Privacy Policy.

Plain-English summary: We collect what we need to run a regulated trading service and improve our product — identity data, transaction data, and basic usage analytics. We never sell your data. You can access, correct or delete your personal information at any time.

01Who we are

Xblu LTD (“XBlu”, “we”, “us”) is the data controller for personal data collected through xblu.io and our trading platform. You can reach our Data Protection Officer at privacy@xblu.io.

02What we collect

Identity & KYC data

• Full name, date of birth, nationality, country of residence
• Government-issued ID (passport, national ID, driving licence)
• Proof of address (utility bill, bank statement)
• Selfie / live-capture biometric for identity verification
• Tax identification number where required
• Source of funds & source of wealth declarations

Account & transaction data

• Email, password (hashed), phone number, account preferences
• Deposit and withdrawal history, payment method details (last 4 digits, issuer)
• Order history, position history, fees paid, account balance

Device & usage data

• IP address, device type, browser, operating system
• Pages visited, features used, session duration
• Cookies and similar technologies (see our Cookie Policy)

Communications

• Support tickets, chat transcripts, email correspondence
• Recorded phone calls where applicable (with prior notice)

03How we use your data

04Who we share it with

We share personal data only when necessary, with carefully selected parties:

• KYC / identity verification providers — to confirm your identity in compliance with AML regulation;
• Payment processors and banks — to process your deposits and withdrawals;
• Liquidity providers — to route your trades for execution (we share trade metadata, not your identity);
• Cloud infrastructure providers — hosting, storage and analytics, under strict data-processing agreements;
• Regulators, courts and law-enforcement — where we are legally required to disclose;
• Professional advisors — lawyers, auditors and accountants under confidentiality.

We do not sell your personal data to advertisers or data brokers.

05International transfers

Your data may be processed outside your country of residence. Where data is transferred outside the European Economic Area or the UK, we rely on Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms.

06How long we keep it

• KYC records and transaction records: 7 years after account closure (regulatory retention);
• Marketing data: until you withdraw consent or 2 years of inactivity;
• Support tickets: 3 years from resolution;
• Server logs: 12 months.

07Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request erasure of your data (subject to legal retention obligations);
• Object to or restrict our processing;
• Receive your data in a portable format;
• Withdraw consent at any time;
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email privacy@xblu.io. We will respond within thirty (30) days.

08Security

We protect your data using industry-standard measures, including AES-256 encryption at rest, TLS 1.3 in transit, hardware-security-module key custody, role-based access controls, and 24/7 security monitoring. No system is impenetrable, but we will notify you and the relevant authorities without undue delay in the event of a personal data breach.

09Cookies

We use cookies and similar technologies to operate xblu.io, remember your preferences, and measure usage. See our full Cookie Policy for the list of cookies and how to manage them.

10Changes & contact

We may update this policy from time to time. Material changes will be notified by email. For any privacy-related question, contact privacy@xblu.io.