Privacy Policy
This policy explains what personal data Evolution Zenith collects, why each category is collected, on what legal basis, who receives it, how long we keep it and the rights you can exercise over it. It is written to be read, not skimmed past a checkbox.
Definitions
"Personal data" means any information relating to an identified or identifiable person, such as a name, email address or phone number. "Processing" covers anything done with that data: collecting, storing, consulting, transferring or erasing it. The "controller" decides why and how data is processed; a "processor" handles it on the controller's instructions. "You" is the visitor or registered user of the platform; "we" is Evolution Zenith acting as controller for the data described here.
Personal data we collect
Account data: first and last name, email address, phone number and password stored only as a cryptographic hash. Identity verification data: government identity document copies, address evidence and, where required, selfie or liveness captures. Transaction data: deposits, withdrawals, trading activity and the balances they produce. Communication data: the content of your messages to support and our replies, and call records where you request telephone support. Usage data: pages visited on the site, approximate device and browser characteristics, and referral source.
Usage data and cookies
Cookies and similar browser storage are used for three purposes: keeping you signed in during a session, remembering interface preferences such as dismissed notices, and aggregate measurement of traffic through the analytics slot described below. Sessions and preference cookies are functional and need no separate consent; measurement cookies activate only when an analytics identifier is configured. You can clear or block cookies in your browser at any time; the site keeps working, with preferences forgotten and manual sign-in each visit. We do not use cookies to build advertising profiles.
Controller and processors
Evolution Zenith, reachable at [email protected], is the controller of the data described in this policy. Processors acting on our instructions include our hosting provider, identity verification services, email delivery services and the analytics provider when active. Processors are bound by written agreements that restrict them to our instructions, require appropriate security and prohibit use of your data for their own purposes.
Collection and use of information
We use account data to create and operate your account; identity data to meet verification obligations; transaction data to execute, reconcile and monitor activity; communication data to answer you and keep a record of what was agreed; and usage data to keep the site working and understand, in aggregate, which pages help users. We do not collect special-category data beyond what identity verification lawfully requires, we do not profile you for automated decision-making with legal effect, and we never sell personal data.
Legal bases and GDPR
Where the EU General Data Protection Regulation applies, our bases are: performance of a contract for account, transaction and support data; compliance with legal obligations for verification and record-keeping; legitimate interests in operating and securing the service, such as fraud prevention and aggregate analytics; and consent, separately given and withdrawable, for marketing communications and optional cookies. Where local law in your market provides equivalent protections under another name, this policy meets those requirements as well.
Data retention
Account and communication records are kept while the relationship is active and for a reasonable period after closure for dispute and accounting purposes. Identity verification data is retained for the period anti-money-laundering rules require, which typically extends beyond the relationship itself. Transaction records follow tax and accounting retention periods. Usage data in aggregate, non-identifying form may be kept longer. When retention ends, data is deleted or irreversibly anonymised; backups age out on a fixed cycle.
Transfers of data
Some providers we rely on operate outside your market. Where personal data is transferred internationally, we use the instruments the law provides: adequacy decisions where they exist, standard contractual clauses otherwise, and supplementary safeguards where needed. The list of current processor locations is maintained by the compliance function and provided on request together with the safeguards applied.
Disclosure of data
We disclose personal data only to: processors listed above acting on instructions; the licensed entities delivering the trading service you are onboarded to; payment institutions involved in your deposits and withdrawals; professional advisers under confidentiality; and regulators, courts or other competent authorities where the law compels it. We do not disclose data to data brokers, advertising networks or social platforms, and we contest fishing expeditions where lawfully possible.
Security of processing
Technical and organisational measures protect data in transit and at rest, as described on the Security page: TLS for transport, encryption for stored documents, role-restricted access, logged administrative actions and segmentation between systems. No measure makes processing immune to all risk, so incident response exists too: containment, assessment, notification of supervisory authorities and affected users where required, and a written post-incident review.
Your rights as a data subject
You may request access to your data and a copy of it; correction of inaccurate data; erasure where retention has no legal basis; restriction of processing while a dispute over accuracy is resolved; objection to processing based on legitimate interests; and portability of data you provided, in a machine-readable format. Consent-based processing can be stopped by withdrawing consent at any time. Requests are free of charge in ordinary cases, answered within one month, and extendable by two months for genuinely complex cases with notice. Send requests to [email protected]; identity verification applies before disclosure, to prevent your data being handed to someone else.
Service providers
The current categories of processors are: hosting and infrastructure; identity verification and document checking; email delivery; FX rate provisioning for the calculator; and analytics, when configured. Each receives only the data its function requires. The list changes as providers change, and the categories above always describe what is in place at publication of this policy.
Analytics
The site carries a slot for a Google Analytics identifier that is left empty unless the site operator configures it. When configured, Analytics measures aggregate traffic: pages viewed, session origin, device class. Where consent is required in your market for such measurement, it is requested before activation, and refusal leaves the site fully functional. Analytics data is used to improve the site, not to identify individual visitors.
Advertising and retargeting
We do not run advertising pixels or retargeting tags on this site. If a future marketing campaign requires them, the tools will be consent-gated in markets where that is required, disclosed in this section and documented with their data flows before activation. Marketing emails we send ourselves carry an unsubscribe link, and unsubscribing works immediately and permanently.
Links to third-party sites
Links leaving this site lead to resources we do not control, with their own privacy rules: exchanges, payment providers, regulators' public pages. This policy stops at our boundary; reading the destination's own policy is your best protection, particularly where the link leads to a sign-in form. We never frame third-party sign-ins inside our pages.
Children's privacy
The services are intended solely for adults and are not directed at minors. We do not knowingly collect data from anyone below the legal age in their jurisdiction. If we learn that a minor has provided personal data, we delete it promptly and close the account. Parents or guardians who believe a minor has registered can reach us at [email protected] and will receive written confirmation of deletion.
Changes to this policy
We may update this policy to reflect changes in processing, providers or law. Material changes are announced on the platform notice board, and the revision always takes effect from publication on this page. The version you accepted at registration, together with each published revision, governs the processing that happened during its validity, so history is never quietly rewritten.
Contact us
For any privacy matter, including requests, questions or complaints about this policy, write to [email protected]. A privacy-related complaint is handled under the same procedure as any other complaint, and you additionally retain the right to lodge a complaint with your local supervisory authority. We answer every privacy request in writing, including our reasoning where a request cannot be met in full.