMC Markets entity jointly liable for our Services, Rewards, refunds or customer support obligations.

9. International transfers

Because we use international providers, your personal data may be processed in the United Arab Emirates and in other countries where our providers, infrastructure or support teams operate. These include the United States (for example our email and customer support providers), the United Kingdom (where our website and main systems are hosted), EEA states and Singapore.

Where applicable law requires transfer safeguards, we will use safeguards that are appropriate in the circumstances, which may include contractual protections, vendor due diligence, access controls, minimisation, encryption and transfer-risk assessments.

10. Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including for contract performance, fraud prevention, sanctions compliance, dispute resolution, tax and accounting rules, record-keeping, evidence preservation and legal claims.

Retention periods may vary depending on the data type. For example, account records, transaction records, support records, compliance logs and payout records may be kept longer than routine website analytics data. Where data is aggregated or anonymised so it no longer identifies you, we may retain and use it for longer periods.

11. Security

We use a combination of technical, organisational and contractual measures designed to protect personal data against unauthorised access, misuse, loss, alteration or disclosure. These may include role-based access controls, logging, encryption where appropriate, vendor due diligence, security monitoring, restricted access to compliance materials and incident-response processes.

No system can be guaranteed to be completely secure. You are also responsible for keeping your account credentials, device access and email account secure.

12. Cookies and similar technologies

We use cookies and similar technologies for security, session continuity, functionality, analytics and, where permitted, marketing or attribution. For detailed information, please read our Cookie Policy.

We use Usercentrics to ask for, record and apply your cookie choices. You can change them at any time through the ‘Privacy Settings’ link in the footer of the Website.

13. Your rights

Depending on your location and the law that applies to you, you may have rights to request access to, correction of, deletion of, restriction of, objection to or portability of your personal data, and you may have the right to withdraw consent where consent is relied upon. You may also have the right to complain to the data protection authority where you live or work.

We may need to verify your identity before responding. We may also limit or decline a request where an exemption applies, where the request would adversely affect the rights of others, where we must keep certain records for legal reasons or where the data is no longer capable of being linked to you.

14. Marketing communications

We may send service messages that are necessary for the operation of your account, purchases, support tickets, security events, legal notices, program updates or payout processing.

If you buy from us, or start a purchase and do not finish it, we may email you about similar challenges and offers without asking you first. You can refuse these emails at any time: every one has an unsubscribe link, and you can also tell us through the contact details in section 17. We do not send them to anyone who has told us not to.

15. Children

Our Services are not intended for children. You may not use the Services unless you meet the minimum age and eligibility requirements stated in our General Terms and Conditions.

16. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, service design, fraud patterns, technology, business structure, vendor arrangements or operational practices. When we do, we will update the “Last updated” date at the top of this page and may provide additional notice where appropriate.

17. Contact

To ask about this Policy or to exercise a privacy right, email support@cmcmarketsfunded.com or write to True North Tech L.L.C-FZ at the registered office shown at the top of this Policy. Please include your full name, the email address you use with us and what you are asking for.

If your request relates to an optional CMC Markets referral after you have already engaged directly with the relevant CMC Markets entity, that entity may need to handle part of your request under its own legal documents.