This Privacy Policy (the “Policy”) describes how Kohle Capital Markets Limited (the “Company”, “we”, “us”, or “our”) collects, uses, stores, discloses, and protects personal data in connection with digital services operated under the KCM Trade brand (the “Services”).
This Policy applies to all mobile applications, web applications, websites, application programming interfaces (APIs), software development kits (SDKs), and related digital platforms operated or distributed by the Company. It should be read together with the Company’s Terms of Service, AML and KYC Policy, Cookie Policy, and other applicable disclosures.
1. Purpose and Scope
The purpose of this Policy is to inform users of the manner in which personal data is processed and the rights available to individuals under applicable data protection laws.
This Policy applies to all users who access or use the Services, whether as registered account holders or visitors, subject to applicable legal and regulatory requirements.
2. Categories of Personal Data Collected
Depending on the nature of the Services and user interaction, the Company may collect and process the following categories of personal data:
2.1 Identification and Contact Information
- Full legal name
- Date of birth
- Nationality and country of residence
- Email address, telephone number, and other contact details
2.2 Account and Verification Information
- Login credentials and account identifiers
- Identity verification documentation
- Proof of address and verification status
2.3 Financial and Transactional Information
- Deposit and withdrawal records
- Trading activity and transaction history
- Account balances and related financial data
2.4 Technical and Usage Information
- Device identifiers, operating system, and application version data
- IP address and network information
- Log files, usage metrics, and diagnostic data
- Mobile attribution identifiers and app install source data (via AppsFlyer SDK)
- Push notification tokens and device registration identifiers (via OneSignal and Firebase Cloud Messaging)
- In-app conversion event and campaign attribution data
- Device permission states, including camera, location, biometric authentication, and notification access
- Website and web application analytics data, including page views, session duration, and interaction events, collected via Google Analytics 4 and Google Tag Manager
- Advertising effectiveness and conversion data collected via the Meta (Facebook) Pixel on the Company’s web and client portal properties
- Cloudflare Web Analytics data, including anonymised page view metrics and performance indicators
2.5 Compliance and Risk Management Information
- Source of funds or source of wealth information
- AML, KYC, and sanctions screening results
- Internal risk assessments and audit records
3. Purposes of Processing
Personal data is processed for one or more of the following purposes:
- Provision, operation, and administration of the Services
- Account creation, authentication, and user management
- Identity verification, fraud prevention, and financial crime compliance
- Processing of transactions and execution of user instructions
- Security monitoring and system integrity
- Compliance with legal, regulatory, and contractual obligations
- Improvement and optimisation of the Services
- Website and application analytics to understand usage patterns and improve user experience
- Marketing analytics and advertising effectiveness measurement, including conversion tracking via third-party analytics and advertising platforms
4. Legal Bases for Processing
Personal data is processed in accordance with applicable data protection laws on one or more of the following legal bases:
- Performance of a contract or steps taken at the user’s request
- Compliance with legal or regulatory obligations
- Legitimate interests of the Company, including security and risk management
- User consent, where required by applicable law
5. Data Sharing and Disclosure
The Company may disclose personal data to:
- Affiliated entities within the Company’s corporate group
- Third-party service providers acting on the Company’s instructions
- Technology, hosting, analytics, messaging, payment, and verification providers
- Professional advisers, auditors, or consultants
- Regulatory authorities, law enforcement agencies, or courts where required by law
All disclosures are subject to appropriate contractual, technical, and organisational safeguards.
5.1 Named Third-Party Service Providers
The Company currently engages the following principal third-party service providers in connection with the delivery of the Services:
| Provider | Function |
|---|---|
| FX Back Office (FXBO) | CRM, account administration, and back-office operations |
| ShuftiPro | Identity verification, KYC document processing, biometric verification, and AML screening |
| Pelican Exchange Limited | Copy trading infrastructure and trade replication (copy-trade.io) |
| Acuity Trading | Market signals, market sentiment, economic calendar data, analysis tools, and financial education content. Signals presented in the application (via the Signal Centre) are generated by Acuity Trading, not by the Company. |
| Financial Modeling Prep (FMP) | Financial market news and market data aggregation for in-application news and market-data features |
| OpenRouter | AI model gateway and routing layer for AI-assisted informational features (including educational assistant, pre-trade check, and position review). Where a user invokes an AI feature that references account context, the relevant prompt data — which may include trading account data such as balance, equity, open positions, profit/loss, and trade history — is transmitted to OpenRouter and to the underlying AI model provider that services the request, in each case acting as a sub-processor. |
| MetaQuotes (MT4 / MT5) | Trading platform and order execution environment |
| Leverate | Trading platform technology and liquidity infrastructure |
| Convrs.io | Live chat and in-app client support |
| Webflow | Website hosting and content management |
| Cloudflare | DNS, CDN, and network security infrastructure |
| AppsFlyer | Mobile attribution, in-app conversion event analytics, install tracking, and deep link routing |
| OneSignal | Push notification delivery across iOS, Android, Huawei AppGallery, and Web PWA |
| Firebase (Google) | Firebase Cloud Messaging (FCM) for push notification delivery; app instance analytics |
| SendGrid (Twilio) | Transactional email delivery — OTP verification codes for registration and email changes |
| Amazon Web Services (SES) | Transactional email delivery — SMTP fallback for OTP delivery |
| Google Maps Platform | Address geocoding and residential address verification during KYC form completion |
| Google Sign-In | Social authentication option during new account registration |
| Apple Sign-In | Social authentication option during new account registration (iOS only) |
| Microsoft (Azure AD / MSAL) | Social authentication option during new account registration |
| Localizely | Over-the-air delivery of translated app UI strings to end-user devices |
| Google Analytics 4 / Google Tag Manager | Website and client portal analytics — session data, page views, interaction events, and conversion tracking. Google Tag Manager also serves as a container for deploying and managing additional analytics and marketing tags. |
| Meta (Facebook) Pixel | Advertising conversion tracking and marketing analytics on the Company’s website and client portal. The Meta Pixel may collect browsing and interaction data from both unauthenticated and authenticated sessions and transmit it to Meta Platforms, Inc. pursuant to Meta’s data processing terms. |
| Cloudflare Web Analytics | Anonymised website performance and page view analytics, collected via the Cloudflare Beacon script. Operates separately from Cloudflare’s DNS and CDN functions. |
Each provider is engaged under contractual terms that restrict processing to the purposes for which data is shared.
6. Cross-Border Data Transfers
Personal data may be processed or stored in jurisdictions outside the user’s country of residence.
Where cross-border transfers occur, the Company implements appropriate safeguards in accordance with applicable data protection laws, including the Data Protection Act 2017 of Mauritius where applicable. Such safeguards may include transferring personal data to jurisdictions recognised as providing an adequate level of protection, or putting in place contractual protections (such as standard contractual clauses) with the recipient that require it to protect the data to a standard consistent with this Policy.
7. Data Security
The Company implements reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.
Such measures may include access controls, encryption, monitoring, and regular review of security practices. However, no system can be guaranteed to be completely secure.
In the event of a personal data breach that is likely to result in a risk to the rights and interests of affected individuals, the Company will notify the relevant supervisory authority and, where required by applicable law, the affected individuals without undue delay after becoming aware of the breach.
8. Data Retention
Personal data is retained only for as long as necessary to fulfil the purposes described in this Policy or to comply with applicable legal, regulatory, or contractual obligations.
Retention periods vary depending on the nature of the data and applicable requirements. In particular, identity verification, transaction, and account records that the Company is required to keep under applicable anti-money-laundering and financial-services legislation are retained for the minimum periods prescribed by that legislation — generally not less than seven (7) years following the end of the client relationship or the completion of the relevant transaction — after which personal data is deleted or anonymised unless a longer period is required by law or is necessary for the establishment, exercise, or defence of legal claims.
9. User Rights
Subject to applicable laws, users may have rights in relation to their personal data, including the right to request access, correction, or deletion, and the right to object to or restrict certain processing activities.
Requests may be subject to identity verification and legal or regulatory limitations.
10. Cookies and Similar Technologies
The Company uses cookies and similar technologies in accordance with its Cookie Policy, which forms part of this Policy by reference.
11. Platform-Specific Disclosures
This Policy is intended to align with platform-specific privacy disclosure requirements, including those applicable to:
- Google Play Store
- Apple App Store
- Huawei AppGallery
- Other mobile application distribution platforms
Declarations made to such platforms are intended to be consistent with this Policy.
12. Amendments
The Company may amend this Policy from time to time to reflect changes in laws, regulations, regulatory guidance, technology, or business practices.
Any amendments shall take effect upon publication, as indicated by the updated Last Updated date.
13. Contact Information
For questions or requests relating to this Privacy Policy or personal data processing, please contact:
Kohle Capital Markets Limited
Email: CS@kcmtrade.com
Website: https://www.kcmtrade.com
By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.