01Our role: processor and controller
YourPropFirm operates in two distinct capacities, and your rights differ depending on which applies.
| Data | Our role | Your firm's role |
|---|---|---|
| Trader records in your platform instance — KYC documents, account history, payout details | Processor | Controller |
| Your staff's admin accounts and audit logs | Processor | Controller |
| Your own contact details as a prospect, customer contact, or event attendee | Controller | Data subject |
| Website analytics and marketing data | Controller | Data subject |
02What we collect
As a processor, on your firm's behalf
- Identity and KYC data your traders submit — name, date of birth, address, government ID images, proof of address, liveness checks.
- Trading and account data: challenge attempts, phases, positions, breaches, resets, and appeals.
- Payment data: payout requests, payment-method identifiers, and settlement records. We do not store full card numbers; card data goes directly to the payment provider.
- Support and communication records created inside the platform.
As a controller, about you
- Contact and company details you give us — name, work email, phone, firm name, role, and what you told us about your stack.
- Product and website usage: pages viewed, features used in your admin console, and email engagement.
- Technical data: IP address, browser and device type, and approximate location derived from IP.
- Recordings and notes from demo calls, where you have been told and consented at the start of the call.
03Why we use it
| Purpose | Lawful basis |
|---|---|
| Providing, operating, and supporting the platform | Performance of contract |
| Fraud, abuse, and multi-account detection across the network | Legitimate interests |
| Security monitoring, audit logging, and incident response | Legitimate interests / legal obligation |
| Regulatory and AML obligations where they apply to us | Legal obligation |
| Product analytics and improvement | Legitimate interests |
| Marketing to business contacts | Legitimate interests, or consent where required |
We do not sell personal data, and we do not use trader data from one firm's instance to train models or build products for another firm.
05International transfers
The platform is hosted in the EU and Singapore. Data may be transferred outside your region where a sub-processor or your own firm's configuration requires it.
For transfers out of the EEA and UK we rely on adequacy decisions where they exist, and otherwise on Standard Contractual Clauses with the UK Addendum, supported by a transfer impact assessment.
Customers on our Enterprise plan can pin their instance to a single region. Ask us before signing if data residency is a requirement for your licence.
06How long we keep it
| Data | Retention |
|---|---|
| Trader records in an active instance | For the life of the contract, then per your deletion instruction |
| Instance data after termination | Exported on request, then deleted within 90 days |
| KYC documents | As required by the retention period your firm configures, minimum per applicable AML law |
| Audit and security logs | 24 months |
| Prospect and marketing data | 36 months from last engagement |
| Billing records | 7 years, as required by tax law |
Backups are retained on a rolling 35-day cycle, so deleted records may persist in encrypted backups for up to 35 days after deletion from live systems.
07Your rights
Where we are the controller of your data, you can ask us to:
- Give you a copy of the personal data we hold about you.
- Correct data that is wrong or incomplete.
- Delete your data, where we have no overriding obligation to keep it.
- Restrict or object to processing based on legitimate interests.
- Receive your data in a portable, machine-readable format.
- Withdraw consent, where consent was the basis — this does not affect processing already carried out.
Email privacy@yourpropfirm.com. We respond within 30 days and will not charge you for a first request. We may ask for proof of identity before releasing data.
If you are in the EEA or UK you can also complain to your local supervisory authority. We would rather you came to us first so we can put it right.
09Children
The platform is a business tool sold to firms, and is not directed at anyone under 18. Firms running on YourPropFirm are responsible for enforcing their own minimum-age rules through the KYC configuration.
If you believe a minor's data has reached us, email privacy@yourpropfirm.com and we will work with the controlling firm to remove it.
10Changes to this policy
We version this document. Material changes are announced to customer administrators at least 30 days before they take effect, and the version number and effective date at the top of this page always reflect what is currently in force.
Superseded versions are available on request so you can see exactly what changed and when.
11Contacting us
Data protection enquiries: privacy@yourpropfirm.com
Security reports: security@yourpropfirm.com
YourPropFirm is part of Quant Technology Group. Our registered entity details and the address for formal notices are provided in your Master Services Agreement, or on request.
Need a DPA or a security review?
We keep a standard data-processing agreement, a sub-processor list, and a completed security questionnaire ready to send. Most procurement teams get what they need in one email.