Legal documents

Privacy Policy

What data we collect, how we use it, and your rights.

Otto Trade respects your privacy. This Policy explains what data we collect, how we use it, and your rights under the EU General Data Protection Regulation (GDPR).

1. Data we collect

  • Identity: name, date of birth, nationality, ID document images
  • Contact: email, phone, postal address
  • Financial: bank/crypto details for deposits and withdrawals, transaction history
  • Technical: IP address, device info, browser, login timestamps
  • Trading: all trades placed on your MT4 account

2. Why we collect it

  • To open and operate your trading account (contractual necessity)
  • To comply with KYC, AML, and anti-fraud regulations (legal obligation)
  • To process deposits and withdrawals (contractual necessity)
  • To improve our services and respond to support requests (legitimate interest)

3. Who we share it with

We share data only with: regulators when required, our MT4 platform provider (TechnoGlobal), payment processors, KYC verification providers, and law enforcement when lawfully requested. We never sell your data.

4. Where we store it

Servers in the European Union. KYC documents are encrypted at rest. Passwords are hashed with bcrypt. Trading credentials are encrypted with AES-256-GCM.

5. How long we keep it

Account data: while you're a client + 7 years after closure (regulatory requirement). Trading records: 7 years. Marketing data: until you unsubscribe.

6. Your rights (GDPR)

  • Access — request a copy of all data we hold about you
  • Rectify — correct inaccurate data
  • Erase — request deletion (subject to legal retention requirements)
  • Restrict — limit how we process your data
  • Object — opt out of marketing
  • Portability — get your data in machine-readable format

To exercise these rights, email privacy@8-trade.com.

7. Cookies

We use essential cookies only (session, CSRF). No advertising or third-party tracking cookies.

8. Complaints

If you believe we have mishandled your data, you may file a complaint with your local data protection authority.