Introduction

Castle Rich Limited Luxembourg ("Castle Rich", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website, trading platform, and services (collectively, the "Services").

We comply with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Luxembourgish data protection laws. By using our Services, you consent to the practices described in this Privacy Policy.

Information We Collect

We collect various types of information to provide and improve our Services:

• Identity Data: Full name, date of birth, nationality, government-issued ID numbers (passport, national ID, driver's license).
• Contact Data: Email address, phone number, residential/business address.
• Financial Data: Bank account details, source of funds, trading history, transaction records.
• Professional Data: Employment status, occupation, employer details, investment experience.
• Technical Data: IP address, browser type, device information, operating system.
• Usage Data: Login times, pages visited, trading activities, feature usage.

As a regulated financial services provider, we may collect sensitive personal information as part of our AML/KYC obligations, including information about your financial status and criminal record checks where required by law.

How We Use Your Information

We use your personal information for the following purposes:

• Account Management: To create and maintain your account, process transactions, and provide customer support.
• Regulatory Compliance: To fulfill our AML/KYC obligations under Luxembourgish and EU law.
• Service Improvement: To analyze usage patterns and improve our Platform and Services.
• Communication: To send you important notices, confirmations, and marketing materials (with your consent).
• Security: To monitor for unauthorized access, fraud, and other security incidents.
• Legal Obligations: To comply with applicable laws, regulations, and court orders.

Legal Basis for Processing

We process your personal information under the following legal bases:

• Contract Performance: Processing necessary to perform our contract with you (e.g., executing trades, managing your account).
• Legal Obligation: Processing required to comply with laws and regulations (e.g., AML/KYC, tax reporting).
• Legitimate Interests: Processing necessary for our legitimate business interests (e.g., fraud prevention, system security).
• Consent: Processing based on your explicit consent (e.g., marketing communications).

Information Sharing

We may share your personal information with:

• Service Providers: Third-party vendors who assist with platform hosting, payment processing, data analytics, and customer support.
• Regulatory Authorities: Government agencies, regulators, and law enforcement as required by law.
• Financial Institutions: Banks and payment processors to facilitate deposits and withdrawals.
• Professional Advisors: Lawyers, auditors, and consultants who provide services to us.
• Corporate Transactions: In the event of a merger, acquisition, or sale of assets, your information may be transferred.

We do not sell your personal information to third parties for marketing purposes.

International Data Transfers

Castle Rich Limited Luxembourg operates globally, and your personal information may be transferred to and processed in countries outside your country of residence. We ensure appropriate safeguards are in place for such transfers, including:

• EU Standard Contractual Clauses
• Transfers to countries with adequacy decisions by the European Commission
• Binding Corporate Rules where applicable

By using our Services, you consent to the transfer of your information to countries that may have different data protection laws than your country.

Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest (AES-256)
• Multi-factor authentication for system access
• Regular security assessments and penetration testing
• Access controls based on the principle of least privilege
• Employee training on data protection and privacy

While we strive to protect your information, no transmission over the internet is completely secure. We cannot guarantee absolute security.

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, including:

• Active Accounts: For the duration of your account relationship with us.
• Regulatory Requirements: For up to 10 years after account closure to comply with AML/KYC and tax laws.
• Legal Claims: For the duration of applicable statute of limitations periods.
• Legitimate Interests: As necessary for fraud prevention, security, and business analysis.

After retention periods expire, we securely delete or anonymize your personal information.

Your Rights

Under GDPR and applicable laws, you have the following rights regarding your personal information:

• Right to Access: Request a copy of your personal information.
• Right to Rectification: Correct inaccurate or incomplete information.
• Right to Erasure: Request deletion of your information (subject to legal retention requirements).
• Right to Restrict Processing: Limit how we use your information.
• Right to Data Portability: Receive your information in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: Withdraw consent where processing is based on consent.
• Right to Lodge a Complaint: File a complaint with the Luxembourg data protection authority (CNPD).

To exercise these rights, please contact us at privacy@castlerck.com. We will respond within 30 days.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our Site. Cookies are small text files stored on your device.

Cookie Policy.

Third-Party Links

Our Site may contain links to third-party websites. This Privacy Policy does not apply to those sites. We are not responsible for the privacy practices of third parties. We encourage you to review their privacy policies before providing personal information.

Children's Privacy

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we discover that we have inadvertently collected information from a child, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy on our Site and Platform
• Sending an email notification to registered users
• Displaying a prominent notice on our Platform

The "Last Updated" date at the top of this page indicates when the policy was last revised. Your continued use of our Services after changes constitutes acceptance of the revised policy.

Contact Information

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: