Privacy policy

1. Who we are

Croftvex ("we", "us", "our") operates croftvex.com and is the controller of the personal data collected through it. We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You can contact us about anything in this policy at [email protected].

2. The data we collect

• Identity and contact data: your first name, last name, email address and telephone number when you complete one of our forms.
• Technical data: your IP address, approximate location derived from it, browser type, device information and the pages you view.
• Campaign data: referral identifiers and campaign parameters attached to the link that brought you to the site.
• Correspondence: the content of any messages you send us and our replies.

3. How we use your data

We use your data to respond to your registration or enquiry, to arrange for a member of our team or an onboarding partner to contact you, to verify your identity and prevent fraud, to keep the website secure and working properly, to understand which campaigns bring visitors to us and to meet our legal and regulatory obligations.

4. Our lawful bases

We rely on taking steps at your request before entering into a contract (when you register), our legitimate interests in running and improving our business (where those interests are not overridden by your rights), compliance with legal obligations (such as anti-money laundering checks) and, where required, your consent. Where we rely on consent, you can withdraw it at any time.

5. Who we share data with

When you register, your details are passed to the account-opening and onboarding partners who help us contact you and complete activation. We also share data with service providers who host our website, deliver our emails and provide security and analytics services, all under contracts that require them to protect it. We may disclose data to regulators, law enforcement or courts where the law requires. We do not sell your personal data.

6. International transfers

Some of our partners and providers process data outside the United Kingdom. Where they do, we rely on UK adequacy regulations or put appropriate safeguards in place, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. How we protect your data

Forms on this site are submitted over encrypted HTTPS connections. Access to personal data is restricted to people who need it for their role, and our systems are monitored and tested regularly. No method of transmission or storage is completely secure, but we work to protect your data against loss, misuse and unauthorised access.

8. How long we keep it

We keep personal data only for as long as we need it for the purposes above. Enquiries that do not lead to an account are normally deleted within 24 months. Where an account is opened, records required under anti-money laundering rules are kept for five years after the relationship ends.

9. Your rights

You have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability and to withdraw consent. To exercise any of these rights, email [email protected]. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

10. Cookies and similar technologies

We use a small number of technologies under the Privacy and Electronic Communications Regulations (PECR):

• croftvex_ticker: a functional cookie that caches market prices for 24 hours so the price ticker loads quickly.
• Browser storage: your form details are held briefly in your browser's local storage so they can be passed on from the confirmation page after you register.
• Campaign measurement: if you arrive through an advertising link that carries a measurement identifier, a third-party pixel may record that a registration took place.

Our fonts, form components and price data are loaded from third-party services that receive your IP address in order to deliver them. Where the law requires your consent for a non-essential technology, we will ask for it first.

11. Age restriction

Our services are intended only for adults aged 18 or over. We do not knowingly collect data from anyone under 18, and we delete any such data we discover.

12. Changes and contact

We may update this policy from time to time, and the date at the top of this page shows when it last changed. Questions or requests about your personal data can be sent to [email protected].