Privacy Policy

Privacy Policy and Cookie Policy

  • Data Controller & Policy Overview
  • Data Controller: cTrader Ltd, a limited liability company registered in the Republic of Cyprus, registered address: 78 Spyrou Kyprianou, Magnum House, 3rd Floor, 3076 Limassol, Cyprus (hereinafter referred to as "cTrader", "we", "us" or "our").

    cTrader collects and processes certain personal data related to users (hereinafter referred to as "you", "user") through this website.

    Personal Data means any information directly or indirectly related to an identified or identifiable natural person, in particular data that can be identified via identifiers such as name, ID number, geolocation data, online identifiers, or specific personal characteristics including physical, economic, cultural and social attributes.

    This Privacy Policy (hereinafter referred to as this Policy) is formulated in accordance with the effective version of the EU General Data Protection Regulation (GDPR 2016/679) issued on April 27, 2016, aiming to inform you of the types of personal data we collect, methods and purposes of data processing, data retention period, data recipients and your legitimate rights.

    This Policy serves as a supplementary clause to the website user agreement. Your use of this website constitutes your acceptance of this Policy and relevant website terms of use (including rules corresponding to specific services and user identities, collectively referred to as Terms of Service).

  • Policy Revision
  • This Policy may be revised at any time, and the version displayed on the website shall be the valid version.

    In case of substantial changes to this Policy, we will notify you via email or website pop-up notice within a reasonable period.

    cTrader may request you to confirm that you have read and understood the contents of this Policy by any recordable means at any time.

  • Types of Personal Data Collected by the Website
  • We mainly collect data directly from you. Meanwhile, with your authorization, we may obtain relevant data from third-party partners, advertising partners and social platforms to provide you with services.

    Mandatory fields (usually marked with asterisk *) will be indicated on data collection pages. If you fail to fill in mandatory information, we cannot provide you with complete website services.

  • Scope of Data Collection
  • We primarily collect data directly from you, and acquire relevant data from third-party service providers, advertising partners and social platforms subject to your authorization.

    Below are all categories of data we may collect and process based on your website behaviors and authorized scope:

    Identity & Account Registration Information: full name, username, email address, contact number, login password, date of birth/adult identity verification, personal avatar, enterprise name and legal representative information of professional sellers, VAT number of professional sellers, and information voluntarily filled in your personal profile.

    Device, Account & Usage Behavior Information: IP address, session login records, Cookies and tracking identifiers, authorization/rejection records and operation time, user preference profiles, language settings, browser type, accessed website content and URLs, login time and duration.

    Website Interaction & User Communication Information: username of contacts, chat message content, message sending time, shared images, other attached data in chats, product reviews, star ratings, review release time, review replies, comments and public messages you post on the website, consumption habits.

    Listed & Hosted Product Related Information: product descriptions, real product photos, product prices, invoice/receipt photos.

    Payment Related Information: commodity prices, withholding tax rates calculated based on buyers' locations, payment method details, bank account information, electronic invoices.

    Sales & Operation Information: product listing records, sales records, website revenue data.

    Customer Service, Dispute & Violation Management Information: consultation and complaint records submitted to customer service center; types and receiving time of violation warnings received by users; content, reasons and submission time of user complaints.

    Sensitive Data: We do not actively collect sensitive personal data. We will only collect or process your sensitive personal data after obtaining your explicit written consent, and will never process such data without your knowledge. You are advised to only fill in necessary information in public areas such as comment sections to avoid sensitive privacy leakage.

  • Purposes of Data Processing Based on Pre-contractual Procedures and General Terms of Service
  • We process your personal data for the following purposes:

    Allow you to register and create a website account;

    Assist you in managing your personal account;

    Enter into service agreements with you;

    Provide you with various platform services;

    Display your product listing information on the website;

    Support you to complete transactions and payment settlements on the platform;

    Push full-process account updates from registration to cancellation via email and in-site notifications;

    Inform you of updates (addition, modification and deletion) of general terms, privacy policy, commission rules and platform service functions via email and in-site messages;

    Remind you of pending hosted products waiting for your review and confirmation;

    Push transaction status including purchasing progress, sales progress and payment status via email and in-site notifications;

    Send notifications to you when cTrader and partners require additional verification of identity, residential address and other information;

    Notify you promptly when abnormalities affecting your normal use of the website are detected;

    Reply to your consultations, requests and complaints submitted to customer service via email and in-site messages.

  • Data Processing Based on Legitimate Interests
  • Such data processing is based on our legitimate interests and shall meet three conditions simultaneously: (1) the pursued interests are legal, definite and valid; (2) data processing is necessary; (3) processing activities will not infringe upon the legitimate rights and interests of data subjects.

    We ensure that the following processing activities will not violate your fundamental rights and freedoms. Specific processing purposes and legitimate interest basis are as follows:

    Provide you with product copywriting suggestions, pricing guidance and price drop reminders, and inform you of inquiries and interactive messages from other users via email and in-site notifications. Legitimate Interest Purpose: Facilitate transactions among users and improve platform user experience and satisfaction.

    Send email reminders for you to review pending hosted products. Legitimate Interest Purpose: Enrich platform product inventory and complete listed product resources.

    Push preferred content, products and information based on your browsing habits, and deliver platform promotion activities to sellers timely via email and in-site notifications. Legitimate Interest Purpose: Optimize personalized experience, deliver exclusive benefits, boost transaction conversion and enhance user satisfaction.

    Invite you to participate in satisfaction surveys, opinion polls and other questionnaires. Participation is voluntary without any adverse consequences, and questionnaire responses are processed subject to your consent. Legitimate Interest Purpose: Collect user feedback and continuously optimize website functions and services.

    Disclose part of your basic information to other users including username, registration time, product location, sales volume, seller honor badges and store ratings. Legitimate Interest Purpose: Establish user mutual trust mechanism, standardize compliant transactions, improve platform transaction volume and reputation.

    Implement anti-fraud detection and account security verification, automatically suspend abnormal transactions for manual review by risk control team, and verify identity information when necessary. Legitimate Interest Purpose: Protect website and user fund security and prevent all kinds of fraudulent behaviors.

    Conduct review and compliance management on platform content, chat records and user conversations. Legitimate Interest Purpose: Improve service security and content quality, enforce platform rules, remove illegal content and malicious programs, settle user disputes, accept reports and complaints, crack down on infringement and counterfeiting acts, and protect legitimate user rights.

    Carry out marketing data statistics and behavior analysis to study website and service usage habits and continuously optimize platform functions. Legitimate Interest Purpose: Perfect user experience and realize personalized service customization.

    Review customer service communication records, train service staff, optimize after-sales service processes and guarantee service satisfaction.

  • Data Processing Only With Your Consent
  • We will only process personal data based on your authorization with your explicit consent for the following purposes:

    Subscribe you to platform email newsletters, which you may cancel anytime via unsubscribe links in emails or account settings;

    Deliver customized product dynamic reminders set by you in your account, which can be turned off in the account backend at any time;

    Display personalized customized advertisements on third-party websites and block irrelevant promotions; you may disable this function by modifying Cookie settings (see Cookie Policy section);

    Analyze your feedback from voluntary questionnaires including satisfaction surveys, function tests and public opinion polls;

    Share necessary basic data with cooperative brands and inform you of activity and partner details when you agree to join brand joint activities;

    Collect your contact number for special services such as customer service follow-up and callback services.

  • Personal Data Retention Period
  • We only retain your personal data within the shortest period necessary to fulfill data processing purposes, with specific rules as follows:

    Account-related data: retained during your account existence and cleared after account cancellation;

    Email newsletter and message reminder data: retained until you unsubscribe or withdraw authorization;

    Contract execution data: retained during contract validity period and archived in accordance with statutory limitation period after contract termination;

    Tax declaration related data: archived and retained in accordance with statutory prosecution limitation after annual tax declaration submission;

    Complaint, dispute and litigation related data: retained throughout dispute settlement period and extended per statutory limitation period;

    Questionnaire survey data: retained after survey completion and anonymized if no further use is required;

    Online application related data: automatically deleted after 2 years;

    Even after you cancel your account, we may still retain necessary relevant data within statutory limitation period if required by legal obligations or our legitimate retention interests including abnormal account status, unresolved complaints and disputes, evidence preservation for legal rights protection and other circumstances until all disputes are fully settled.

  • Data Recipients & Sharing Parties
  • In compliance with Articles 32 to 34 of GDPR, cTrader adopts comprehensive technical and administrative measures to protect personal data from accidental damage, loss, alteration, unauthorized disclosure and access, and imposes equivalent security obligations on all service providers and subcontractors.

    To provide platform technology support, account login authorization, licensing services, billing settlement, payment clearing, electronic invoicing, security risk control, anti-fraud, customer service, data analysis, compliance operation and supporting services, we may share necessary personal data with Spotware Systems Ltd and its group affiliated enterprises.

    Spotware Systems Ltd is a limited liability company registered in the Republic of Cyprus, registered address: 78 Spyrou Kyprianou, Magnum House, 3rd Floor, 3076 Limassol, Cyprus, company registration number: HE301668.

    All above data processing activities comply with applicable data protection laws, regulations and GDPR provisions. If Spotware Systems Ltd or its affiliates act as independent or joint data controllers in settlement, payment, invoicing, compliance operation and other businesses, relevant information will be clearly stated in payment procedures, invoice documents, legal terms and privacy statements.

  • Cookie Policy
  • cTrader uses web Cookies to optimize website browsing experience and improve user experience. Most browsers accept Cookies by default, and you may refuse or delete local Cookies by referring to browser help documents.

    This website uses both analytical Cookies and social Cookies.

    Cookies used by cTrader will not secretly obtain your private personal information or access any confidential data stored on your devices.