Privacy Policy

1.Introduction and definitions

This Privacy Policy explains how SummitFX handles personal information you provide to us when you use our foreign exchange and international payment services, including our WhatsApp-based trading platform, our website, and any associated communications.

In this Privacy Policy, the following definitions apply:

• "Personal data" means information relating to an identified or identifiable living individual.
• "You" means an individual who uses our Services, including prospective, active, and former clients, and visitors to our website.
• "Banking Partners" means the regulated payment institutions through whom we provide foreign exchange and payment services, currently including Sciopay, Equals Money, Ebury, TransferMate, GC Partners, Corpay, and IbanFirst.
• "Services" means the foreign exchange, international payment, and related services provided by SummitFX and our Banking Partners.

Our data protection practices are based on the principles set out in the UK GDPR: that personal data must be processed lawfully, fairly, and transparently; collected for specified and legitimate purposes; kept accurate and up to date; retained no longer than necessary; and processed securely.

2.Information we collect

Information you provide to us directly

When you register as a client, request a quote, or otherwise communicate with us, we may collect:

• Name, date of birth, and nationality
• Contact information (phone number, email address, postal address)
• Identity verification documents (passport, driving licence, national ID)
• Proof of address (utility bills, bank statements)
• Company information and company registration documents (for business clients)
• Director and beneficial owner information (for corporate onboarding)
• Source of funds and source of wealth information
• Bank account details and beneficiary details for payment execution
• Information about your foreign exchange needs, trading patterns and preferences

Information we collect through our WhatsApp platform

When you interact with our WhatsApp Business number for trading, quoting, and support, we collect and process:

• Your WhatsApp phone number and display name
• The content of messages you send us, including quote requests, trade instructions, and support queries
• Documents and images you send to us through WhatsApp
• Message metadata (timestamps, delivery status, read receipts)

Information we collect automatically

When you visit our website, we automatically collect certain technical information:

• IP address and approximate geographic location
• Browser type and version, operating system, device type
• Referring website, pages visited, time on site, navigation patterns
• Cookie identifiers (see Section 7 for details)

Information from third parties

We may receive information about you from third parties where necessary to verify your identity, prevent fraud, or provide Services, including:

• Identity verification providers and credit reference agencies
• Sanctions screening and politically exposed person (PEP) databases
• Our Banking Partners, regarding the status of payments you instruct
• Publicly available sources, including Companies House and social media where relevant for business onboarding
• Referral sources (if another client referred you to us)

3.How we use your information

We process your personal data to:

• Provide our Services — including onboarding you as a client, providing rate quotes, executing trades, managing beneficiary details, and settling payments through our Banking Partners.
• Comply with legal and regulatory obligations — including Know Your Customer (KYC) and anti-money laundering (AML) checks under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, sanctions screening, and regulatory reporting.
• Communicate with you — sending you quote confirmations, trade confirmations, delivery notifications, rate alerts, market orders, and service-related messages via WhatsApp, email, or phone.
• Operate the Summit Points and equity pool — calculating and tracking Summit Points you earn, administering the client equity allocation, and communicating with you about your balance and the pool's value.
• Provide customer support — responding to your enquiries, troubleshooting issues, and handling complaints.
• Improve and develop our Services — analysing usage patterns, testing new features, and gathering feedback.
• Prevent fraud and protect security — detecting and preventing unauthorised access, fraud, and other illegal activity.
• Send marketing communications — where you have consented, we may send you marketing communications about SummitFX Services. You can opt out at any time.

4.Lawful bases for processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases, depending on the processing activity:

• Contract — processing necessary to perform our agreement with you (e.g. executing trades, settling payments, managing your account).
• Legal obligation — processing required to comply with applicable law (e.g. AML checks, regulatory reporting, record keeping).
• Legitimate interests — processing necessary for our legitimate business interests, such as fraud prevention, service improvement, and internal administration, where these interests are not overridden by your rights.
• Consent — where you have given us specific, freely given consent (e.g. for non-essential cookies or marketing communications). You can withdraw consent at any time.

5.Sharing your information

We do not sell your personal data. We share your personal data only where necessary to provide our Services, comply with the law, or protect our legitimate interests.

Banking Partners

To execute your trades and settle payments, we share your relevant personal data with the Banking Partner handling your transaction. Each Banking Partner is an independently regulated payment institution or electronic money institution, and each acts as a separate data controller for the data it holds. Full details of each Banking Partner's regulatory permissions and data practices are available on our Partners page.

Service providers

We use third-party service providers to help us deliver our Services. These include:

• Meta Platforms Ireland Ltd — for the WhatsApp Business API that powers our trading platform
• Pipedrive — our customer relationship management (CRM) system
• Railway — our cloud hosting provider
• Google — for Gmail, Google Analytics, and related business services
• Resend — for transactional email delivery
• Identity verification and sanctions screening providers

Each service provider acts as our data processor and is contractually bound to process your data only on our instructions and in accordance with the UK GDPR.

Legal and regulatory disclosures

We may disclose your personal data where we are required to do so by law, regulation, or court order, or where disclosure is necessary to protect our rights or the rights of others. This includes disclosures to HM Revenue & Customs, the National Crime Agency, the Financial Conduct Authority (FCA) (in relation to our Banking Partners where applicable), and other competent authorities.

Corporate transactions

If SummitFX is acquired by or merges with another company, or sells any part of its business, we may disclose your personal data to the prospective buyer or merger counterparty as part of due diligence and to continue providing the Services. Any transfer will be carried out in compliance with the UK GDPR.

6.Your data rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to ask us to correct inaccurate or incomplete personal data.
• Right to erasure — to ask us to delete your personal data (subject to our legal obligation to retain certain records for AML purposes).
• Right to restriction — to ask us to restrict the processing of your personal data in certain circumstances.
• Right to object — to object to our processing where we rely on legitimate interests, including for direct marketing.
• Right to data portability — to receive your personal data in a structured, commonly-used format and to transmit it to another controller.
• Right to withdraw consent — where we rely on your consent, you can withdraw it at any time.
• Right not to be subject to automated decision-making — including profiling, where it produces legal effects on you.

To exercise any of these rights, please contact us using the details in Section 13. We will respond to your request within one month. There is no fee unless your request is manifestly unfounded or excessive.

7.Cookies and tracking technologies

Our website uses cookies and similar tracking technologies. A cookie is a small text file stored on your device that helps us remember your preferences, understand how you use the site, and improve your experience.

Types of cookies we use

• Strictly necessary cookies — required for core website functionality. These cannot be disabled.
• Analytics cookies — help us understand how visitors use our website (e.g. Google Analytics). These are only set with your consent.
• Marketing cookies — used to measure the effectiveness of our marketing. These are only set with your consent.

You can control cookies through your browser settings and, where applicable, our cookie consent banner. Note that disabling certain cookies may affect website functionality. For more information, see our Cookie Policy or visit allaboutcookies.org.

8.International data transfers

SummitFX primarily stores and processes personal data within the United Kingdom. However, some of our service providers (including Meta, Google, and certain Banking Partners) are based outside the UK or may transfer data to countries outside the UK for processing.

Where we transfer your personal data outside the UK, we ensure appropriate safeguards are in place in accordance with the UK GDPR. These may include:

• Transferring to countries that the UK Government has deemed to provide an adequate level of protection
• Using the UK's International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) as supplementary safeguards
• Relying on binding corporate rules where the recipient has them in place

If you would like further information about our international transfer safeguards, please contact our Data Protection Officer.

9.Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by law.

• Client records (KYC, AML, trade history) — retained for a minimum of 5 years after the end of our relationship with you, as required by the Money Laundering Regulations 2017.
• Marketing preferences — retained until you withdraw consent or ask us to delete them.
• Website analytics data — typically retained for up to 26 months.
• WhatsApp message history — retained for as long as your account is active, plus the minimum retention period required by law.

After the applicable retention period expires, we will securely delete or anonymise your personal data.

10.Security

We take appropriate technical and organisational measures to protect your personal data from loss, misuse, unauthorised access, alteration, and disclosure. These measures include:

• Encryption in transit using TLS 1.2 or higher
• Encrypted databases and secure cloud infrastructure
• Access controls and authentication for our systems
• Regular security reviews and monitoring
• Staff training on data protection obligations

However, no method of transmission over the internet or electronic storage is completely secure. While we use commercially reasonable means to protect your personal data, we cannot guarantee absolute security.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO in accordance with applicable law.

11.Children's privacy

Our Services are not directed at children under the age of 18, and we do not knowingly collect personal data from children under 18. If you are under 18, please do not use our Services or provide us with any personal information. If we learn that we have collected personal data from a child under 18, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please contact us immediately.

12.Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify you by email or through a prominent notice on our website before the changes take effect. The "Last updated" date at the top of this page indicates when the Privacy Policy was last revised. We encourage you to review this page periodically.

13.Contact us and Data Protection Officer

If you have any questions about this Privacy Policy, wish to exercise any of your rights, or have any concerns about how we handle your personal data, please contact us:

• Email: support@summitfx.com (data protection enquiries marked for our Data Protection Officer)
• Phone: +44 (0) 20 3878 4760
• Post: Data Protection Officer, SummitFX Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

We will acknowledge your request within 72 hours and will respond substantively within one month, in accordance with our obligations under the UK GDPR.