Comprehensive Privacy Policy

1. Introduction and Scope

ZoneX ("we", "us", "our", or "Company"), a company registered in Switzerland (CHE-192.381.383), is committed to protecting your privacy and personal data. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you use our website, trading platform, terminal software, and related services (collectively, the "Services").

This Policy applies to all users of our Services, including website visitors, registered users, challenge participants, and users who successfully complete the evaluation. By using our Services, you consent to the data practices described in this Policy.

We process personal data in accordance with:

• Swiss Federal Act on Data Protection (FADP)
• EU General Data Protection Regulation (GDPR) where applicable
• Other applicable data protection laws and regulations

2. Data Controller

ZoneX acts as the data controller for all personal data processed through our Services.

3. Personal Data We Collect

3.1 Information You Provide

We collect information that you provide directly to us:

• Account Information: Name, email address, username, password, date of birth, nationality, address
• Identification Documents: Government-issued ID, passport, proof of address (for KYC/AML compliance)
• Financial Information: Bank account details, payment card information, transaction history
• Trading Data: Trading performance, strategies, positions, profit/loss records
• Communication Records: Support tickets, emails, contact forms, chat messages, customer support interactions, communication preferences, and phone call recordings where legally permitted.
• Preferences: Communication preferences, platform settings, language preferences

3.2 Automatically Collected Information

• Technical Data: IP address, browser type and version, operating system, device identifiers
• Usage Data: Pages visited, features used, time spent, click patterns, referral sources
• Cookies and Tracking: Session data, analytics information, marketing tracking data
• Location Data: General geographic location based on IP address
• Performance Metrics: Platform performance, error logs, diagnostic data

3.3 Information from Third Parties

• Identity verification services (for KYC/AML compliance)
• Payment processors and financial institutions
• Cryptocurrency exchanges (trading data, API connections)
• Marketing and analytics partners
• Fraud prevention and security services

4. Legal Basis for Processing

We process your personal data on the following legal bases:

4.1 Contractual Necessity

Processing is necessary to perform our contract with you, including providing access to our Services, processing transactions, and managing your account.

4.2 Legal Obligations

Processing is required to comply with legal obligations, including KYC/AML regulations, tax reporting, financial services regulations, and court orders.

4.3 Legitimate Interests

Processing is necessary for our legitimate interests, including fraud prevention, security, business analytics, service improvement, and direct marketing (where not requiring consent).

4.4 Consent

Where required by law, we obtain your explicit consent for specific processing activities, such as marketing communications and certain cookies.

5. How We Use Your Personal Data

We use your personal data for the following purposes:

5.1 Service Provision

• Creating and managing your account
• Providing access to our trading platform and terminal
• Processing Challenge Program applications and evaluations
• Managing funded-stage Account Configurations
• Executing trades and managing positions
• Processing contractual Performance Remuneration payments

5.2 Compliance and Security

• Verifying your identity (KYC/AML compliance)
• Preventing fraud, money laundering, and unauthorized access
• Monitoring for suspicious activities and rule violations
• Complying with legal and regulatory requirements
• Responding to legal requests and court orders

5.3 Communication

• Sending service-related notifications and updates
• Responding to support requests and inquiries
• Providing customer service and technical support
• Sending marketing communications (with consent where required)

5.4 Business Operations

• Analyzing usage patterns and user behavior
• Improving our Services and developing new features
• Conducting market research and analytics
• Managing business operations and internal record-keeping
• Enforcing our Terms of Use and other agreements

5.5 Communication and Email Processing

ZoneX uses email, messaging, customer support, and communication service providers to deliver account notifications, security alerts, transactional communications, onboarding messages, customer support responses, platform updates, service announcements, and marketing communications where permitted by applicable law.

In connection with these communications, we and our service providers may process information including your name, email address, communication preferences, message content, delivery status, bounce information, unsubscribe requests, and related communication metadata.

To improve service reliability, security, and user experience, ZoneX may monitor communication performance metrics, including message delivery, opens, clicks, engagement statistics, bounce rates, and unsubscribe activity. Such processing is conducted in accordance with applicable data protection laws and solely for legitimate business, operational, compliance, security, and customer-service purposes.

6. Data Sharing and Disclosure

We may share your personal data with the following categories of recipients:

6.1 Service Providers

• Cloud hosting and infrastructure providers
• Payment processors and financial institutions
• Identity verification and KYC service providers
• Customer support and CRM platforms
• Analytics and marketing service providers
• Email, messaging, CRM, customer support, marketing automation, and communication service providers

6.2 Cryptocurrency Exchanges

We share necessary trading data with cryptocurrency exchanges to facilitate trading on your behalf through incentive-eligible accounts.

6.3 Legal and Regulatory Authorities

We disclose personal data when required by law, court order, or regulatory authority, including tax authorities, financial regulators, and law enforcement.

6.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity.

6.5 With Your Consent

We may share your data with other third parties when you have given explicit consent.

All third parties with whom we share data are required to maintain appropriate security measures and process data only as instructed by us.

7. International Data Transfers

Your personal data is primarily stored and processed in Switzerland. However, some of our service providers may be located in other countries, including the European Union and other jurisdictions.

When we transfer personal data outside Switzerland or the EEA, we ensure appropriate safeguards are in place:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules
• Other legally recognized transfer mechanisms

You may request information about the specific safeguards in place for international transfers by contacting our Data Protection Officer.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations:

• Active Accounts: Throughout the duration of your account plus 10 years after closure (for financial and legal compliance purposes)
• Trading Records: 10 years from the date of the transaction (legal requirement)
• KYC/AML Documents: 10 years after account closure (regulatory requirement)
• Communication Records: 3-7 years depending on the nature of communication
• Marketing Data: Until consent is withdrawn or 3 years of inactivity
• Technical Logs: 12-24 months for security and troubleshooting

After the retention period expires, we securely delete or anonymize your personal data unless further retention is required by law.

9. Your Data Protection Rights

Under Swiss and EU data protection law, you have the following rights:

9.1 Right of Access

You can request a copy of your personal data we hold and information about how we process it.

9.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data.

9.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data in certain circumstances, subject to legal retention requirements.

9.4 Right to Restriction of Processing

You can request that we limit the processing of your personal data in specific situations.

9.5 Right to Data Portability

You can request a machine-readable copy of your personal data to transfer to another service provider.

9.6 Right to Object

You can object to processing based on legitimate interests, including direct marketing.

9.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time without affecting prior processing.

9.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local supervisory authority.

To exercise any of these rights, please contact us at legal@zonex.pro. We will respond to your request within 30 days.

10. Data Security

We implement comprehensive technical and organizational security measures to protect your personal data:

10.1 Technical Measures

• End-to-end encryption for sensitive data transmission
• Encrypted data storage using industry-standard algorithms
• Secure authentication and authorization systems
• Regular security audits and penetration testing
• Firewall protection and intrusion detection systems
• Automated backup and disaster recovery systems

10.2 Organizational Measures

• Strict access controls and role-based permissions
• Employee training on data protection and security
• Confidentiality agreements with all employees and contractors
• Data protection impact assessments for high-risk processing
• Incident response and breach notification procedures

While we implement robust security measures, no system can be 100% secure. You are responsible for maintaining the security of your account credentials and should notify us immediately of any unauthorized access.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, analyze Service usage, measure marketing performance, and operate our affiliate and referral programs. Depending on your jurisdiction and consent preferences, these technologies may include Google Analytics, Google Tag Manager, advertising and conversion tracking pixels, affiliate and referral tracking technologies, session recording and website optimization tools, and similar analytics or performance-monitoring technologies.

11.1 Types of Cookies

• Essential Cookies: Required for basic platform functionality and security
• Performance Cookies: Collect information about how you use our Services
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Track your activity for advertising purposes (requires consent)

11.2 Managing Cookies

You can control cookies through your browser settings, including by blocking or deleting cookies, restricting third-party cookies, or using browser-level opt-out mechanisms. Where applicable, you may also opt out of specific analytics or advertising providers using the opt-out tools they make available (for example, the Google Analytics opt-out browser add-on). Disabling essential cookies may affect platform functionality.

11.3 Analytics and Advertising Technologies

ZoneX may use analytics, advertising, and performance-monitoring technologies to understand how users interact with our Services, improve functionality, measure marketing effectiveness, detect fraud, and optimize the user experience.

These technologies may collect information including IP address, device information, browser information, pages visited, time spent on pages, referral sources, interactions with advertisements, and other usage data. Where these technologies involve transfers of personal data outside Switzerland or the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions recognized under the Swiss FADP and the GDPR.

11.4 Affiliate and Referral Tracking

ZoneX operates affiliate and referral programs. We may use cookies, tracking links, referral codes, unique identifiers, and similar technologies to attribute referrals, track affiliate performance, prevent fraud, and calculate commissions owed to affiliates. Information processed for these purposes is limited to what is necessary to administer the programs and comply with our legal and contractual obligations.

11.5 Consent Management

Where required by applicable law (including the GDPR and the Swiss FADP), non-essential cookies and tracking technologies will only be activated after obtaining the user's consent. Users may withdraw or modify their consent preferences at any time through the cookie management tools provided by ZoneX, or by adjusting their browser settings and using the opt-out mechanisms offered by individual providers. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

For more information, please see our separate Cookie Policy.

12. Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate parental consent, we will take steps to delete such information promptly.

If you believe we have collected data from a child, please contact us at legal@zonex.pro.

13. Third-Party Service Providers

We work with trusted third-party service providers to deliver our Services. These providers may process your personal data on our behalf or as independent controllers. Below is a list of key service providers and links to their respective privacy policies:

• MultiPass — Payment institution. Privacy Policy
• DiliSense — Compliance – Sanctions screening. Privacy Policy
• Binance — Exchange partner for trading services. Privacy Policy
• Bybit — Exchange partner for trading services. Privacy Policy
• OKX — Exchange partner for trading services. Privacy Policy
• Hyperliquid — Exchange partner for trading services. Privacy Policy
• Phemex — Exchange partner for trading services. Privacy Policy
• Gate.io — Exchange partner for trading services. Privacy Policy
• CoinW — Exchange partner for trading services. Privacy Policy
• KuCoin — Exchange partner for trading services. Privacy Policy
• OVH — Infrastructure and hosting services. Privacy Policy
• TradingView — Charting and market data services. Privacy Policy
• Cloudflare — Content delivery network and security services. Privacy Policy
• Auth0 — Authentication and identity management services. Privacy Policy

We also engage email, messaging, CRM, customer support, marketing automation, and communication service providers to deliver and manage communications with our users. These providers may process personal data as described in Section 5.5 (Communication and Email Processing) and Section 6.1 (Service Providers) of this Privacy Policy.

We require all third-party service providers to process your data in accordance with applicable data protection laws and to implement appropriate security measures. For more details on how each provider handles your data, please refer to their respective privacy policies linked above.

14. Automated Decision-Making and Profiling

We may use automated systems to:

• Evaluate Challenge Program applications
• Monitor trading activity for rule violations
• Detect fraud and suspicious activities
• Assess risk and trading performance

You have the right to request human review of automated decisions that significantly affect you and to contest such decisions.

15. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by law.

We will provide information about the nature of the breach, its likely consequences, and the measures taken to address it.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Services. We will notify you of material changes by:

• Email notification to your registered address
• Prominent notice on our website and platform
• In-app notifications

The "Last Updated" date at the top of this Policy indicates when changes were last made. Your continued use of our Services after changes constitute acceptance of the updated Policy.

17. Contact Information

18. Consent and Acknowledgment

By using our Services, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and disclosure of your personal data as described herein.

If you do not agree with this Policy, please do not use our Services.