01 Data Controller
The data controller responsible for your personal information is Sun Capital FX (SC) Ltd, registered at 9A CT House, Providence, Mahé, Seychelles, under registration number 8423606-1. Regional processing also occurs at SUN CAPITAL MARKETS LTD — SUPREME FX · Dubai Branch (DET Licence No. 1273677) and our SECP-registered Pakistan entity.
02 Information We Collect
We collect the following categories of personal data:
2.1 Information you provide
- Name, date of birth, nationality, and contact details;
- Government-issued identification and proof of address;
- Financial information including source of funds and source of wealth;
- Trading preferences and account settings;
- Communications with our support and compliance teams.
2.2 Information we collect automatically
- IP address, device type, browser, and operating system;
- Login times, session duration, and pages visited;
- Trading activity — orders, positions, P&L, deposits and withdrawals;
- Cookies and similar tracking technologies (see Section 9).
2.3 Information from third parties
- Identity verification providers and credit reference agencies;
- Sanctions and politically-exposed-person screening services;
- Payment service providers and banking partners.
03 How We Use Your Data
Your personal data is used for the following purposes:
- Account opening and management — verifying identity, opening accounts, and processing transactions;
- Regulatory compliance — meeting AML/KYC, tax reporting, and record-keeping obligations;
- Service delivery — executing trades, processing deposits and withdrawals, and providing customer support;
- Risk management — monitoring for fraud, market abuse, and unauthorised activity;
- Marketing — sending updates and offers where you have consented or where we have a legitimate interest;
- Legal defence — protecting our rights in the event of a dispute.
04 Legal Basis for Processing
We rely on the following legal bases under GDPR:
| Purpose | Legal Basis |
|---|---|
| Account opening & KYC | Contract · Legal obligation |
| Trade execution | Contract |
| AML monitoring | Legal obligation |
| Marketing emails | Consent · Legitimate interest |
| Fraud prevention | Legitimate interest |
05 Data Sharing and Disclosure
We share your data only where necessary and only with parties bound by confidentiality obligations. Recipients include:
- Regulatory authorities (FSA, DET, FSCA, SECP) on lawful request;
- Identity verification and sanctions screening providers;
- Payment processors and banking partners;
- Liquidity providers and execution venues — anonymised where possible;
- Professional advisors (auditors, legal counsel);
- Cloud hosting and IT service providers under data processing agreements.
We do not sell your personal data to third parties.
06 International Transfers
Because we operate across Seychelles, the UAE, Pakistan, the UK, and the EU, your data may be transferred to jurisdictions outside your own. Where we transfer data from the EEA, we rely on Standard Contractual Clauses or adequacy decisions to ensure appropriate safeguards.
07 Data Retention
We retain personal data for as long as necessary to provide services and to comply with our legal obligations. Under AML regulations, we are required to retain client records for a minimum of five years after the end of the business relationship. Marketing data is retained until consent is withdrawn.
08 Your Rights
Under GDPR and similar laws, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete information;
- Erase data where we no longer have a lawful basis to keep it;
- Restrict or object to certain processing activities;
- Port your data to another provider in a machine-readable format;
- Withdraw consent for marketing at any time.
To exercise any of these rights, email compliance@SunCapitalFX.com. We respond within 30 days.
09 Cookies and Tracking
We use cookies and similar technologies to keep you logged in, remember preferences, measure website performance, and (where consented) deliver relevant marketing. You can control cookies through your browser settings; disabling essential cookies may affect platform functionality.
10 Security
We protect your data using bank-grade safeguards including 256-bit SSL/TLS encryption, firewalls, two-factor authentication, and role-based access controls. Internal access to client data is restricted to trained personnel bound by confidentiality agreements.