Privacy Policy

1. Definitions

In this policy, “personal data” is any information that identifies a person; “processing”, any operation on that data (collecting, using, storing, sharing); “data subject”, the person the data belongs to (you); “controller”, whoever decides the processing (Thriventage); “processor”, whoever processes data on the controller’s behalf (for example, a technology provider); and “third party”, any other person or organisation.

2. Personal data we collect

We collect: full name; email address; telephone number; password (always encrypted, never in readable text); contact-form details, including the content of your request; and, when you complete identity verification, a copy of your photographic ID, proof of address and a liveness check (a selfie or short video). We do not collect sensitive data (health, religion, political affiliation) or children’s data: the service is exclusively for people over 18.

3. Site usage data

When you visit the site we record technical data: pages viewed, time of access, device and browser type, language and IP address. This data serves security, aggregate statistics and the operation of the site. We do not use it to build our own advertising profiles and we do not sell it.

4. Cookies and similar technologies

We use strictly necessary cookies and local storage: keeping you signed in, remembering language preferences and security measures (protection against fraud and abuse). When the analytics metric is enabled, analytics cookies are used to count visits in aggregate. You can block or delete cookies in your browser; the site will keep working, although some session features may require you to sign in again. We do not use third-party advertising cookies.

5. Controller and processors

The data controller is Thriventage, with its registered address at 1 Canada Square, Level 39, Canary Wharf, London E14 5AB and its official privacy channel at [email protected]. The processors are the providers that host the platform, process payments, provide the identity-verification service and deliver email, all bound by confidentiality contracts and defined instructions on the use of the data.

6. Collection and use of information

We use your data to: create and administer your account; verify your identity; provide you with the automated trading service; contact you for operational and support reasons; send you, with your consent, commercial communications; meet legal and regulatory obligations; protect the platform and its users against fraud and abuse; and improve the service using aggregate statistics. Each use is limited to these purposes; we do not use the data for anything else without telling you.

7. Legal bases for processing

We process data on these bases: performance of the contract (everything necessary to operate your account); compliance with legal obligations (identity verification, record keeping, responses to authorities); legitimate interest (security of the platform, fraud prevention); and your consent, for commercial communications and for the liveness check in the verification process, which you may withdraw at any time without affecting the rest of the service, unless the law requires the data to be kept.

8. Data retention

Account data is kept while the account is active and, after closure, for the applicable statutory retention periods (including the trading and identification records required under anti-money-laundering rules). Usage data is kept in aggregate form for up to 24 months. Verification documents are kept encrypted for the corresponding statutory period and securely destroyed when it expires. When deletion is requested, data whose erasure is not prevented by a legal obligation is deleted.

9. Transfers to third parties

We share strictly necessary information with: identity-verification providers; payment processors; technology providers (hosting, email); group companies involved in providing the service; and authorities or regulators where applicable rules require it. Every transfer is documented and limited to the minimum necessary. We do not sell or rent personal data.

10. Disclosure of data

We may disclose data where there is a legal requirement from a competent authority, to protect the rights or security of the platform and its users, or in merger or corporate reorganisation processes, in which case we notify you where the law allows. Outside these cases, your data is not disclosed to third parties unconnected with the operation of the service.

11. Security of processing

We apply encryption in transit and at rest, role-based access control with strengthened authentication, access audit logs, continuous monitoring and periodic reviews. No system is infallible: if a breach occurs that affects your data, we will notify you without undue delay together with the corrective measures, in line with applicable rules. Operational details are on the security page.

12. Your rights as a data subject

You may exercise at any time your rights of access (know what data we hold), rectification (correct inaccurate data), erasure (delete data where there is no legal obligation to keep it), objection (stop processing based on legitimate interest) and portability (receive your data in a structured format). You may also withdraw your consent for commercial communications. To exercise your rights, write to [email protected] with the subject line “Personal data”: we handle and respond within a maximum of twenty working days after verifying your identity.

13. Service providers

The key processors are: the hosting and content-delivery provider; the registration form processor; the identity-verification provider; the payment processor (for transfers, cards and digital wallets); and the transactional email service. All of them act under contract, with access limited to what their function requires and no authority to use the data for their own purposes.

14. Analytics

When the site’s analytics metric is enabled, we use an analytics tool to count visits and navigation routes in aggregate. The IP address may be processed in anonymised or truncated form depending on the configuration. Analytics is not used to identify you personally or to share data with advertising networks.

15. Advertising and retargeting

We do not retarget using your account data and we do not share identifiers with advertising platforms. If a feature of this kind were added in future, it would be done only with your express consent and after updating this policy.

16. Links to third-party sites

The site links to external sites, such as exchanges or payment gateways, which have independent privacy policies. We recommend reading them before providing data on those sites: this policy applies solely to the Thriventage site and services.

17. Children’s privacy

Thriventage’s services are not directed at people under 18 and we do not knowingly collect children’s data. If we detect that a minor has created an account, we close it and delete the data in accordance with the law. If you are a guardian and believe a minor provided data on the site, write to [email protected].

18. Changes to this policy

This policy may be updated to reflect legal, technical or service changes. We publish the current version on this page at least fifteen days before it takes effect, and we notify significant changes by email. The date of the current version can be requested in writing at any time.

19. Contact

Official channel for privacy matters: [email protected], staffed Monday to Friday from 9:00 to 18:00 UK time. Address for notifications: 1 Canada Square, Level 39, Canary Wharf, London E14 5AB. If you consider that we did not handle a rights request correctly, you may escalate to the competent data-protection authority under the applicable procedure.