This Data Safety and Processing Disclosure (the “Disclosure”) describes how Kohle Capital Markets Limited (the “Company”, “we”, “us”, or “our”) collects, uses, stores, and protects data in connection with digital services operated under the KCM Trade brand (the “Services”).
This Disclosure is intended to support transparency and compliance with applicable data protection laws, regulatory requirements, and platform governance standards, including those applicable to mobile application distribution platforms.
1. Scope of Application
This Disclosure applies to all mobile applications, web applications, websites, software development kits (SDKs), application programming interfaces (APIs), and related digital services operated or distributed by the Company under the KCM Trade brand.
2. Categories of Data Collected
Depending on the nature of the Services and user interaction, the Company may collect and process the following categories of data:
2.1 Personal and Account Information
- Name, date of birth, nationality, and contact details
- Residential address and identification information
- Account credentials and verification status
2.2 Financial and Transactional Data
- Account balances and transaction records
- Deposit and withdrawal information
- Trading and activity history
2.3 Technical and Usage Data
- Device identifiers and operating system information
- IP address and network information
- Application usage, performance, and diagnostic data
- Mobile attribution identifiers and app install source data
- Push notification tokens and device registration identifiers
- In-app conversion event and campaign attribution data
- Device permission states, including camera, location, biometric authentication, and notification access
- Website and web application analytics data, including page views, session events, and interaction data, collected via Google Analytics 4 and Google Tag Manager
- Advertising conversion and remarketing data collected via the Meta (Facebook) Pixel on the Company’s website and client portal
- Anonymised website performance metrics collected via Cloudflare Web Analytics
2.4 Verification and Compliance Data
- Identity verification documentation
- Source of funds or source of wealth information
- Compliance assessments and audit records
3. Purpose of Data Processing
Data is collected and processed for the following purposes:
- Provision, operation, and maintenance of the Services
- Identity verification, fraud prevention, and compliance with AML and KYC obligations
- Transaction processing and account management
- Security monitoring and risk management
- Legal and regulatory compliance
- Service improvement and technical optimisation
- Website and application analytics to understand usage patterns and improve user experience
- Marketing analytics and advertising effectiveness measurement, including conversion tracking via third-party analytics and advertising platforms
4. Data Sharing and Disclosure
The Company may share data with:
- Affiliated entities within the corporate group
- Third-party service providers acting on the Company’s instructions
- Technology, hosting, analytics, messaging, and verification providers
- Regulatory authorities, law enforcement, or other parties where required by law
Data is shared only to the extent necessary and subject to contractual and legal safeguards.
5. Third-Party Sub-Processors
The Company engages the following categories of third-party service providers in connection with the operation of the Services. Each provider processes data only as necessary to deliver the relevant service, under contractual obligations consistent with applicable data protection requirements.
| Provider | Role | Website |
|---|---|---|
| FX Back Office (FXBO) | Client relationship management (CRM), account administration, and back-office operations | fxbackoffice.com |
| ShuftiPro | Identity verification, KYC document review, biometric checks, and AML screening | shuftipro.com |
| Pelican Exchange Limited | Copy trading infrastructure and trade replication services (copy-trade.io platform) | copy-trade.io |
| Acuity Trading | Market signals (Signal Centre), market sentiment, economic calendar data, analysis tools, and financial education content delivery | acuitytrading.com |
| Financial Modeling Prep (FMP) | Financial market news and market data aggregation for in-application news and market-data features | financialmodelingprep.com |
| OpenRouter | AI model gateway and routing for AI-assisted informational features. Transmits prompt data — which, for account-aware features, may include trading account data (balance, equity, open positions, profit/loss, and trade history) — to the underlying AI model provider servicing the request | openrouter.ai |
| MetaQuotes (MT4 / MT5) | Trading platform infrastructure and order execution environment | metaquotes.net |
| Leverate | Trading platform technology and liquidity infrastructure | leverate.com |
| Convrs.io | Live support chat and in-app messaging | convrs.io |
| Webflow | Website hosting and content delivery | webflow.com |
| Cloudflare | DNS management, DDoS protection, CDN services, and anonymised web analytics (Cloudflare Web Analytics beacon) | cloudflare.com |
| AppsFlyer | Mobile attribution, in-app conversion event analytics, install tracking, and deep link routing | appsflyer.com |
| OneSignal | Push notification delivery across iOS, Android, Huawei AppGallery, and Web PWA | onesignal.com |
| Firebase (Google) | Firebase Cloud Messaging (FCM) for push notification delivery; app instance analytics | firebase.google.com |
| SendGrid (Twilio) | Transactional email delivery — OTP verification codes for registration and email changes | sendgrid.com |
| Amazon Web Services (SES) | Transactional email delivery — SMTP fallback for OTP delivery | aws.amazon.com |
| Google Maps Platform | Address geocoding and residential address verification during KYC form completion | cloud.google.com/maps-platform |
| Google Sign-In | Social authentication option during new account registration | accounts.google.com |
| Apple Sign-In | Social authentication option during new account registration (iOS only) | appleid.apple.com |
| Microsoft (Azure AD / MSAL) | Social authentication option during new account registration | microsoft.com |
| Localizely | Over-the-air delivery of translated app UI strings to end-user devices | localizely.com |
| Google Analytics 4 / Google Tag Manager | Website and client portal analytics — session data, page views, and interaction events. Google Tag Manager serves as a container for deploying and managing analytics and marketing tags. | analytics.google.com |
| Meta (Facebook) Pixel | Advertising conversion tracking and marketing analytics on the Company’s website and client portal, operated by Meta Platforms, Inc. | facebook.com/business/ads |
The list above reflects current principal sub-processors and may be updated from time to time. Users may request a current list by contacting the Company.
6. Data Security Measures
The Company implements reasonable technical and organisational measures designed to protect data against unauthorised access, alteration, disclosure, or destruction.
Such measures may include, without limitation:
- Encryption in transit and at rest, where appropriate
- Access controls and authentication mechanisms
- Monitoring and logging of system activity
- Regular review of security practices
7. Data Retention
Data is retained only for as long as necessary to fulfil the purposes described in this Disclosure or to comply with applicable legal, regulatory, or contractual obligations.
Retention periods may vary depending on the type of data and applicable requirements.
8. User Rights and Controls
Subject to applicable laws, users may have rights in relation to their personal data, including the right to request access, correction, or deletion.
Requests may be subject to legal, regulatory, or compliance limitations and verification of identity.
9. Cross-Border Data Transfers
Data may be processed or stored in jurisdictions other than the user’s country of residence, subject to appropriate safeguards and in compliance with applicable data protection laws.
10. Platform-Specific Disclosures
This Disclosure is intended to align with platform-specific data disclosure frameworks, including but not limited to:
- Google Play Data Safety requirements
- Apple App Privacy disclosures
- Huawei AppGallery app compliance requirements
The information provided herein is intended to be consistent with declarations made to such platforms.
11. Amendments
The Company may amend this Disclosure from time to time to reflect changes in:
- Applicable laws or regulations
- Platform governance or disclosure requirements
- Technology, security practices, or business operations
Any amendments shall take effect upon publication, as indicated by the updated Last Updated date.
12. Contact Information
For enquiries relating to data safety or data processing practices, please contact:
Kohle Capital Markets Limited
Email: CS@kcmtrade.com
Website: https://www.kcmtrade.com
This Disclosure forms part of the Company’s legal and compliance documentation and should be read in conjunction with the Company’s Privacy Policy and other applicable disclosures.