Privacy Policy and Cookies

Last update: 05/08/2026

1. Introduction

1.1 Spotware Systems Ltd, a limited liability company incorporated in the Republic of Cyprus, with registration number HE 301668, whose registered address is situated at 78 Spyrou Kyprianou, Magnum House, 3rd Floor, 3076 Limassol, Cyprus (“Spotware” or “we”), is the owner of the website: www.spotware.com (the “Website”) and the provider of the cTrader Platform (the “Platform”).

1.2 Spotware collects and processes certain personal data through its Website and its products relating to users (“you” or “user”) in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation or “GDPR”) and other applicable data protection legislation.

1.3 The purpose of this Privacy Policy (the “Policy”) is to explain how Spotware processes personal data, the categories of personal data processed, the purposes and legal bases for processing, the recipients of personal data, the applicable retention periods and the rights available to data subjects under applicable data protection legislation.

1.4 In this Policy, “Personal Data” means any information relating to an identified or identifiable natural person (“data subject”), directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.

1.5 The Policy applies to the processing of Personal Data collected through the Website, the Platform and related services and governs the different manners in which individuals may interact with Spotware, including:

i. Brokers and/or proprietary trading firms (existing or prospective) communicating with Spotware in the context of being onboarded on the Platform;

ii. Traders opening or using demo accounts provided directly by Spotware;

iii. Traders accessing or using the Platform through a broker or proprietary trading firm;

iv. Visitors of the Website; and

v. Any other individuals whose Personal Data are processed by Spotware in connection with its products, services or business operations.

1.6 Spotware acts as the Data Controller where it determines the purposes and means of processing Personal Data. This includes, for example, Personal Data processed in connection with:

i. Visitors of the Website;

ii. Demo accounts provided directly by Spotware;

iii. The administration, operation, maintenance, security and improvement of Spotware’s own products and services;

iv. Marketing communications, events, recruitment and other business activities carried out directly by Spotware.

1.7 Where Spotware acts as the Data Controller, it is responsible for ensuring that the processing of Personal Data complies with the GDPR and other applicable data protection legislation.

1.8 Where a trader accesses or uses the Platform through a broker or proprietary trading firm which is a client of Spotware (the “Client”), the Client generally determines the purposes and means of processing the trader’s Personal Data in connection with the provision of brokerage and trading services. In such circumstances, the Client acts as the Data Controller, while Spotware acts as the Data Processor, processing Personal Data in accordance with Article 28 GDPR and the applicable contractual arrangements between Spotware and the Client.

1.9 As a Data Processor, Spotware processes Personal Data only to the extent necessary to provide, maintain, secure and support the Platform and related services. Data subject rights relating to such processing should generally be exercised through the relevant Client, although Spotware will provide reasonable assistance to Clients in fulfilling their obligations under applicable data protection legislation.

1.10 Where Spotware acts as a Data Processor, the Client’s Privacy Policy shall govern the Client’s collection and use of Personal Data, while this Policy explains how Spotware processes such Personal Data in connection with the provision of the Platform and related services to the Client.

1.11 This Policy supplements the terms and conditions which govern access to, and use of, the Website and which you accept by using it, as well as other terms and conditions you accept for specific services (the “Terms”).

1.12 Data subjects whose Personal Data is processed in accordance with this Policy acknowledge that they have reviewed and understood its terms and conditions regarding the scope and nature of such processing activities.

2. Modification of the Policy

2.1 The Policy can be modified at any time. The current version is the one available on the Website. In the event of a significant change to the Policy, we will inform you within a reasonable period of time (by email or by banner (“push”) on the Website).

3. Collection of Personal Data

3.1 Spotware collects Personal Data directly from you when you:

i. Interact with the Website;

ii. Use a demo account provided directly by Spotware;

iii. Contact us and request information about our products or services.

3.2 Where Spotware acts as a Data Processor, Spotware also processes Personal Data received from or on behalf of the relevant Client in accordance with the applicable contractual arrangements between Spotware and the Client, and in line with the privacy policies of the respective Clients.

3.3 Where Personal Data are collected through the Website, any mandatory information required to be provided will be identified at the time of collection (for example, by an asterisk). Failure to provide mandatory information may prevent Spotware from providing certain products or services.

3.4 Depending on your relationship with Spotware and the services you use, we may collect and process the following categories of Personal Data:

i. Information relating to your identity and account creation, including your full name, username, email address, telephone number, password, date of birth or confirmation of majority, profile picture and other account-related information;

ii. Information relating to your device, Platform account and activity, including IP address, session information, browser information, language preferences, device identifiers, cookies, content and URLs you connect to;

iii. Information relating to your communications with Spotware or other users, including messages, comments, enquiries, complaints and related correspondence;

iv. Information processed by Spotware in its capacity as a Data Processor pursuant to its contractual arrangements with a Client in connection with the provision of the Platform, in line with the privacy policies of the respective Clients;

v. Technical, operational and performance information relating to the operation, security, maintenance and improvement of the Platform.

4. Processing Based on Contractual Necessity

4.1 Where Spotware acts as a Data Processor, the lawful basis for processing is determined by the relevant Client in its capacity as the Data Controller. The following sections explain the lawful bases relied upon by Spotware where it acts as a Data Controller.

4.2 Spotware may process Personal Data where necessary to take steps prior to entering into a contract or to perform its contractual obligations towards the relevant data subject in accordance with Article 6(1)(b) GDPR.

4.3 We process your Personal Data in order to:

i. Allow you to create an account on the Website;

ii. Help you manage your account;

iii. Enable you to enter into contracts with us;

iv. Provide you with our services;

v. Notify you of any event related to your account, from its creation to its deletion, by email and notifications;

vi. Notify you when we update our End-user Licence Agreement, the Policy and more generally, our services and features by email and notifications;

vii. Notify you when we have detected a problem that is blocking or may block your use of the Website by email and notifications;

viii. Answer your questions, requests and complaints addressed to the support team by email and notifications.

5. Processing Based on a Legitimate Interest

5.1 Spotware may also process Personal Data where such processing is necessary for the purposes of its legitimate interests, provided that those interests are not overridden by the interests or fundamental rights and freedoms of the data subject, in accordance with Article 6(1)(f) GDPR.

5.2 In order to legally base a processing operation on legitimate interest, three cumulative conditions must be met:

i. The interest pursued must be legitimate (i.e. lawful, clearly and precisely determined, real and present);

ii. The processing carried out must be necessary; and

iii. The processing must not adversely affect the rights and interests of data subjects.

5.3 For your information, we detail below the processing operations carried out on the basis of the legitimate interests pursued by Spotware. We process your Personal Data in order to:

i. Give you advice by email and notifications;

ii. Present you, by email and notifications, with content, products and information that may be of interest to you based on the content you view, in order to improve and personalise your experience of the Website and our services;

iii. Offer you the opportunity, by email and notifications, to participate in surveys (e.g. satisfaction, opinion, poll, etc.) to collect feedback and improve the Website and our services. Participation is entirely voluntary, and any responses you provide are processed on the basis of your consent;

iv. Allow other users to have access to certain information about you (username, date of registration) to promote trust and transparency among users;

v. Implement detection measures to fight against fraud and ask you to perform security checks on your account;

vi. Access and moderate content, messages and conversations to maintain the security and integrity of the Platform, ensure compliance with our Terms and detect illegal, unsolicited or malicious content;

vii. Perform marketing statistics and analysis in order to:

a. Understand how you use the Website and our services;

b. Improve our Website and our service because we have a legitimate interest in seeking the best possible user experience and improving our Website, services and features and in personalising the experience for everyone;

viii. Train our support team and improve our support services by reviewing communications you have with our team to ensure a high standard of service.

6. Processing Where Consent Is Required

6.1 Spotware may also rely on consent as the lawful basis for processing, for example for marketing purposes. In this context, where processing is carried out on another lawful basis, including the performance of a contract, compliance with a legal obligation or legitimate interests, Spotware does not rely on consent.

6.2 We process your Personal Data following your consent in order to:

i. Subscribe you to our newsletters. You can deactivate them at any time through the link provided in the newsletters or directly from your account;

ii. Send you the product alerts you have set up from your account. You can deactivate your alerts directly from your account;

iii. Customise the ads that appear on third-party sites so that you are not exposed to ads that are not relevant to you. You can disable them by changing your cookie settings (see the “Cookies” section of the Policy);

iv. Analyse the answers you agree to share with us when you respond to our surveys (satisfaction, poll, feature testing, etc.);

v. Share your strictly necessary data with our partner brands when you agree to participate in operations. In this case, you will be given information specific to the operations and partner brands.

7. Retention of Personal Data

7.1 We retain your Personal Data for the strict period of time necessary to fulfil the purpose of the processing concerned. Thus, the data:

i. Associated with your account is retained as long as you maintain your account and until your account is deleted;

ii. Relating to the sending of newsletters and alerts is kept as long as you do not withdraw your consent by unsubscribing;

iii. Collected in the context of specific contracts is kept for the duration they remain active and is then archived for the strict legal retention periods applicable;

iv. Related to the management of complaints, disputes and litigation are kept for the duration necessary to resolve the dispute and for the duration specified in any applicable law;

v. The answers to surveys are kept for the time necessary for the survey and are then anonymised if they were not already;

vi. Related to online applications is kept for two (2) years and then deleted.

7.2 In some cases, we may retain certain Personal Data about you even if you delete your account, by legal obligation, or if we have an overriding legitimate interest in retaining some of your data.

8. Use of Third-Party Service Providers and Sub-processors

8.1 Spotware may engage third-party service providers that process Personal Data in connection with the provision, operation, maintenance and security of the Website, the Platform and related services. Where Spotware acts as a Data Processor, such service providers may be appointed as sub-processors in accordance with the applicable contractual arrangements between Spotware and the relevant Client. Spotware takes all reasonable measures to ensure that any third-party service provider processing Personal Data is subject to appropriate contractual obligations consistent with applicable data protection legislation and that their appointment complies with the requirements of Article 28 GDPR.

9. Security Measures

9.1 Spotware is committed to implementing and maintaining appropriate technical and organisational measures designed to ensure a level of security appropriate to the risks associated with the processing of Personal Data, in accordance with Articles 32 to 34 GDPR.

9.2 Spotware also requires its service providers and sub-processors to implement appropriate technical and organisational measures to safeguard Personal Data in accordance with applicable data protection legislation.

10. Cookies

10.1 Spotware uses internet cookies to facilitate navigation throughout the Website and to enhance the visitor’s experience. Your internet browser is likely to accept these cookies by default. However, you can refer to your browser’s help guide if you would like to reject or delete them from your system.

10.2 We may use both “analytic” cookies and “social” cookies on the Website. Cookies used by Spotware do not retrieve any personal information or any information from the visitor’s device.

11. Contact and Data Subject Rights

11.1 If you have any questions regarding this Policy or the processing of your Personal Data, please contact Spotware’s Data Protection Officer at: dpo@spotware.com.

11.2 Individuals whose data are processed have defined rights under the GDPR. Specifically, GDPR requires Data Controllers and Data Processors to implement the necessary processes and mechanisms in support of data subjects exercising the following rights, the exact definitions of which have the meanings assigned to them by the GDPR:

i. Right to information as to the Personal Data processing being performed and the rationale of such processing;

ii. Right to access to the Personal Data being processed about them;

iii. Right to rectification allowing individuals to request the correction or amendment of their data;

iv. Right to object to a specific type of processing, under specific circumstances;

v. Right to object to automated processing or profiling in cases where automated processing results in decisions that, in the opinion of the affected data subject, do not adequately reflect the unique characteristics of the case involved;

vi. Right to withdraw consent allowing a data subject under specific circumstances to give notice and withdraw a previously given consent for a specific type of processing;

vii. Right to data portability allowing the transfer of Personal Data processed by a Data Controller to the data subject or directly to another Data Controller in electronic, machine-readable format;

viii. Right of erasure (“right to be forgotten”) entitling a data subject, under certain circumstances, to request the deletion of their Personal Data.

11.3 To exercise any of your above rights, it is important that you submit your request to Spotware’s Data Protection Officer at dpo@spotware.com. In doing so, please state which of the above right(s) you seek to exercise and your contact details so that simple identity verification processes can be concluded, ahead of responding to your request. Please be informed that the successful completion of the identity verification process is an essential step and condition for your request to be processed.

11.4 Where Spotware acts in its capacity as a Data Processor pursuant to its contractual arrangements with a Client, requests relating to the exercise of data subject rights should generally be addressed to the relevant Client acting as the Data Controller. Spotware will provide reasonable assistance to the relevant Client in responding to such requests where required by applicable law.