The objective of UCapital24 S.p.A. and Ucapital Investment Ltd (the “Companies,” the “Joint Controllers,” or “We“) is to synergistically provide a Proprietary Trading service, (hereinafter “Prop“) which consists of a “trading challenge” for the purpose of testing one’s skills, within the prescribed rules, of trading financial instruments through the opening of demo trading accounts, i.e., without the use of real money.     

The Joint Controllers have signed a joint data controller agreement, the excerpt of which is available at their offices, for the purpose of defining, pursuant to Article 26 of Regulation (EU) 2016/679 (hereinafter, “GDPR”), the processing of personal data carried out under joint controllership for the administrative, organizational, accounting and promotional/marketing management of the activities and services rendered jointly by the two Companies.

The Joint Controllers wish to provide Data Subjects with certain information regarding the processing of their personal data, as defined below, which they may collect and process through the website https://ucapitalinvestment.com on which it is possible to purchase the Prop service, in the quality of User of the website or Customer of the services rendered.

Where not otherwise specified, this Policy applies as a disclosure – pursuant to Articles 13 and 14 of Regulation (EU) No. 2016/679 (hereinafter the “GDPR“) – made to those who interact with the above site (“Users“, “Interested Parties“, or “You“).

1. Joint Controllers. Data processors.

In relation to personal data collected for the use of services available on the website https://ucapitalinvestment.com , the Joint Controllers are:

UCapital24 S.p.A., with registered office at Via dei Piatti 11, 20123, Milan (MI), C.F. and P.IVA 10144280962. The updated list of data processors is available upon request at the office of the Joint Controller.

UCapital Investment Ltd with registered office at Salisbury House, 81 High Street, Potters Bar, Hertforfshire, United Kingdom, EN6 5AS, Company Number: 13244044. An up-to-date list of data processors is available upon request at the offices of the Joint Controller.

The Joint Controller hold in the highest regard the right to privacy and the protection of their Users’s personal data. For any information in relation to this privacy policy, Users may contact, as the designated point of contact by the Joint Controllers themselves, Ucapital24 S.p.a.

However, it remains the right of the Data Subjects to contact indifferently both Joint Controller at any time, using the following methods:

For UCapital24 S.p.a by writing an e-mail to privacy@ucapital24.com or by sending a registered letter with return receipt to the company’s registered office at Via dei Piatti 11, 20123, Milan (Mi).

For UCapital Investment Ltd by writing an e-mail to support@ucapitalinvestment.com or by sending an international registered mail to the company’s registered office at Tallis House, 2 Tallis Street, London, United Kingdom, EC4Y 0AB.

2. Data Protection Officer.

The Joint Controller UCapital24 S.p.A. has appointed a Personal Data Protection Officer (“RDP” or “DPO“), pursuant to Article 37 of the GDPR, who is responsible for supervising compliance with the legislation protecting personal data and acting as a point of contact for Data Subjects and whom you can contact for any needs inherent to the processing of personal data by writing to the following e-mail address: dpo@ucapital24.com .

3. Categories of personal data processed, source from which they originate, and why we use Data Subjects’s data. Purposes and legal basis for processing.

Following is a list of all the purposes for which we collect Users’s personal data, Purposes and legal basis for processing, Legitimate interests pursued.

Personal data collected will be processed:

a) For navigation of the website and activities related to the functioning and operation of the web page:

1. Purpose of processing: to enable web browsing and, in the case of computer crimes, to ascertain possible liability.
2. Data processed: The computer systems and software procedures used to operate this web page acquire, in the course of their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes IP addresses, domain names, URIs.
3. Legal basis: i. Provision of services aimed at enabling users to navigate this website; ii. Legitimate interest consisting in ensuring the proper functioning of information systems and to proceed with the investigation of possible crimes (possibly also on the basis of the existence of a legal obligation) pursuant to Art. 6, c. 1, lett. f) of the GDPR.
4. Retention period: 30 days following the date of collection, unless legal provisions or orders of Public Authorities impose a different retention time in connection with investigations related to possible computer crimes.

b) Online purchasing of Prop services:

1. Purposes of the processing: fulfillment of purchase orders placed online and performance of related activities (sending the confirmation e-mail and login credentials for the service, or sending the software, invoicing, payment management, possible activation of the order return and refund process, return management, etc.).
2. Data processed: contact data (first name, last name, e-mail address, phone number, data for billing purposes). In the event of a return, we will also ask you to provide us with your IBAN code, in case the purchase was made using that payment method, which is necessary to make a refund of the service price. We do not process data related to the means of payment you have indicated (e.g., payment card number and security code), which are instead collected exclusively by the operator of the payment service you have chosen.
3. Legal Basis: The processing of such data does not require the consent of the Data Subjects as it is necessary for the performance of a contract to which the Data Subject is a party or the execution of pre-contractual measures taken at the request of the data subject pursuant to Article 6, c.1, lett b) of the GDPR .
4. Retention period: time required to fulfill contractual and regulatory obligations regarding the purchase and sale of products and services (e.g., tax regulations), usually 10 years from the date of purchase.
5.  

c) Customer Care:

1. Purposes of the processing: the Joint Controllers make available to Users a support service managed directly by Ucapital24 S.p.a. (via web and telegram whatsapp chat, telephone, e-mail, online form) for any request related to the purchase of our products or the use of our services.
2. Data processed: data necessary to respond to requests that will be addressed to our Customer Care (in particular, for the chat support service, we will ask you to provide your name and e-mail address).
3. Legal basis: i. execution of the contract for the purchase and sale of products or pre-contractual measures taken as a result of your request under Art. 6, c.1, lett b) of the GDPR; ii. with respect to the chat support service, legitimate interest in preventing so-called “chat spam” pursuant to Art. 6, c. 1(f) of the GDPR.
4. Retention period: time strictly necessary to fulfill the requests of data subjects. Relevant conversations are deleted weekly and no phone numbers are saved in any way.
5.  

d) Registration to the reserved area:

1. Purpose of processing: creation of a reserved area (“account”) that will allow Users to view certain content regarding their personal position and access free educational content.
2. Data processed: personal data and contact details indicated in the online form relating to the registration to the reserved area. The data essential for the use of our services are marked with an asterisk: therefore, in the absence of the provision of this information we will not be able to make available the service requested by the User.
3. Legal basis: execution of the website registration contract in accordance with Art. 6 c. 1 lett. b) of the GDPR.
4. Retention period: the account and its related data will be deleted if the account is not used for more than 3 years.
5.  

e) Sending commercial communications (for direct marketing purposes):

1. Purposes of the processing: sending commercial communications via e-mail, SMS, Whatsapp, Telegram and cell phone regarding products related to services offered by the Joint Controllers.
2. Data processed: contact data (e.g., first name, last name, e-mail address, phone number).
3. Legal basis: your consent under Art. 6, c. 1, lett. a) of the GDPR, which you can revoke at any time by writing to privacy@ucapital24.com .
4. Retention period: until the withdrawal of consent by the User.
5.  

f) To register for the newsletter service on education and training:

1. Purpose of processing: Sending of informational communications via e-mail from the Joint Controllers on a monthly basis about online and in-person training activities that will be held the following month after the receipt of the email.
2. Data processed: first name, last name, email.
3. Legal basis: the consent of the data subject (according to Art. 6 c. 1 lett. a) GDPR), which can be revoked at any time by clicking on the unsubscribe button in the footer of the emails.
4. Retention Period: the Personal Data of the Data Subject will be processed until the Data Subject decides to unsubscribe from the service, and in any case for a period not exceeding 3 years from the date of enrollment, after which the Data Subjects will be asked to renew their consent.
5.  

g) For registration for the informative newsletter service:

1. Purpose of processing: Sending of informational communications via e-mail from the Joint Controller that will have on a weekly basis and with which economic and financial updates will be provided.
2. Data processed: first name, last name, e-mail.
3. Legal basis: the consent of the Data Subject (pursuant to Art. 6 c. 1 lett. a) GDPR), which can be revoked at any time by clicking on the unsubscribe button in the footer of the emails.
4. Retention Period: the Personal Data of the Data Subjects will be processed until the Data Subjects decide to unsubscribe from the service and in any case for a period not exceeding 3 years from the date of enrollment, after which the Data Subjects will be asked to renew their consent
5.  

h) Legal obligations to which the Joint Controllers are subject:

1. Purposes of the processing: to fulfill legal obligations to which the Joint Controllers are subject (e.g. accounting, tax, administrative);
2. Data processed: tax and billing data of customers.
3. Legal basis: the processing is necessary to fulfill a legal obligation to which the Joint Controllers are subject under Art. 6, c. 1, lett. c) of the GDPR.
4. Retention Period: The co-owners will process the Personal Data of the Data Subjects for the time strictly necessary to achieve the purposes stated in the purposes.
5.  

i) Proximity marketing (soft spam) to its customers/users:

1. Purposes of processing: for the purpose of sending, by the Joint Controllers, information via e-mail (not for telephone communications)for the purpose of direct sales of products and/or services provided by the Joint Controllers (and not by third parties) regarding services similar or related to those already purchased or for which the User has registered or shown interest (so-called “soft spam“);
2. Data processed: contact data such as first name, last name, e-mail.
3. Legal Basis: If the User is already a Customer of the Joint Controllers, or has registered for certain services and there is a balancing of interests, the legal basis may consist of the legitimate interests of the Joint Controllers (pursuant to Art. 6 c. 1 lett. f) of the GDPR) and therefore consent is not required for sending advertising communications.
4. Retention period: for the duration of the existing contractual relationship with the Customer or until the User who has demonstrated interest in a service exercises his or her right of opposition to the processing of his or her personal data for marketing purposes.
5.  

j) Antifraud and establishment, exercise or defense of a right:

1. Purpose of processing: to verify the correspondence between the acquiring party and the holder of the selected payment instrument and the establishment, exercise or defense of a right of the Data Controllers, including in court.
2. Data processed: first name, last name, order details and information on the type of payment instrument used to make the purchase, more generally, no new and specific provision of Personal Data is therefore not required, as the Contractors will pursue this additional purpose by processing, where necessary, the Personal Data already collected.
3. Legal basis: legitimate interest in preventing and combating fraud and the exercise or defense of a right of the Data Controllers under Article 6(f) of the GDPR.
4. Retention period: two years after data collection or for the duration of any judgment.
5.  

4. Provision of data and consequences in case of non-provision.

The provision of personal data for the purposes under b), c) and d) is optional, but necessary to manage and process Users’s requests, as well as for the fulfillment of legal and contractual obligations on the part of the Joint Controllers. Failure to provide the data will result in the inability of the Joint Controllers to fulfill their contractual and legal obligations.

The provision of personal data for the purposes under a), h) and k) is mandatory in order to finalize orders, to follow up on contractual and legal obligations and to pursue the legitimate interests of the Joint Controllers at the points indicated in the section above. Failure to provide it will result in the impossibility of following up on the User’s requests, establishing contractual relations with the same and carrying out the activities indicated above.

The provision of data for the purposes under e), f), g), i) and j) is optional. Failure to provide data will have no consequence on the usability of the services and remains at the complete discretion of the User.

5. Recipients and possible categories of recipients of personal data.

Personal data may be made accessible to, brought to the attention of, or communicated to the following parties, who will be appointed by the Joint Controllers, as the case may be, as data processors or authorized persons, or will act as autonomous data controllers:

• employees and/or collaborators in any capacity whatsoever of the Joint Controller;
• suppliers and partners of the Joint Controllers who provide services and all activities related to the Site, IT or marketing service providers etc. appointed as data processors, through the signing of a contract;
• freelancers and consultants for the purpose of legal, financial and accounting management of the activities of the Joint Controllers (such as accounting, administrative, legal practitioners, etc.) and credit institutions and insurance companies, acting as autonomous data controllers.
• public authorities or police forces in the cases stipulated by law.

It should be noted that Data Subjects’ data will be stored in Servers located within the European Union.

6. Transfer of data to countries outside the European Union:

The personal data collected may be transferred outside the European Union. In this case, the transfer will take place in compliance with the provisions of the EU Regulation 2016/679 (“GDPR”) (in particular, the data will be transferred only after signing the Standard Contractual Clauses approved by the EU Commission by Decision No.2021/914/EU or to countries that can guarantee an adequate level of protection of personal data and therefore recipients of an Adequacy Decision adopted by the EU Commission).

7. Cookie

Cookies are small text files that visited sites send to the User’s terminal, where they are stored, and then transmitted back to the same sites on the next visit. Cookies allow sites to function properly and efficiently to enhance the user experience by allowing  from time to time relevant site to store the information in the memory of your computer or other device.

Cookies can be classified in different ways, namely according to the site that generates them, according to their duration, and according to their purpose of use.

The web page https://ucapitalinvestment.com makes use of only technical cookies that are strictly necessary for its functionality and usability.  These cookies are necessary for the operation of the site and cannot be disabled. They are usually set only in response to actions taken by Users that constitute a request for services, such as filling out modules/forms. It is possible to set the browser to block or have warnings about these cookies, but as a result some parts of the site will not work. These cookies do not store personal information.

For the above cookies, it is not necessary to acquire the User’s prior and informed consent. The legal basis for their use is the legitimate interest of the Joint Controllers in the smooth operation of the website.

Listed below are, in detail, the technical cookies installed on the https://ucapitalinvestment.com website for which, as mentioned above, prior consent is not required for their installation.

How to disable cookies by browser configuration:

In general, Cookies can be disabled by the User by checking and/or modifying the settings of his/her browser according to the instructions made available by the respective providers at the links provided below:

• Internet Explorer
• Mozilla Firefox
• Google Chrome
• Apple Safari
• Opera

More information on cookies is available at http://www.youronlinechoices.com/it .

8. Rights of Data Subjects.

The Data Subjects may exercise their rights under Articles 7, c. 3, and 15 et seq. of the GDPR by sending an e-mail to privacy@ucapital24.com, or, alternatively, a communication by registered letter with return receipt to the registered office of UCapital24 at Via dei Piatti 11, 20123, Milan (MI), identified by the Owners as the point of contact.

The Data Subjects may, in particular:

• obtain confirmation of whether or not personal data concerning him or her are being processed and the purposes of such processing;
• Access their personal data and information about the processing, and request copies of such personal data;
• Obtain correction of inaccurate personal data and supplementation of incomplete personal data;
• Obtain, if any of the conditions set forth in Article 17 of the GDPR exist, the deletion of personal data concerning him/her;
• Obtain, in the cases provided for in Article 18 of the GDPR, the limitation of processing;
• if the conditions set forth in Article 20 of the GDPR are met, receive the personal data concerning him or her in a structured, commonly used, machine-readable format and request their transmission to another data controller, if technically feasible.

Right to opposition to processing in pursuit of the legitimate interest of the Joint Controllers.

Each Data Subject has the right to object at any time to the processing of his or her personal data carried out in pursuit of a legitimate interest of the Joint Controllers. In the event of an opposition, personal data will no longer be processed, unless there are legitimate grounds for processing that override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defense of a legal claim.

Right to withdraw consent.

Where consent is required for the processing of personal data, each Data Subject may, in addition, revoke any consent already given at any time, without affecting the lawfulness of the processing based on the consent given prior to revocation. Consent may be revoked by writing an e-mail to privacy@ucapital24.com .

Right to file a complaint with the Guarantor.

Any Data Subject may lodge a complaint with the Guarantor for the Protection of Personal Data if he or she believes that his or her rights under the GDPR have been violated, in the manner indicated on the website of the Guarantor accessible at: www.garanteprivacy.it .

 9. Amendments to this policy

This policy may be subject to updates or changes (including due to new legislation or regulations) so Users are encouraged to check this document regularly. Substantial changes will in any case be highlighted via the Site or notified by e-mail.

Date of last revision: 03/04/2023