Privacy policy

1. Controller

The controller is Trade Arena.

Privacy and support email: support@tradearenahq.com.

You can also use our contact form and select “Help with TradeArena”.

2. Scope of this policy

This policy applies to the website, web and mobile applications, private leagues, subscriptions, support communications and other features offered under the TradeArena brand.

TradeArena is a simulation service. Portfolio and transaction data described in this policy concern simulated activity, not real investments or financial accounts.

3. Personal data we process

Depending on how you use TradeArena, we may process account and identity data; verified email and identity provider; display name, date of birth, language, preferences and avatar; session identifiers, IP address or pseudonymous fingerprints, device, browser and security events; and the version, language and presentation or acceptance date of legal documents.

To operate leagues we process memberships, invitations, rules, selected companies, simulated orders and transactions, positions, portfolio allocation, return, ranking and audit events.

For subscriptions and billing we process the plan, customer, subscription, invoice and payment references, billing address, country, taxes, refunds and contract status. TradeArena does not store full card numbers or security codes.

We may also process notifications and delivery data; name, email, company, team size, reason and message from the contact form; and, if you enable mobile notifications, an installation identifier and push token.

Please do not include health data, biometric information, identity documents, bank details, passwords or other particularly sensitive data in forms, avatars or messages.

4. How we obtain data

We obtain data directly from you when you create and use an account, complete your profile, participate in leagues, purchase a subscription or contact us; from your identity provider when you choose to sign in through one; from the payment provider about payments, subscriptions, invoices, taxes, refunds or fraud; from other members when they invite you to a league; and automatically when technical, session, security or audit data is generated.

When another person provides your email to invite you, we use it only to manage the invitation, protect the service and prevent abusive sending. The invitation communication states who sent it, why we received your address and where to read this policy.

5. Purposes, legal bases and retention

Account, profile, age check, leagues and simulation: we process identity, email, date of birth, language, profile, memberships, rules and simulated activity to perform the contract. Active data is kept while you maintain the account; the integrity and claims periods in this policy then apply.

Subscriptions, payments and taxes: we process identity, billing address, plan and payment references to perform the contract and comply with legal, tax and accounting duties. Documents that must be retained are kept during the contract and for up to six years.

Authentication, security and abuse prevention: we process sessions, IP address or pseudonymous fingerprints, device, audit and incidents to perform the contract and pursue our legitimate interest in protecting accounts, people and systems. They are generally kept for up to 365 days unless an incident requires evidence to be retained longer.

Invitations: we process the recipient email, league, inviting person and status on the basis of the legitimate interest in enabling member-requested invitations and preventing abuse. The email is anonymised 30 days after the invitation is resolved or expires; operational history without the email may be kept for up to 365 days.

Transactional communications: we process email, language, event type and delivery status to perform the contract. Operational traceability may be retained for up to 365 days; suppressions needed to prevent further sending are kept while applicable.

Support and contact: we process name, email, company, subject and message to perform the contract, take pre-contractual steps or pursue the legitimate interest in answering the enquiry. Data is kept for up to 12 months after closure unless it becomes part of a contract or claim.

Push notifications: we process installation, token and preferences when you request this feature. They are kept until you disable notifications, withdraw permission or the installation becomes invalid.

Legal evidence and claims: we process legal versions, language, dates and related data to perform the contract, comply with duties and establish or defend rights. It is kept during the contract and for up to five years after termination, unless a longer legal period or an open claim applies.

5a. First-party aggregate measurement

We count landing visits, CTA clicks, Checkout starts and Founder activations using only the event type, language, plan and a closed page location.

We do not associate these metrics with a person, account, session or persistent fingerprint. We also do not log full URLs, referrers, UTM parameters, email addresses, amounts or financial data. The transient HMAC fingerprint used to limit abuse is not part of the event, metrics or logs.

6. Information visible to other people

Leagues are private and are not publicly listed. Only people with a valid membership may access them.

Within a league, other members may see your display name, avatar or initials, plan and badges; selected companies; percentage portfolio allocation; return, ranking position and certain shared simulated activity.

They cannot see your quantities, available balance, total value, private prices, fees, email address, pending orders or detailed financial history. Owners or administrators may see the email addresses of pending invitations they manage.

Someone outside a league cannot find it or access its information even if they know a link or identifier.

7. Recipients and provider categories

To provide TradeArena, we may disclose strictly necessary data to providers of identity and authentication; hosting, content delivery networks and cloud computing; databases and storage; payments, billing and tax; email and support; mobile notifications; and business graphic resources.

Advisers, auditors and professional providers may also receive data where needed for legal, tax, accounting or security duties, as may authorities, courts and public bodies where required by law or a valid request.

Each category receives only the data needed for its role. When a provider acts as a processor, it is subject to a data processing agreement, confidentiality duties and security measures.

Payment, identity or other providers may act as independent controllers for certain operations, such as fraud prevention, managing their own account or complying with legal duties. Their privacy policies describe that processing.

When the browser requests logos or other external resources directly, the provider may receive the IP address and ordinary technical connection data.

TradeArena does not sell personal data, disclose it to data brokers or use it for behavioural advertising.

You can request information about the specific recipients that received your data by writing to support@tradearenahq.com.

8. International transfers

Some providers or subprocessors may process data from countries outside the European Economic Area, particularly the United States.

Where an international transfer occurs, TradeArena uses a GDPR-recognised mechanism, such as a European Commission adequacy decision, the EU–US Data Privacy Framework where applicable, Standard Contractual Clauses or other appropriate safeguards accompanied, where required, by supplementary measures.

Selecting a European technical region does not necessarily exclude international access by a provider or its subprocessors.

You can request further information about applicable countries, recipients and safeguards, and a copy of those safeguards, by writing to support@tradearenahq.com. We may redact only confidential information that does not affect your rights.

9. Your rights

You may exercise the rights of access, correction, deletion, objection, restriction and portability; withdraw consent where processing relies on it, without affecting prior lawfulness; and not be subject to solely automated decisions that produce legal or similarly significant effects.

You can export your data or request deletion from Account. You may also exercise any right by writing to support@tradearenahq.com or using the contact form.

We may request reasonable information to verify your identity. Exercising rights is free and we normally respond within one month. The period may be extended by up to two additional months for particularly complex or numerous requests; if so, we will tell you.

If you believe your rights were not properly addressed, you may complain to the Spanish Data Protection Agency.

10. Account deletion

Deleting an account and cancelling a subscription are different operations.

Account deletion revokes sessions, removes the active identity, profile and avatar, anonymises the email, removes memberships and deletes personal notifications.

Deletion does not require erasing data we must retain for legal duties or pseudonymous records needed for the integrity of leagues, simulated transactions, the ledger, audit or defence of claims.

Backups are removed through their ordinary rotation cycle and remain unavailable for ordinary use.

11. Children

TradeArena is intended exclusively for people aged 18 or over.

We do not knowingly collect data from children. If we discover that someone under 18 created an account, we will take steps to close it and delete or anonymise the data, except for evidence that must be retained for legal or security reasons.

12. Automated decisions and profiling

TradeArena automatically calculates rankings, returns, plan limits and simulation results. These calculations are part of the game, produce no legal effect, do not determine access to credit or investments and award no economic prizes.

TradeArena does not make decisions based solely on automated processing that produce legal or similarly significant effects on a person.

Payment and other providers may apply their own automated security or fraud-prevention systems. Their policies and the rights available against them also govern that processing.

13. Security

We apply technical and organisational measures designed to protect data, including access control, environment separation, encrypted communications, private avatar storage, protected sessions, log minimisation and controls against unauthorised access and abuse.

No system is completely infallible. If a security breach is likely to result in a high risk to your rights and freedoms, we will tell you where required by applicable law.

14. Cookies and similar technologies

The use of cookies, local storage and similar technologies is explained in the Cookie Policy.

Presentation or acceptance of this Privacy Policy does not constitute consent to optional cookies or processing. Any required consent will be requested separately and may be withdrawn as easily as it was given.

15. Changes to this policy

We may update this policy because of legal, technical, security or service changes. Each version will have an identifier and effective date.

If a change is material, we will tell you before it takes effect through the application, email or another appropriate medium. Changes do not retroactively legitimise processing that was unlawful when carried out.

16. Contact

For privacy enquiries, rights requests or complaints, write to support@tradearenahq.com. You can also use our contact form and select “Help with TradeArena”.