Privacy Policy

OstinFx Ltd.respects your privacy and is committed to protecting the personal data you entrust to us. This Privacy Policy describes how we handle personal data in connection with our websites, trading platforms and related services (the “Services”).

1. Data controller

The data controller responsible for your personal data is OstinFx Ltd., an International Business Company incorporated in Saint Lucia (company no. 2026-00551), with registered office at Ground Floor, The Sotheby Building, Rodney Village, Rodney Bay, Gros-Islet, Saint Lucia. You can contact our team about privacy matters using the details in the Contact section below.

2. Information we collect

We collect information that you provide to us, that we generate through your use of the Services, and that we receive from third parties such as verification and payment providers. This includes:

• Identity and contact data — name, date of birth, nationality, residential address, email address and telephone number.
• Verification data — government-issued identity documents, proof of address, photographs or selfies for identity matching, and related metadata.
• Financial data — payment and banking details, transaction history, account balances, trading activity and source-of-funds information.
• Technical data — IP address, device and browser information, login records, and usage data collected through cookies and similar technologies.
• Communications — correspondence, support tickets and records of interactions with our team.

3. How we use your information

• to establish, verify, operate and administer your account;
• to provide, maintain and improve the Services;
• to execute and settle transactions and process deposits and withdrawals;
• to meet our legal, regulatory, anti-money-laundering, sanctions and tax obligations;
• to detect, prevent and investigate fraud, abuse and security incidents;
• to communicate with you about your account, our Services and, where permitted, marketing;
• to analyse usage and performance so we can enhance our platforms.

4. Legal bases for processing

Where applicable data-protection law requires a legal basis, we rely on one or more of the following: the performance of our contract with you; compliance with a legal or regulatory obligation; our legitimate interests in operating, securing and improving our business (balanced against your rights); and your consent, which you may withdraw at any time where processing is based on it.

5. KYC and identity data

To comply with our Know Your Customer and anti-money-laundering obligations we collect and verify identity, address and source-of-funds information, and we may use third-party verification services to confirm the documents you provide. This information is processed to satisfy legal obligations and to protect against financial crime, and is retained for the periods required by law even after your account is closed. Further detail is set out in our AML & KYC Policy.

6. Cookies and similar technologies

We use cookies and similar technologies to operate our websites, remember your preferences, secure your session and understand how the Services are used. You can control non-essential cookies as described in our Cookie Policy.

7. Sharing with third parties and processors

We do not sell your personal data. We share it only as necessary to provide the Services and meet our obligations, including with:

• identity-verification, fraud-prevention and screening providers;
• payment processors, banks and liquidity providers;
• technology, hosting, analytics and communications service providers acting as our processors;
• professional advisers, auditors and, where legally required, regulators, courts and law-enforcement authorities;
• parties involved in a corporate transaction such as a merger or restructuring.

We require our processors to protect personal data under appropriate contractual and security safeguards and to process it only on our instructions.

8. International transfers

We operate internationally, and your personal data may be transferred to and processed in countries other than the one in which you reside. Where we transfer personal data across borders, we take steps to ensure it is protected by appropriate safeguards consistent with this policy and applicable law.

9. Data retention

We retain personal data for as long as necessary to provide the Services, and thereafter for the periods required to meet our legal, regulatory, accounting and record-keeping obligations, to resolve disputes and to enforce our agreements. Certain KYC and transaction records are retained for a minimum period after the end of the business relationship, as required by applicable anti-money-laundering law. When data is no longer required, we securely delete or anonymise it.

10. Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse and alteration, including encryption in transit, access controls, monitoring and staff confidentiality obligations. No method of transmission or storage is completely secure, however, and you are responsible for keeping your login credentials confidential.

11. Your rights

Depending on your jurisdiction, you may have rights to access, correct, update or delete your personal data, to restrict or object to certain processing, to data portability, and to withdraw consent where processing relies on it. You may also opt out of marketing communications at any time. We may need to verify your identity before acting on a request and may decline requests where an exemption or legal obligation applies. To exercise your rights, contact us using the details below.

12. Children

The Services are intended only for adults and are not directed at children. We do not knowingly collect personal data from anyone under 18 years of age. If we become aware that we have collected such data without appropriate authority, we will take steps to delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The current version is always available on our website, and we will indicate the date of the most recent update below. Material changes may be notified through the platform or by other reasonable means.

14. Contact

If you have questions about this Privacy Policy or how we handle your personal data, please contact us at legal@ostinfx.com, or by post to OstinFx Ltd., Ground Floor, The Sotheby Building, Rodney Village, Rodney Bay, Gros-Islet, Saint Lucia.

Last updated: 13 July 2026