Privacy policy

Caldwell Fox Capital ("we", "us", "our") is the controller of personal data processed in connection with caldwellfoxcapital.com, login.caldwellfoxcapital.com, app.caldwellfoxcapital.com, help.caldwellfoxcapital.com, and the account. If another group company provides a specific service, we will identify that company where required.

You can contact us about this policy through your assigned agent or by writing to privacy@caldwellfoxcapital.com. If we appoint a data protection officer or EU/UK representative, we will publish those details here.

Account data: name, email, password hash, authenticator settings, preferred currency, account type (personal or business), and the identifiers we assign.

Identity data: date of birth, residential or registered address, nationality or tax residence where collected, government identity document images, and the outcome of verification checks. For a business, company name, numbers, ownership, and signatory details.

Financial data: balances, deposits, conversions, payouts, asset types, bank or wallet coordinates you give us, and desk notes about those movements.

Technical data: IP address, device and browser type, approximate location derived from IP, sign-in times, and security logs. We do not use third-party advertising pixels on the account.

Correspondence: emails, messages to the desk, and notes your agent records so the file stays consistent.

Directly from you when you register, verify email, complete identity, deposit, withdraw, or write to us.

Automatically when you use the Services, through the session cookie, a small profile cookie, and server logs.

From service providers who help us with email delivery, hosting, fraud and sanctions screening, and market data, and from public sources where the law allows.

To create and run the account, authenticate you, assign an agent, show balances, and process deposits and payouts. Legal basis: performance of the contract (the Terms of Use).

To verify identity, prevent financial crime, keep records, and meet sanctions, tax, and accounting duties. Legal basis: legal obligation and, where needed, legitimate interests in a safe desk.

To send operational mail (codes, security alerts, status of a payout). Legal basis: contract and legitimate interests. Marketing mail is only sent if you ask for it or another lawful basis applies, and you can opt out.

To keep the site secure, debug faults, and measure that the service works. Legal basis: legitimate interests. We balance those interests against your rights.

Where we rely on consent (for example a non-essential cookie, if we ever add one), you can withdraw it without affecting prior processing.

We use a session cookie so you stay signed in, and a small profile cookie so the site knows your role and whether the email is confirmed. These are required for the login to function.

We do not currently set advertising or cross-site tracking cookies. If that changes, we will update this policy and, where the law requires, ask before non-essential cookies are set.

You can block cookies in your browser. Doing so will prevent sign-in.

Staff see your file on a need-to-know basis. Assigned agents see assigned clients. Managers and operators see what they need to run the desk.

Processors who host the site, send email, store backups, or screen identity may receive data under written terms that require confidentiality and security.

We may disclose data to courts, regulators, or law-enforcement where the law requires or allows it, and to professional advisers under duty of confidentiality.

We do not sell your personal data. We do not share it with third parties for their own marketing.

Our vendors and staff may process data outside your country, including in the United States or the United Kingdom. Where we transfer personal data out of the UK or EEA, we use a lawful mechanism such as an adequacy decision or standard contractual clauses, unless a specific legal exemption applies.

We keep account, identity, and transaction records for as long as you have an account and for a period after closure that is not usually less than five years, so we can meet AML, tax, and dispute obligations.

Security logs are kept for a shorter operational period unless they form part of an investigation. Email backups follow the vendor's cycle.

When retention ends, we delete or irreversibly anonymise the data where the systems allow.

Passwords are stored with a modern one-way hash. Email confirmation is required before a client session is fully live. Authenticator apps can be required. Sessions expire after six hours. Payouts wait for human review.

No method of transmission or storage is perfectly secure. You must keep your device and credentials safe and tell us if you think they were compromised.

Depending on where you live, you may have the right to access, correct, erase, restrict, or object to certain processing, to receive a portable copy of data you gave us, and to withdraw consent.

You also have the right to complain to a supervisory authority. In the UK that is the ICO. In the EEA it is the authority of your EU member state of residence, workplace, or the place of the alleged infringement. In Lithuania, that includes the State Data Protection Inspectorate (VDTA).

Some rights are limited. We may refuse erasure where we must keep records for AML or to defend a claim. We will explain if we cannot fulfil a request.

To exercise rights, write to privacy@caldwellfoxcapital.com from the email on the account, or ask your agent. We may need to verify it is you.

The Services are for adults. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it unless the law requires us to keep it.

We do not make solely automated decisions that produce legal or similarly significant effects about you without human involvement. Identity and payout reviews are seen by a person.

We may update this policy. The version on the help centre is current. If a change is material, we will notify the email on the account where we can.

Last updated 27 August 2026.