1. Purpose and Scope
CXM Direct LLC (the "Firm", "we", "our" or "us") is committed to protecting the privacy, confidentiality and security of the personal information entrusted to us by our clients, prospective clients, website visitors and other individuals with whom we interact.
This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal information when you access our website, apply for an account, use our products or services, communicate with us, or otherwise interact with the Firm.
The Firm recognises the importance of protecting personal information and is committed to processing such information fairly, lawfully, transparently and securely in accordance with applicable legal and regulatory requirements.
By accessing our website or using our products and services, you acknowledge that you have read and understood this Privacy Policy.
2. Who We Are
CXM Direct LLC is a Saint Vincent and the Grenadines incorporated entity with company number 444LLC2020 registered with the Financial Services Authority.
For the purposes of this Privacy Policy, the Firm determines the purposes and means by which personal information is processed in connection with the products and services it provides.
If you have any questions regarding this Privacy Policy or the processing of your personal information, you may contact the Firm using the contact details set out at the end of this Policy.
For the purposes of this Privacy Policy, the Firm is responsible for determining the purposes and means by which personal information is collected, used, stored, disclosed and otherwise processed in connection with its products and services.
3. Personal Information We Collect
The Firm collects and processes personal information that is reasonably necessary for the establishment, administration and maintenance of its relationship with clients, the provision of its products and services, compliance with applicable legal and regulatory obligations, and the protection of its legitimate business interests.
Depending on the nature of your relationship with the Firm, we may collect the following categories of personal information:
Identification Information
This may include your name, date of birth, nationality, residential address, identification documents, passport details, government-issued identification numbers, photographs and other information required to verify your identity.
Contact Information
This may include your residential and correspondence addresses, telephone numbers, email addresses and other contact details.
Financial Information
This may include information relating to your bank accounts, payment methods, sources of funds and wealth, employment, occupation, income, financial circumstances and trading experience, where required for regulatory or operational purposes.
Account Information
This may include account numbers, usernames, passwords, account preferences, authentication credentials, security questions and other information necessary to establish and manage your trading account.
Transaction Information
This includes records of deposits, withdrawals, transfers, executed transactions, open positions, trading activity, account balances, communications relating to transactions and other information generated through your use of the Firm's services.
Technical Information
When you access our website or trading platforms, we may automatically collect certain technical information, including your IP address, browser type, operating system, device identifiers, connection information, login activity, platform usage data and other information related to your interaction with our systems.
Communications
We maintain records of communications between you and the Firm, including emails, telephone calls, video conferences, live chat conversations, support requests, complaints and other correspondence, where permitted or required by applicable law. Such communications may be monitored or recorded for quality assurance, training, security, dispute resolution and regulatory compliance.
The categories of personal information collected may vary depending on the products or services you use and the legal or regulatory obligations applicable to your account.
Google User Data
Where you choose to connect your Google account or use a Firm application or service that integrates with Google services, the Firm may receive certain information made available through the relevant Google service and the permissions you authorise.
Depending on the Google service and permissions you authorise, the application may access your Google account name, email address, Google account identifier and, where specifically required for the functionality you request, other Google account or profile information made available through the authorised Google API scopes
The Firm will use such information to establish and administer your account, provide and maintain the relevant services, communicate with you regarding your account or use of the services, maintain the security and integrity of its systems, and for other purposes described in Section 5 of this Privacy Policy, where applicable.
The Firm will not sell this user data. User data will not be used for targeted or personalised advertising or disclosed to data brokers or information resellers.
Where user data is disclosed to a service provider, the disclosure will be limited to what is reasonably necessary for that service provider to perform services on behalf of the Firm, including technology, cloud hosting, cybersecurity, communications, analytics or other services described in Section 7 of this Privacy Policy. Such service providers shall be subject to appropriate confidentiality and security requirements.
User data will be protected in accordance with the security measures described in Section 9 of this Privacy Policy and retained in accordance with Section 10. Where such information is no longer required, and there is no legal or regulatory requirement to retain it, the Firm will take reasonable steps to delete or otherwise dispose of it securely.
4. How We Collect Personal Information
The Firm collects personal information from a variety of sources to enable it to provide services efficiently, meet its legal and regulatory obligations and maintain the security and integrity of its business.
Information Provided Directly by You
Most personal information is collected directly from you when you:
- apply for or open an account;
- complete application forms or questionnaires;
- submit identity verification documents;
- communicate with the Firm;
- use the Trading Service;
- make deposits or withdrawals;
- participate in promotions or surveys; or
- otherwise interact with the Firm.
You are responsible for ensuring that the information you provide is accurate, complete and kept up to date throughout your relationship with the Firm.
Information Collected Automatically
When you access our website, client portal or trading platforms, certain information may be collected automatically through cookies, server logs and similar technologies. This information helps us maintain the security of our systems, improve the performance of our services and better understand how our website and platforms are used.
Further information regarding our use of cookies is set out in Section 12 of this Privacy Policy.
Information Obtained from Third Parties
Where permitted by applicable law, the Firm may obtain personal information from third parties, including:
- identity verification providers;
- sanctions and politically exposed person (PEP) screening providers;
- fraud prevention agencies;
- financial institutions and payment service providers;
- publicly available sources;
- regulatory authorities;
- business partners; and
- other organisations where reasonably necessary to comply with legal or regulatory obligations or to provide our services.
The Firm takes reasonable steps to ensure that personal information obtained from third parties is processed in accordance with applicable legal requirements.
5. How we Use Collected Personal Information
The Firm processes personal information only where it is reasonably necessary for the provision of its products and services, the management of its relationship with clients, compliance with applicable legal and regulatory obligations, and the protection of its legitimate business interests.
Depending on the nature of your relationship with the Firm, we may use your personal information to:
- establish and administer your trading account;
- verify your identity and conduct customer due diligence and ongoing monitoring;
- comply with applicable anti-money laundering, counter-terrorist financing, sanctions screening and other financial crime prevention requirements;
- process deposits, withdrawals, transfers and other payment transactions;
- execute, settle and administer trading transactions;
- provide access to the Online Trading Service and other products and services;
- communicate with you regarding your account, transactions or enquiries;
- respond to complaints, requests and support enquiries;
- maintain the security and integrity of our systems, website and trading platforms;
- monitor trading activity for fraud prevention, market abuse detection, risk management and compliance purposes;
- improve, develop and enhance our products, services and technology;
- conduct internal audits, quality assurance, business continuity planning and operational risk management;
- comply with court orders, regulatory requests or other legal obligations; and
- exercise or defend the Firm's legal rights where necessary.
The purposes for which personal information is processed are not exhaustive and may evolve as the Firm develops its products and services or as legal and regulatory requirements change.
Where personal information constitutes Google user data accessed through a Google API or Google-authorised integration, the Firm will use such data only for purposes necessary to provide or improve the user-facing functionality of the application or services requested by the user, or as otherwise expressly permitted by applicable law and Google's applicable policies.
6. Legal Basis for Processing Personal Information
The Firm processes personal information only where there is an appropriate legal or regulatory basis.
Depending on the circumstances, personal information may be processed where:
- processing is necessary to enter into or perform a contract with you;
- processing is necessary to comply with applicable legal or regulatory obligations;
- processing is necessary to protect the legitimate interests of the Firm or a third party, provided those interests are not overridden by your rights and freedoms; or
- you have provided your consent where consent is required by applicable law.
The Firm may use automated systems to assist in identity verification, sanctions screening, fraud detection, transaction monitoring, account security and risk management. Such systems are used to support the Firm's legal and regulatory obligations and operational processes and, where appropriate, are subject to human oversight.
The Firm may also process personal information for any other purpose that is compatible with the purposes described in this Privacy Policy or otherwise permitted or required by applicable law.
Where processing is based on your consent, you may withdraw that consent at any time, subject to any legal, regulatory or contractual obligations that require the Firm to continue processing certain information. The withdrawal of consent will not affect the lawfulness of any processing carried out before the withdrawal.
7. Disclosure of Personal Information
The Firm treats your personal information confidentially and does not sell personal information to third parties. The Firm may disclose personal information, including Google user data where applicable, only where reasonably necessary to provide or improve its products and services, operate and secure its systems, comply with applicable legal or regulatory obligations, or for the other purposes expressly described in this Privacy Policy and permitted by applicable law and Google's applicable policies.
Nothing in this Privacy Policy prevents the Firm from collecting, using or disclosing personal information where required or permitted by applicable law, regulatory requirements, court orders or lawful requests from competent authorities.
Where necessary, Personal information may be disclosed to:
Service Providers
The Firm engages carefully selected third-party service providers to support the delivery of its products and services. These providers may include providers of:
- trading platforms;
- cloud hosting and information technology services;
- identity verification services;
- sanctions and AML screening;
- payment processing;
- banking services;
- customer support;
- communications infrastructure;
- cybersecurity services;
- data storage;
- analytics; and
- professional advisory services.
Such providers are required to maintain appropriate confidentiality and security measures and may process personal information only for the purposes authorised by the Firm.
Regulatory Authorities
The Firm may disclose personal information as reasonably required to comply with applicable legal or regulatory obligations or to meet lawful requests from competent authorities.
Financial Crime Prevention
Personal information may be shared with financial institutions, fraud prevention agencies, sanctions screening providers, credit reference agencies and other organisations where reasonably necessary to prevent fraud, money laundering, terrorist financing, sanctions breaches or other financial crime.
Business Transfers
Where the Firm undergoes a merger, acquisition, corporate restructuring, sale of assets or other business reorganisation, personal information may be disclosed to prospective purchasers, investors, advisers or successor entities, subject to appropriate confidentiality obligations.
8. International Transfer of Personal Information
The Firm operates internationally and may transfer personal information to service providers, affiliates or other organisations located outside Saint Vincent and the Grenadines where reasonably necessary for the provision of its products and services or the operation of its business.
Where personal information is transferred internationally, the Firm takes reasonable steps to ensure that appropriate safeguards are implemented to protect the information and that the receiving party maintains standards of confidentiality and security that are substantially equivalent to those applied by the Firm.
By establishing an account with the Firm or using its products and services, you acknowledge that your personal information may be transferred, stored or processed in jurisdictions outside your country of residence where this is reasonably necessary for the purposes described in this Privacy Policy.
Such transfers may occur where the Firm's service providers, technology infrastructure, affiliated companies or business operations are located in other jurisdictions.
The Firm takes reasonable steps to ensure that recipients of personal information maintain appropriate standards of confidentiality, security and data protection consistent with this Privacy Policy and applicable legal requirements.
Where Google user data is transferred internationally, such transfer will be limited to what is reasonably necessary to provide or improve the relevant application functionality, operate or secure the relevant services, or comply with applicable legal or regulatory requirements, and will be subject to appropriate confidentiality, security and data protection safeguards.
9. Data Security
The Firm maintains appropriate administrative, technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
These measures include, where appropriate:
- encryption of sensitive information;
- secure communication protocols;
- firewalls and network monitoring;
- access controls based on business need;
- authentication and identity verification procedures;
- cybersecurity monitoring;
- secure storage environments;
- staff confidentiality obligations; and
- periodic review of security controls.
While the Firm takes reasonable steps to protect personal information, no method of transmitting information over the internet or storing information electronically can be guaranteed to be completely secure. Accordingly, the Firm cannot guarantee the absolute security of information transmitted electronically, and clients should take appropriate precautions to protect their own devices, passwords and account credentials.
Where required by applicable law, the Firm will investigate and respond to personal data breaches and provide any notifications required by law or regulation.
The Firm periodically reviews, tests and updates its information security controls and procedures to maintain its ongoing effectiveness and respond to evolving security risks.
These security measures also apply to Google for user data accessed, stored or processed by the Firm through Google APIs or other Google-authorised integrations. Access to such data is restricted to authorised personnel, systems and service providers with a legitimate business need, subject to appropriate access controls and confidentiality obligations.
10. Data Retention
The Firm retains personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, comply with legal and regulatory obligations, resolve disputes, enforce contractual rights and maintain appropriate business records.
Retention periods may vary depending on the nature of the information, the products or services provided, applicable legal or regulatory requirements and the legitimate needs of the Firm.
Where personal information is no longer required, the Firm will take reasonable steps to securely delete, anonymise or otherwise dispose of the information in accordance with its record retention and information security procedures, unless continued retention is required or permitted by applicable law.
Different categories of personal information may be retained for different periods depending on their purpose, applicable legal or regulatory requirements and the legitimate operational needs of the Firm.
For Google user data accessed through Google APIs or other Google-authorised integrations, the Firm will retain such data only for as long as reasonably necessary to provide the relevant functionality or fulfil the purpose for which the data was accessed, unless a longer retention period is required or permitted by applicable law. When the applicable retention period expires, or when the data is no longer required for the relevant functionality and there is no legal or regulatory requirement to retain it, the Firm will securely delete, anonymise or otherwise dispose of the data in accordance with its applicable retention procedures.
11. Your Privacy Rights
Subject to applicable law and any legal or regulatory obligations to which the Firm is subject, you may have certain rights in relation to the personal information held by the Firm.
Depending on the applicable legal framework, these rights may include the right to:
- request access to the personal information the Firm holds about you;
- request correction of inaccurate, incomplete or outdated personal information;
- request the restriction of processing in certain circumstances;
- request the deletion of personal information where the Firm is no longer required or permitted to retain it;
- object to certain forms of processing where permitted by law;
- withdraw consent where processing is based on consent; and
- lodge a complaint with the relevant supervisory or regulatory authority where you believe your personal information has been processed unlawfully.
The exercise of these rights may be subject to legal, regulatory or contractual limitations. In particular, the Firm may be required to retain certain information to comply with applicable anti-money laundering, counter-terrorist financing, taxation, accounting or other legal and regulatory obligations.
The Firm may require you to verify your identity before responding to any request relating to your personal information in order to protect your privacy and prevent unauthorised disclosure.
Where the Firm has accessed Google user data through a Google-authorised integration, you may request deletion of such data by contacting the Firm using the contact details in Section 17. The Firm will consider and process such requests in accordance with applicable law, Google's applicable policies and any legal or regulatory requirements requiring the Firm to retain the information.
12. Cookies and Similar Technologies
The Firm uses cookies and similar technologies to support the operation of its website, improve user experience, maintain security, analyse website traffic and better understand how visitors interact with its online services.
Cookies are small text files stored on your device when you visit a website. They enable certain website functions, remember user preferences, and assist in improving the performance and functionality of the website.
The Firm may use:
- Essential Cookies, which are necessary for the operation and security of the website;
- Performance and Analytics Cookies, which help us understand how visitors use our website and improve its performance; and
- Functional Cookies, which remember your preferences and enhance your browsing experience.
Some cookies may be placed by carefully selected third-party service providers supporting the operation of the Firm's website and online services.
Most internet browsers allow users to control or disable cookies through their browser settings. Please note that disabling certain cookies may affect the availability or functionality of some features of the website.
Where required by applicable law, the Firm will obtain your consent before placing non-essential cookies or similar technologies on your device.
13. Marketing Communications
From time to time, the Firm may contact clients and prospective clients regarding products, services, promotions, educational content, market updates or other information that may be relevant to their relationship with the Firm.
Where required by applicable law, such communications will be sent only where you have provided the necessary consent or where another lawful basis for such communication exists.
You may withdraw your consent or opt out of receiving marketing communications at any time by following the unsubscribe instructions included in the communication or by contacting the Firm using the contact details set out in this Privacy Policy.
Your decision to opt out of marketing communications will not affect the Firm's ability to send communications relating to your account, transactions, security, regulatory obligations or the provision of its products and services.
14. Third Party Websites
The Firm's website or Online Trading Service may contain links to websites, applications or services operated by third parties. Such third-party services are provided for convenience only and are not controlled by the Firm.
The Firm is not responsible for the privacy practices, content or security of third-party websites or services. Clients should review the privacy policies of those third parties before providing any personal information.
15. Children’s Privacy
The Firm's products and services are intended solely for individuals who are legally capable of entering into binding contracts under the applicable laws governing their relationship with the Firm.
The Firm does not knowingly collect personal information from individuals who are not legally eligible to open an account or use its services. If the Firm becomes aware that personal information has been collected from a person who is not legally eligible to use its services, it will take reasonable steps to delete or otherwise deal with such information in accordance with applicable law.
16. Changes to this Privacy Policy
The Firm periodically reviews this Privacy Policy to ensure that it remains consistent with applicable legal and regulatory requirements, industry practice and the Firm's operational activities.
The Firm may amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, technology, business operations or the manner in which personal information is processed.
The current version is published on www.cxm.com and a copy is available upon request. It will become effective on the date specified therein. Continued use of the Firm's website, products or services after the effective date of any revised Privacy Policy constitutes acknowledgement of the updated Policy.
Google API Services User Data Policy
Where the Firm's application accesses Google user data through Google APIs or Google Workspace APIs, the Firm's collection, use, storage and sharing of such data will comply with Google's applicable API Services User Data Policy and Limited Use requirements.
The Firm will request and access only the Google user data necessary to provide or improve the functionality of the application or services requested by the user. The Firm will not use Google user data to develop, improve or train non-personalised or generalised artificial intelligence or machine-learning models.
Notwithstanding anything else in this Privacy Policy, Google user data will not be disclosed, transferred or made available to any third party except as expressly permitted under Google's applicable API Services User Data Policy and Limited Use requirements.
17. Contact Us
If you have any questions regarding this Privacy Policy, wish to exercise your privacy rights or require further information regarding the processing of your personal information, you may contact the Firm using the details below:
c/o Compliance Department
CXM Direct LLC
Registered Address: The Financial Services Centre, Stoney Ground, Kingstown, Saint Vincent and the Grenadines
Email: compliance@cxm.com
The Firm will consider and respond to privacy-related enquiries and requests within a reasonable period and in accordance with applicable legal and regulatory requirements.
18. Client Acknowledgement
By accessing the Firm's website, opening an account or using the Firm's products and services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, disclosure, storage and processing of your personal information as described in this Policy, to the extent permitted by applicable law.
You further acknowledge that:
- the Firm may collect and process personal information for the purposes described in this Privacy Policy;
- the Firm may share personal information with service providers, financial institutions, regulatory authorities and other third parties where reasonably necessary to provide its services or comply with legal and regulatory obligations;
- your personal information may be transferred to jurisdictions outside your country of residence where reasonably necessary for the operation of the Firm's business;
- you are responsible for ensuring that the personal information you provide to the Firm remains accurate, complete and up to date; and
- you understand your rights in relation to your personal information as described in this Privacy Policy.
Effective Date: