Privacy and Cookie Policy

Document owner: [PRIVACY LEAD OR DPO]

Version: [VERSION NUMBER]

Effective date: [EFFECTIVE DATE]

Last updated: [LAST UPDATED DATE]

1 About this policy

This policy explains how BARS 8 LTD, trading as BARS 8, collects, uses, discloses, stores and protects personal data relating to website visitors, prospective clients, clients, authorised persons, beneficial owners, partners, strategy providers, managers and other contacts.

It also explains how BARS 8 uses cookies and similar technologies. Service-specific notices presented at the point of collection may provide additional detail. Where a service-specific notice conflicts with this policy, counsel should define the intended priority and legal basis.

2 Controller and contact

The controller responsible for the processing described here is:

BARS 8 LTD

128 City Road, London, United Kingdom, EC1V 2NX

Company number: 17493202

Privacy contact: [PRIVACY EMAIL OR DPO CONTACT]

Data Protection Officer or representative: [NAME, ROLE AND CONTACT, IF APPLICABLE]

Supervisory authority: [AUTHORITY NAME AND URL, IF APPLICABLE]

Where another BARS 8 entity acts as a separate or joint controller, the relevant application, service notice or entity schedule will identify it and explain the allocation of responsibilities.

3 Scope

This policy applies to personal data processed through:

• the BARS 8 public website, forms and communications;
• account application, identity verification and client administration;
• trading platforms, client portals, copy trading and PAMM services;
• deposits, withdrawals and payment investigations;
• support, complaints, call recordings and secure messages;
• partnership, affiliate and representative programmes;
• events, education, surveys and marketing;
• security, fraud, sanctions and financial-crime controls; and
• business operations, legal obligations and regulatory engagement.

Third-party websites, applications and platforms may apply their own privacy notices. Review them before providing information.

4 Personal data we collect

4.1 Identity and contact data

This can include legal and former names, title, date and place of birth, nationality, citizenship, signature, photographs, residential and mailing address, email, telephone number and preferred language.

4.2 Verification and eligibility data

This can include identity-document details and images, proof of address, biometric or liveness results where lawful, tax identifiers and residence, immigration or residency status, sanctions and PEP screening, adverse-media results, authentication questions and due diligence records.

4.3 Financial and economic data

This can include bank and payment details, transaction references, deposits, withdrawals, chargebacks, source of funds, source of wealth, income, assets, liabilities, occupation, employer, business activity, financial circumstances and tax information.

4.4 Account and trading data

This can include account identifiers, classifications, assessments, product permissions, orders, positions, prices, transaction history, balance, equity, margin, leverage, fees, preferences, watchlists, copy or PAMM allocations, manager or provider interactions and platform records.

4.5 Corporate and relationship data

For entities and arrangements, this can include incorporation, legal form, registered office, ownership, control, directors, partners, trustees, beneficiaries, authorised persons, group structure and business activity.

4.6 Device and technical data

This can include IP address, device identifiers, browser, operating system, application version, time zone, language, login records, session data, cookie identifiers, approximate location, network and diagnostic data, security events and interaction logs.

4.7 Communications and support data

This can include emails, chats, telephone and video recordings, portal messages, form submissions, complaints, survey responses, attachments, screen-sharing records and service notes.

4.8 Marketing and preference data

This can include subscriptions, consent records, channel choices, campaign source, affiliate attribution, event attendance, content engagement and suppression records.

4.9 Partner and professional data

This can include employer or business, role, licences, websites, audience, marketing channels, referral activity, campaign performance, compensation, bank details, tax data, training and monitoring records.

4.10 Inferences and risk indicators

We may derive account risk, fraud, financial-crime, suitability, service, preference and security indicators from information available to us. These indicators are used only for identified lawful purposes and are subject to appropriate access controls.

4.11 Special-category and criminal-offence data

We process sensitive data only where necessary and lawful. Examples can include biometric verification data, accessibility information or data revealing possible criminal conduct through fraud, sanctions or financial-crime screening. The final notice must identify applicable legal conditions and local restrictions.

5 How we obtain data

We receive personal data:

• directly from you or a person authorised to act for you;
• through website, portal, platform and application activity;
• from payment institutions, banks, brokers, liquidity providers and counterparties;
• from identity, fraud, sanctions, PEP, adverse-media and credit-reference providers;
• from company registries, regulators, courts, tax authorities and other public sources;
• from Introducing Brokers, affiliates, regional representatives and campaign platforms;
• from strategy providers, PAMM managers and other participants in an accepted service;
• from group companies and service providers; and
• from cookies, pixels, software development kits, logs and similar technologies, subject to applicable consent requirements.

If another person gives us your data, we may ask them to confirm their authority and that they have provided required privacy information.

6 Why we use personal data

The applicable legal basis depends on the person, purpose and jurisdiction. The approved record of processing must align with this table.

Purpose

Typical data

Proposed legal basis to validate

Assess and open an account

Identity, contact, verification, financial, experience

Steps before contract; contract; legal obligation

Provide trading and account services

Account, trading, payment, communications

Contract; legal obligation; legitimate interests

Operate copy trading or PAMM

Trading, allocation, provider or manager, fee data

Contract; legal obligation; legitimate interests

Verify identity and prevent financial crime

Identity, verification, payment, risk, device

Legal obligation; public interest; legitimate interests; local sensitive-data condition

Process deposits, withdrawals and fees

Financial, identity, account, transaction

Contract; legal obligation; legitimate interests

Assess appropriateness, suitability or classification

Experience, knowledge, objectives, financial circumstances

Legal obligation; contract

Execute, monitor and report transactions

Orders, prices, platform, account, communications

Contract; legal obligation; legitimate interests

Secure accounts, systems and premises

Device, authentication, communications, CCTV where used

Legitimate interests; legal obligation; contract

Support clients and resolve complaints

Identity, account, communications, complaint

Contract; legal obligation; legitimate interests

Record calls and communications

Voice, chat, platform and message records

Legal obligation; contract; legitimate interests; consent where required

Manage partners and campaigns

Partner, attribution, marketing, payment

Contract; legal obligation; legitimate interests

Send service communications

Contact, account, preferences

Contract; legal obligation; legitimate interests

Send marketing

Contact, preference, engagement

Consent; legitimate interests where permitted

Personalise content and measure website use

Device, cookie, interaction, preference

Consent for non-essential technologies; limited legitimate interests where lawful

Develop services and analytics

Aggregated or personal usage and account data

Legitimate interests; consent where required

Establish and defend legal claims

Account, trading, payment, communications

Legitimate interests; legal claims condition; legal obligation

Meet tax, regulatory and authority duties

Identity, tax, account, transaction, communications

Legal obligation; public interest

Corporate transactions and audits

Relevant account, contract, operational records

Legitimate interests; legal obligation

Where legitimate interests are used, we assess necessity, expected impact and safeguards. You can request information about an applicable balancing assessment, subject to lawful confidentiality limits.

7 If data is required

Some information is required by law, contract or service design. If you do not provide it, we may be unable to open or maintain an account, process a payment, execute an instruction, provide a feature or meet a request. We will identify mandatory fields where practicable.

8 Automated processing and decisions

We may use rules and models to support identity verification, fraud detection, sanctions screening, financial-crime risk, account security, eligibility, appropriateness, margin, trading limits and marketing preferences.

Some processing can affect whether an account, payment, product or service is available. The final implementation register must identify any decision based solely on automated processing that produces a legal or similarly significant effect. Where applicable law grants rights, you may request human intervention, express your view and challenge the decision.

We test relevant systems for data quality, effectiveness, explainability, security and inappropriate bias in proportion to the risk. An automated result can be reviewed or overridden by authorised personnel under documented controls.

9 Who receives personal data

We may disclose personal data where necessary and lawful to:

• BARS 8 group entities and personnel with a defined need;
• identity, verification, fraud, sanctions, adverse-media and risk providers;
• trading platform, hosting, cloud, cybersecurity, communications and support providers;
• banks, payment processors, card schemes, wallets and reconciliation providers;
• brokers, liquidity providers, market-data providers, execution counterparties and technology vendors;
• copy trading providers, strategy providers or PAMM managers to the limited extent the service requires;
• Introducing Brokers, affiliates and representatives within approved reporting and privacy limits;
• auditors, insurers, legal advisers, accountants, consultants and debt-recovery providers;
• regulators, courts, law enforcement, tax authorities, financial intelligence units and other competent bodies;
• a prospective buyer, seller, investor, lender or restructuring participant under confidentiality safeguards; and
• another person you authorise or whom law permits us to contact.

Recipients may act as processors, independent controllers or joint controllers. Contracts and due diligence are used where required. We do not sell personal data for money. Counsel must assess whether any advertising disclosure meets a broader statutory definition of sale or sharing and provide the required opt-out mechanism.

10 International transfers

Recipients and systems may be located outside the country in which data was collected. Before a restricted transfer, we use a lawful mechanism appropriate to the jurisdiction, such as:

• a recognised adequacy decision;
• approved contractual clauses;
• binding corporate rules;
• a permitted certification or framework;
• a legally available derogation for a specific transfer; or
• another mechanism authorised by applicable law.

Where required, we assess the destination law and practical safeguards and apply supplementary measures. You may request information about the relevant transfer mechanism, subject to redactions needed for security and confidentiality.

Transfer destinations and mechanisms: [APPROVED INTERNATIONAL TRANSFER SCHEDULE].

11 Retention

We keep personal data for the period needed to provide services, meet legal and regulatory duties, prevent fraud, resolve disputes and enforce agreements. The period depends on record type, jurisdiction, relationship and legal hold.

Record category

Draft minimum or rule to validate

Account application and due diligence

[AML OR REGULATORY RETENTION PERIOD] after relationship or transaction

Orders, trades, statements and communications

[TRADING RECORD RETENTION PERIOD]

Payments and tax records

[PAYMENT AND TAX RETENTION PERIOD]

Complaints and legal claims

[COMPLAINT OR LIMITATION PERIOD PLUS BUFFER]

Call and screen recordings

[RECORDING RETENTION PERIOD]

Security and access logs

[SECURITY LOG RETENTION PERIOD]

Marketing consent and suppression

Consent life plus [EVIDENCE PERIOD]; suppression while needed

Website analytics

[ANALYTICS RETENTION PERIOD]

Partner and manager records

Agreement life plus [CONTRACT RETENTION PERIOD]

Rejected applications

[REJECTED APPLICANT RETENTION PERIOD]

At the end of the period, data is securely deleted or irreversibly anonymised unless a legal hold, authority request or continuing obligation requires further retention.

12 Security

We use measures designed for the nature and risk of the data, which can include:

• identity and access management, least privilege and multifactor authentication;
• encryption in transit and at rest where appropriate;
• secure development, change management, testing and vulnerability management;
• network, device, application and event monitoring;
• backups, resilience, recovery and incident response;
• provider due diligence and contractual security requirements;
• data minimisation, environment separation and retention controls; and
• personnel screening, confidentiality and training.

No transmission or storage method is completely secure. You should protect devices and credentials and notify [SECURITY CONTACT] promptly of suspected compromise.

13 Your rights

Depending on applicable law, you may have the right to:

• receive information about processing;
• access personal data and obtain a copy;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• object to processing based on legitimate interests or public interest;
• object to direct marketing;
• receive certain data in a portable format;
• withdraw consent without affecting earlier lawful processing;
• request safeguards relating to qualifying automated decisions;
• complain to a supervisory authority; and
• exercise additional local rights, including appeal or opt-out rights.

Rights are subject to conditions and exemptions. Financial-services, financial-crime, legal privilege, recordkeeping, fraud and claim obligations can require us to retain or withhold some information.

Submit a request to [PRIVACY REQUEST CHANNEL]. We may verify identity and authority. We will respond within [STATUTORY PERIOD], subject to lawful extension. We do not charge a fee unless the law permits one for manifestly unfounded, excessive or repeated requests.

14 Marketing choices

We may send marketing where we have valid consent or another legal basis permitted in your jurisdiction. Messages identify BARS 8 and provide an unsubscribe method. You can update preferences through [PREFERENCE CENTRE], use the unsubscribe link or contact us.

Opting out of marketing does not stop essential service, security, legal or account communications. We may retain a minimal suppression record to honour the choice.

Partners and affiliates may market BARS 8 only through approved channels and legal bases. Report unsolicited or misleading activity to [COMPLIANCE CONTACT].

15 Cookies and similar technologies

15.1 What they are

Cookies are small data files stored or read by a browser or device. Similar technologies include pixels, tags, local storage, software development kits and device identifiers. They can support security, preferences, measurement and advertising.

15.2 Categories

Strictly necessary

These technologies support functions such as security, authentication, load balancing, consent records, fraud prevention and network operation. They are used without optional consent only where law allows.

Functional

These technologies remember choices such as language, region, display and support preferences. Refusal can reduce convenience or feature availability.

Analytics

These technologies help measure page use, navigation, errors and campaign performance. Where required, they activate only after consent.

Advertising

These technologies support audience measurement, frequency control, attribution and relevant advertising across services. Where required, they activate only after consent.

15.3 Cookie inventory

The production website must publish a scanner-verified inventory in this format:

Name

Provider

Purpose

Category

First or third party

Duration

Data destination

[COOKIE NAME]

[PROVIDER]

[SPECIFIC PURPOSE]

[CATEGORY]

[TYPE]

[DURATION]

[COUNTRY OR REGION]

The inventory must include cookies and similar storage used by the website, portal landing pages, embedded calendars, chat, video, forms, analytics and advertising tools.

15.4 Consent controls

On first visit, the banner provides these actions with equal clarity where required:

• Accept all
• Reject optional
• Manage preferences

Optional technologies remain disabled until the required consent is recorded. The preference centre allows category-level choices and withdrawal. The consent record includes identifier, choices, notice version, time and region.

15.5 Browser and device controls

You can also control storage through browser or device settings. Blocking strictly necessary technologies may prevent secure login or essential website functions.

15.6 Global privacy signals

[STATE WHETHER AND HOW RECOGNISED OPT-OUT SIGNALS SUCH AS GPC ARE HONOURED IN APPLICABLE JURISDICTIONS].

16 Call, chat and screen recording

We may record or monitor calls, video, chat, platform sessions or screen interactions for transaction evidence, security, quality, training, complaints and legal compliance. We provide any notice and obtain any consent required by local law. Access and retention are controlled.

17 Social media and public forums

Content posted on a public BARS 8 channel can be visible to other users and the platform operator. Avoid publishing account, identity or payment information. Social platforms process data under their own terms. We may moderate content according to published community standards and legal duties.

18 Children

BARS 8 services are not intended for persons under [MINIMUM AGE]. We do not knowingly open trading accounts for children. If you believe a child has provided personal data, contact [PRIVACY CONTACT] so we can assess and act.

19 Changes to this policy

We may update this policy when law, services, providers or processing changes. The current version and effective date will remain available at [PRIVACY POLICY URL]. We will provide additional notice or seek renewed consent where required.

20 Complaints and contact

Send privacy questions or requests to [PRIVACY EMAIL OR DPO CONTACT] or [PRIVACY POSTAL ADDRESS].

You may complain to [LEAD SUPERVISORY AUTHORITY] and, depending on your location, another competent data-protection authority. We encourage you to contact us first so we can investigate promptly.

Appendix A Data processing approval schedule

Before publication, privacy counsel and the privacy lead must approve:

• controller and joint-controller mapping;
• all legal bases and special-category conditions;
• automated decisions and required explanations;
• recipient and processor categories;
• international-transfer locations and mechanisms;
• retention periods and deletion controls;
• rights channels and response ownership;
• marketing consent and partner data flows;
• the cookie scan, classifications and preference centre;
• mobile, platform and embedded third-party technologies; and
• jurisdiction-specific notices and opt-out mechanisms.