IPFX Capital
← Back to site
Privacy notice: This explains what information IPFX collects, why it is used, how identity documents are protected and how to exercise your rights.
IPFX Capital is operated by Paul Adeniji, who is responsible for the personal-data processing described in this notice. For privacy requests, contact enquiries@ipfxcapital.com.
| Account data | Name, email address, password (stored hashed, never in plain text), country of residence, referral code. |
| Challenge application and identity data | Legal name, date of birth, phone number, residential address, nationality, occupation and employment status, source of funds, intended activity, PEP declaration, government-issued photo ID and ID metadata. Residential address details are required, but a proof-of-address document is not a standard application requirement. Documents previously supplied remain subject to the retention controls in this notice. This information is collected when you apply to start a Challenge and may be refreshed later. |
| Payment data | We never receive or store your full card number, expiry date, or CVV. Card details are entered directly into forms hosted by our payment processor (Stripe) and go straight to them — we only receive a payment confirmation and a reference ID. |
| Trading data | Every order you place, modify, or close on the Platform: instrument, size, entry/exit price, stop loss, take profit, timestamps, and account balance history. See Section 4. |
| Chart and derived strategy data | Indicator identifiers, timeframe and chart style saved in IPFX Markets; behavioural metrics derived from trading data; explainable strategy hypotheses; and demo-only paper-plan comparison scores. We do not need to store chart screenshots for this purpose. |
| Technical data | IP address, device and browser type, and general usage/log data, collected automatically for security, fraud prevention, and diagnosing issues. |
| Communications | Support messages, live-chat questions, and anything you send us via email or the contact form. Questions typed into the automated support assistant are stored with email addresses and long numbers automatically removed, and deleted after 90 days; the assistant cannot see your account. |
We record Trading Data to operate your account, calculate results, enforce programme rules, investigate fraud and improve the Platform. We may create aggregated or anonymised statistics, such as instrument usage or platform-wide performance patterns, where individuals are not identifiable.
We may analyse order history together with a saved IPFX Markets chart setup to estimate possible strategy families such as trend following, mean reversion, breakout, VWAP scalping, swing trading or news-event trading. Each output is labelled as a hypothesis with a confidence level, supporting evidence and contradictory evidence. We create demo-only paper plans from information available at a fixed cutoff and compare them with later trading activity. The system does not place live orders and an inferred strategy is not treated as proof of intent, ownership, future profitability or wrongdoing.
Company trading: IPFX may use your Trading Data, including your identifiable orders and positions, to copy, hedge or route trades in Company accounts and to move accounts between A-book and B-book models, as set out in Section 11.3 of the Terms and Conditions. This processing is necessary for our legitimate interest in managing the Company's risk.
This wording matches Section 11 of the Terms and Conditions.
Where UK/EU GDPR applies, we rely on the following legal bases, depending on the activity: taking steps at your request before entering a contract and performance of our contract with you (reviewing an application, running your account and processing payments); compliance with a legal obligation where a specific KYC, sanctions, tax or record-keeping obligation applies; and our legitimate interests in identity assurance, platform security, fraud prevention, enforcing programme rules, internal risk research and improving evaluation design, balanced against your rights. Strategy hypotheses are not used for direct marketing. Numerical trading safeguards and internal classification may be automated; the review safeguards below apply where a decision has a significant effect. Marketing emails and optional website analytics rely on consent, which you can withdraw through cookie settings or by contacting us.
Providing the mandatory application information is necessary for us to review and administer a Challenge. If it is not provided, we cannot approve the application. Marketing consent is optional and does not affect eligibility.
Some of our service providers (including Supabase and Stripe, and brokers or liquidity providers that receive order data) may process data outside the United Kingdom. Before a restricted transfer, we must establish an applicable UK adequacy route or appropriate contractual safeguards, such as a UK IDTA or UK Addendum, and any required transfer risk assessment. A processor’s claim alone is not evidence that every transfer is covered.
We keep account and trading data while your account is active and afterwards only for as long as reasonably needed for legal, tax, security, fraud-prevention or dispute-resolution purposes. Identity documents for an application that is denied, withdrawn or never activated are scheduled for retention review after 12 months. Where a Challenge is approved, identity documents and associated application records are scheduled for review five years after the decision or, if later, the end of our relationship. Identifiable chart-configuration events, strategy hypotheses and paper-plan comparisons are reviewed for deletion or irreversible anonymisation 24 months after the last relevant account activity unless they are still needed for an active review, dispute, security investigation or legal duty. Records are deleted or irreversibly anonymised when there is no continuing purpose or legal basis. Trading Data may be retained in anonymised or aggregated form indefinitely.
Identity files are reviewed by authorised staff one document at a time through audited, private links which expire after 60 seconds. A photograph is not automatically biometric recognition data. We do not introduce face templates or automated biometric matching through these review controls.
We use encryption in transit, hashed passwords, private object storage, database row-level security, role-based access controls, short-lived document links, multi-factor authentication for identity reviewers, access logging, rate limits and security monitoring. Identity documents are not stored in public website folders. No system is completely secure, and we cannot guarantee absolute security of information transmitted over the internet.
Automated controls may flag identity inconsistencies, prohibited activity, unusual risk or sanctions-related indicators and may produce a trading-style classification or strategy hypothesis for review. They do not make the final Challenge approval decision. Numerical drawdown breaches, missing-stop strikes, entry blocks and internal model selections may be automatic. Correlation/strategy flags support investigation and do not themselves prove cheating. Final misconduct decisions require meaningful human review. You can give your view, challenge inaccurate data and request reconsideration of a significant automated decision. You may ask us to explain the principal factors, correct inaccurate input data, provide your view or request human reconsideration by contacting us below.
Subject to applicable law, you have the right to: access the personal data we hold about you, including relevant inputs and outputs used to build a behavioural profile; request correction of inaccurate data; request erasure; object to or restrict certain processing; request a portable copy; and withdraw consent where processing is based on consent. You may also ask for an explanation and human review of an adverse decision. To exercise a right, contact us using the details below. Trading Data retained only in genuinely anonymised or aggregated form is not personal data. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data.
The Platform is not directed at, and we do not knowingly collect data from, anyone under 18. If we learn we've collected data from someone under 18, we will delete it.
We may update this policy from time to time. Material changes will be highlighted on the Platform or communicated by email. This notice explains processing; continued use is not consent to an unrelated new purpose. Where consent is required we ask separately, and other processing must have a valid lawful basis.
For any question about this policy or to exercise your rights, contact us at enquiries@ipfxcapital.com.