Privacy Policy Zemmy Trade

Effective date: 08.10.2026

Last updated: 08.10.2026

Zemmy Trade (the "Company", "we" or "us") is responsible for the personal data covered by this Privacy Policy. The policy explains our information practices when a person (a "user" or "you") visits our websites, uses our applications or interacts with the other online platforms through which we deliver our services (together, the "Services").

For the processing described here, the Company determines the purposes and means of handling personal data and acts as the personal data controller. Our contact details appear under "Registration and Authorisation" and "How to Contact Us".

Before using any third-party site, application, or service, we recommend that you review and understand its terms and conditions, warranty, and privacy policies, and confirm that you accept them. You acknowledge that we are not responsible for the products, services, or descriptions of products or services you receive from third-party sites or applications, nor for their content or privacy practices. This Privacy Policy does not apply to any such third-party products or services. By using third-party sites or applications to purchase products and services, you knowingly and voluntarily accept all related risks.

1. Data usage

We obtain information from you when you register, verify your identity, make a transaction, contact support, answer a survey or choose an optional feature. Technical information may arise from your interaction with the Services. We may also receive relevant records from payment providers, identity-verification providers, lawfully accessible sources and a sign-in provider you select.

Processing may involve obtaining, recording, arranging, consulting, analysing, updating, storing, transmitting, restricting, erasing or securely destroying information. Collection begins when you supply the relevant information or activate a feature, or when a disclosed technical interaction occurs. Processing ends when its purpose and any lawful retention requirement have expired. We limit each operation to the data reasonably necessary for its stated purpose.

Lawful bases for processing

Consent: a freely given, specific, informed and verifiable permission for a defined purpose. We retain evidence of the choice and provide an accessible withdrawal mechanism.

Contract: processing objectively needed to enter into or perform the Service Agreement or another arrangement you request.

Legal obligation: processing required by a specific obligation that actually applies to the Company or the relevant transaction. This may include anti-money laundering (AML), counter-terrorist financing (CTF), tax, accounting, lawful regulatory reporting and customer-verification duties.

Legitimate interests: necessary and proportionate processing for a documented interest, such as protecting systems or investigating fraud, only where the governing law permits this ground and the balancing of interests supports it.

Data type	Information, purposes and lawful bases
Identity Data	Examples of information we may collect: First name and last name; a patronymic where relevant; date of birth; gender where needed; a photo; and information from a passport, ID or driver's license, including the document number. Purposes of processing: Establish and administer the account; confirm identity and eligibility; investigate fraud; protect the Services; and carry out applicable AML, CTF and other legal checks. Lawful bases for processing: Contract or Legal obligation for necessary checks; Legitimate interests for proportionate security where permitted; Consent for optional uses or where otherwise required.
Contact Data	Examples of information we may collect: Your email address, telephone numbers and billing address, together with changes you submit to these details. Purposes of processing: Operate account and application functions; send communications and essential notices; provide support; verify payment or identity details; and meet applicable compliance duties. Promotional contact is governed by "Marketing" and "Communications". Lawful bases for processing: Contract; Legal obligation where applicable; permitted Legitimate interests for service security; Consent for promotional contact and partner sharing.
Profile Data	Examples of information we may collect: User ID, username, account details (account photo, leaderboard number, online status, experience points and winning amount); interests, preferences, feedback, survey responses and in-app messages. Purposes of processing: Maintain the account, support application functionality, respond to feedback, offer personalized settings and administer optional promotional activities, internal events, Leaderboards Service. Apply security and applicable compliance checks. Public display is restricted as described below. Lawful bases for processing: Contract for requested functions; Legal obligation where relevant; permitted Legitimate interests for security; Consent for optional participation, analytics, personalization or marketing where required.
Technical Data	Examples of information we may collect: IP address and IP history; login records; browser and plug-in types and versions; operating system and platform; time zone and approximate region; cookies and permitted device or advertising identifiers. Purposes of processing: Keep the Services operational, investigate misuse, diagnose faults and support security. Optional analytics, advertising and personalization use only permitted data. Lawful bases for processing: Contract for essential functionality; Legal obligation where applicable; permitted Legitimate interests for necessary security; Consent before optional tracking or other consent-dependent processing.
Usage Data	Examples of information we may collect: Website and application interactions; registration date, account category and trading cluster; complaint and request-file counts; IP history; crash logs, diagnostics and other app performance data. Information about installed apps is restricted to specifically disclosed, permitted functionality, not a general device inventory. Purposes of processing: Resolve technical issues, develop application and Website functions, assess usage and detect manipulation or fraud. Lawful bases for processing: Contract for necessary functions; permitted Legitimate interests for limited security and diagnostics; Consent for optional analytics or personalization; Legal obligation only where a specific duty applies.
Financial Data	Examples of information we may collect: Bank account details and relevant tax identification number, including a social security number, income tax identification number or national insurance number only where that particular identifier is necessary and lawful to request. Purposes of processing: Deliver requested financial functions, reconcile records, prevent payment fraud and carry out applicable AML, CTF, tax or other mandatory checks. Lawful bases for processing: Contract; Legal obligation; permitted Legitimate interests for proportionate fraud prevention; Consent and additional safeguards where sensitive-data rules require them.
Transaction Data & Purchase history	Examples of information we may collect: Deposits, withdrawals, payments, exchanges, trading and purchase history; profit, balance, amounts and methods; and the asset, direction and duration of a trade. Purposes of processing: Execute and document transactions; administer balances and accounts; resolve disputes; identify manipulation; and meet applicable AML, CTF and recordkeeping duties. Lawful bases for processing: Contract; Legal obligation; permitted Legitimate interests for necessary fraud prevention; Consent for optional functions and wherever required for sensitive processing.
Payment Data	Examples of information we may collect: Payment-wallet identifiers; issuing bank, payment system, cardholder name, card number and expiration date where required. Purposes of processing: Authorize or verify a payment, resolve payment issues and prevent fraud, subject to applicable AML, CTF and payment-security rules. We minimize card data and use protected payment channels. Lawful bases for processing: Contract or Legal obligation; permitted Legitimate interests for necessary fraud checks; Consent where required.
Economic Profile Data	Examples of information we may collect: Occupation, purpose of investment, annual income, net wealth, expected annual investment amount and sources of funds, insofar as relevant to the requested service or mandatory verification. Purposes of processing: Conduct required customer due diligence and source-of-funds checks, assess relevant account information and identify fraud or financial-crime risks. Lawful bases for processing: Contract only for necessary, lawful service requirements; Legal obligation; Consent and enhanced safeguards where required.
KYC Data	Examples of information we may collect: "Know your customer" information, including a copy of an identity card, passport or driver's license and a recent utility bill or other permitted evidence needed to verify identity or address. Purposes of processing: Complete applicable KYC, AML and CTF procedures, verify account ownership and investigate impersonation. Requests are limited to relevant information; documents are not repurposed for marketing. Lawful bases for processing: Legal obligation where the check is mandatory; Contract where necessary and recognised by law; Consent for processing not covered by a lawful exception.
Special Categories of Data	Examples of information we may collect: Annual income, biometric data and information about criminal convictions or offences where lawfully necessary. Purposes of processing: Perform narrowly defined verification, security or mandatory compliance activities. Biometric processing, where used, is separately explained before collection. Criminal-record information is obtained only from a lawful source for a legally permitted purpose. Lawful bases for processing: Consent where required, or a clearly applicable Statutory exception.
Conformity Data	Examples of information we may collect: Education, employment status, trading experience and answers to a self-assessment test relevant to the requested Services. Purposes of processing: Assess suitability or eligibility where applicable, administer the account, meet relevant compliance requirements and identify inconsistent or fraudulent information. Lawful bases for processing: Contract or Legal obligation where applicable.
Marketing and Communication Data	Examples of information we may collect: Choices about receiving marketing, preferred communication channels, consent records and records of withdrawal or objection. Purposes of processing: Apply your communication preferences, administer permitted promotional activities and internal events, and evaluate consented marketing. Retain limited preference evidence to prevent further unwanted contact and demonstrate compliance. Lawful bases for processing: Consent; Legitimate interest.
Location Data	Examples of information we may collect: Website regional settings, such as residency country, time zone and interface language, and any related approximate location information you provide. Approximate region inferred from an IP address is addressed under Technical Data. The location data collection feature in iOS and Android apps works only in specific countries. Purposes of processing: For website – set the appropriate Website interface, check regional service availability, support account administration and carry out necessary fraud or compliance checks. For applications – optional KYC check feature for specific countries. Lawful bases for processing: Contract or Legal obligation where necessary; Consent where required.
Audio and Video Data	Examples of information we may collect: Recordings of calls between you and the Company. Purpose of processing: Support. Recording for an optional event or promotion requires its own permission. Lawful bases for processing: Consent where required; Contract or Legal obligation only where that basis covers the recording. A prior notice is provided before recording begins.

Additional protections and choices

Where a data item is sensitive or specific personal data, we identify that status in the relevant notice and apply restricted access, confidentiality and risk-appropriate controls.We do not collect unrelated sensitive data merely because they fall within a statutory category.

The Services are not directed at children, and trading access is restricted to users meeting the age and legal-capacity requirements in the Service Agreement and applicable law.

2. With whom we share the information we collect

We do not sell or rent Personal Information or personal and sensitive user data. We disclose Personal Information only for a specific purpose described here, within a valid legal basis and the applicable platform restrictions. We may move or reveal Personal Information to our subsidiaries. We may also share your Personal Information with dependable external service providers or partners so they can:

(i) confirm your identity and validate your account information;

(ii) store or process Personal Information for us (for instance, through cloud service providers);

(iii) support our business operations, deliver our Services, and help us enhance them;

(iv) conduct research, technical diagnostics, and analytics connected to the Services;

(v) send promotional and informational content, consistent with our marketing practices (see Section Marketing).

We may disclose personal information, or any information you submit through the Services, when we honestly believe that doing so is useful or reasonably necessary to:

(i) satisfy any applicable law, regulation, legal process, or governmental request;

(ii) enforce our policies (including this Privacy Policy), including investigations into possible violations;

(iii) investigate, detect, prevent, or take action against illegal activity or other misconduct, suspected fraud, or security problems;

(iv) establish or exercise our rights to defend ourselves against legal claims;

(v) prevent harm to the rights, property, or safety of us, our users, you, or any third party;

(vi) fulfill the legitimate purposes below:

• To display advertisements to you when you use our Services.

• To conduct research or anonymous analytics so we can improve and customize our Services to suit your needs and interests.

• To investigate violations and enforce our policies, as required by law, regulation, or another governmental authority, or to comply with a subpoena or similar legal process, or to respond to a government request.

• To monitor transactions in order to prevent fraud, money laundering, and cheating.

• For enforcement agencies and/or when we determine it is necessary to enforce intellectual property or other legal rights.

Every third party that may receive user data from us will offer the same or equivalent protection of user data as described in this Privacy Policy.

3. Third-party collection of information

In addition to the information we collect from you directly, we may also receive information from third parties, including through SDKs and other similar technologies or sources.

Google Analytics

We use Google Analytics to understand interactions with the Services and improve their operation. Subject to the choices described above, it can receive page or screen views, interaction events, approximate region, browser and device characteristics, session information and cookie or application identifiers. We do not send names, email addresses, telephone numbers, identity documents, full payment details, authentication credentials or Google User Data to Google Analytics.

Google’s ability to use and share information collected by Google Analytics about your visits to this site is restricted by the Google Analytics Terms of Use and the Google Privacy Policy.

Google OAuth

"Continue with Google" lets you ask Google to authenticate you for registration, sign-in or linking an existing account. This is optional and does not authorize access to all information in your Google Account. "Google User Data" includes information supplied through Google OAuth or Google APIs and any information derived from it.

For this sign-in function, the permissions are limited to openid, email and profile. Depending on the information Google provides and the permissions you grant, we receive a persistent Google Account identifier (sub), an email address and verification status, a name and profile picture, and the ID token or other OAuth authentication credential needed to validate the sign-in. We request no permission unrelated to this function.

Your Google password is not disclosed to us. These permissions do not give us access to Gmail messages, Google Drive files, Google Calendar events, Google Contacts, payment information or other Google Account content. We use the returned information only to authenticate you, associate the sign-in with the correct account, maintain the requested login function and protect it against unauthorized access, fraud or abuse.

Google User Data is not sold, rented or provided to advertising platforms, affiliates, data brokers or information resellers. We do not transmit it to Third-Party AI Models or use it to develop, train or improve generalized or non-personalized artificial intelligence or machine-learning models.

Disclosure is confined to what is necessary for the user-facing sign-in function through authorized processors with your consent, a specific action you expressly request within these restrictions, a necessary security investigation or compliance with law.

We apply technical and organizational measures designed to protect Google User Data and OAuth credentials against unauthorized or unlawful access, use, loss, alteration, destruction, or disclosure. These measures include encryption in transit, encryption at rest for stored Google User Data, role-based access controls, least-privilege access, security logging and monitoring, and restrictions on personnel access. Google User Data are treated as confidential and are not disclosed to unauthorized persons.

A new category of access or a materially different permitted use requires an updated notice and any necessary new authorization before it starts.

Zemmy Trade's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Cookies and other tracking technologies

A cookie is a small browser-stored record. Similar technologies include local storage, pixels and application identifiers. We and disclosed providers may use these technologies to maintain sessions, remember settings, protect the Services and, with the required permission, measure use or support advertising. Cookie and device identifiers can be personal data even when they do not contain your name.

• Session cookies support a browsing session and normally expire when it ends.

• Persistent cookies remain until their specified expiry or until you remove them and can remember a preference between visits.

• Third-party cookies originate from another provider whose technology is included in a page.

Strictly necessary technologies operate only to the extent needed for a requested function or another lawful essential purpose. You may remove the cookies by following the instructions of your device preferences; however, if you choose to disable cookies, some features of our Service may not operate properly and your online experience may be limited.

5. Leaderboards

The Leaderboards service is a feature that allows you to publicly showcase your trading strategies and results. By using this service, you authorize us to disclose your personal data for display in the platform's rankings, you permit us to generate trading signals based on your trades and disclose aggregated information about them, and you agree that other users may copy your successful trades if you are included in the platform's rankings.

The leaderboard contains:

• your name or User ID, a national flag icon, an optional photo, a leaderboard number, position text, online status and experience points.

Trade amounts, account balance, profit and user-linked Transaction Data remain private, they are not made public through a leaderboard.

Participation in Leaderboards is optional. You may keep trading activity private or change participation through "Settings" > "Privacy".

6. Advertisements

We may use advertising technologies, including those provided by third parties, to serve advertisements (including targeted ads) when you use our Services. We may share relevant data with third-party advertising partners, who may use such data on our behalf to measure the effectiveness of our advertising campaigns and to identify and retarget users who have previously interacted with our Services or advertisements.

You can opt out of these technologies by adjusting the relevant settings on your device or within the services of advertising providers. Participating advertising networks may also offer management tools through the Network Advertising Initiative (NAI) or the Digital Advertising Alliance (DAA). To opt out, please visit the websites of these organizations: www.networkadvertising.org/optout_nonppii.asp and www.aboutads.info/choices.

7. Marketing

We may use your Personal Information (name, email address, phone number, and similar details) either on our own or through third-party contractors to send you promotional materials. These materials may relate to our Services and to products, services, websites, and applications offered by our business partners and affiliates (together, marketing affiliates) that we believe could be of interest to you. We may also share or disclose your Personal Information for direct marketing purposes with marketing affiliates so they can present you with various marketing offers that we or they think are relevant to you.

In recognition of your privacy rights, we give you ways to stop receiving further marketing from us or from our marketing affiliates. You may unsubscribe at any time by sending an email with the words “remove marketing” to [email protected]. If you unsubscribe, we will remove your email address from our marketing lists and from any future lists we may share with marketing affiliates.

However, you may need to unsubscribe separately from marketing messages sent by our marketing affiliates. A provider acting independently may maintain a separate consent relationship with you; its own notices explain how to withdraw that distinct consent. We retain only the minimal suppression record necessary to avoid renewed unwanted contact.

Please also note that even if you unsubscribe from our marketing emails, we may still send you service-related updates and notifications. Essential account, security, legal and transaction notices may still be sent through an appropriate channel, without disguising promotional content as a service message.

8. Communications

By pressing the button or checking the box, you may consent to the transfer of your personal data for the purposes of (1) communicating via WhatsApp, and you also agree (2) to receive phone calls (including promotional ones) and WhatsApp messages. We use this service to send you messages regarding the provision of services as well as promotional messages.

• You can stop WhatsApp messages by emailing [email protected] with "WhatsApp" or by making an equivalent request through an available channel. After a WhatsApp opt-out, we do not continue service or promotional messages through that channel; necessary notices use another appropriate means where lawful.

• You can stop promotional calls using "opt-out calls". Opting out of WhatsApp messages does not automatically opt you out of phone calls unless you request to stop receiving calls.

• Call recording, where applicable, follows the separate Audio and Video Data notice.

9. Personal data deletion and rectification requests

Your rights and how to exercise them

Subject to the conditions and exceptions in applicable law, you may ask whether we process your information, obtain access and a copy, correct or complete inaccurate records, withdraw consent, object to processing, request restriction or suspension, and seek deletion or destruction.

Send a request in your own words to [email protected], or use the available account or privacy controls. Identify the account sufficiently for us to locate it and describe the action requested. We seek only proportionate additional evidence needed to prevent unauthorized disclosure or deletion. We do not require a particular legal formula or unnecessary identity documents. Where verification is insufficient, we explain the issue and the next available steps rather than automatically rejecting the request.

Retention and erasure

We retain the information we collect for as long as needed to provide the Services and to comply with our legal obligations (up to 5 years in relation to the AML/CTF, FATF regulation), resolve disputes and enforce our agreements. When a purpose or retention basis expires, information is securely erased, destroyed or irreversibly anonymized.

Account and Profile Data are retained during the service relationship and then processed under the account-deletion procedure. Optional marketing use stops when consent is withdrawn; minimal consent records may remain solely to respect your choice and demonstrate compliance, for the applicable lawful period.

10. Account deletion and recovery

You may initiate account deletion through the account-deletion control in the Android or iOS application or email [email protected] with "delete account" or another deletion request. We may verify ownership proportionately before executing an irreversible action.

Deletion closes the account and removes the associated user data from active systems, including Google User Data and data held by processors, except for specifically justified records described under "Retention and erasure". We instruct relevant providers to delete their copies and explain any lawful retained categories, reasons and duration.

A restore account request can reverse a pending deletion only while the relevant account data still lawfully exists and restoration is technically possible. Once permanent erasure is complete, the deleted information cannot be recovered. A new account, where allowed, requires a new registration and fresh optional choices.

11. Safeguarding and transferring your information

Security

Our safeguards address the sensitivity and risks of the processing. They include encrypted transmission, access controls based on role and necessity, protected credentials, encryption of sensitive stored information, staff confidentiality duties, etc. We keep required records and designate responsible personnel.

No technical system eliminates every risk. Possible consequences of unauthorized access include identity misuse, financial harm and loss of confidentiality. If you feel that your privacy was not treated in accordance with our policy, or if any person attempted to abuse our Services or acted in an inappropriate manner, please contact us directly at [email protected].

Cross-border processing

The Company and its approved providers may process information on infrastructure or through personnel outside the place where you supplied it. This can include overseas hosting, cloud storage and remote support. A transfer occurs only when all applicable conditions are met.

12. Corporate transaction

A proposed or completed merger, acquisition, reorganization, asset sale or change in the operator of the Services may require a limited transfer of business records. Due diligence uses anonymous or minimized information where feasible, with confidentiality safeguards.

We will provide legally required notices before and after a change of controller and identify the successor and material effects on processing. The recipient will maintain applicable protections and respect existing purpose limits and choices.

13. Updates or amendments to the Privacy Policy

The current Privacy Policy is available on the Website and through the applications. We show the effective date and last-update date and give an appropriate advance notice of material changes. A new purpose, additional sensitive processing or expanded Google permission is not applied retroactively merely because this text changes. Where consent or another authorization is needed, we obtain it before the changed activity begins.

14. Registration and Authorisation

Company name: Asseta Ltd.

Registered number: 2149294.

Address: Mandar House, 3rd Floor, Johnson’s Ghut, Tortola, British Virgin Islands.

15. How to Contact Us

For a question about Personal Information, a rights request, a security concern or a complaint about this Privacy Policy, contact our privacy team.

Email: [email protected]

Postal address: Mandar House, 3rd Floor, Johnson’s Ghut, Tortola, British Virgin Islands.