Privacy Policy

01Who we are

NPE Market Limited ("NPE Market", "we", "us") is the controller of the personal data described in this policy. We are an International Business Company registered in Saint Lucia under registration number 2024-00497, with registered office at Ground Floor, The Sotheby Building, Rodney Village, Rodney Bay, Gros Islet, Saint Lucia, and an operational office at 24th Floor, The One Tower, Barsha Heights, P.O. Box 390114, Dubai, United Arab Emirates. We operate www.npemarket.com and the Client Portal at my.npemarket.com.

For anything to do with your personal data, write to [email protected]. You will get a reply from a person, not a form.

02What this policy covers

This policy explains what personal data we collect, why we collect it, what we do with it, who we share it with, how long we keep it, and the rights you hold over it. It applies to visitors to our website, applicants for an account, clients, former clients, introducing partners, strategy providers on our Copy Trading service, managers of and investors in pooled (PAMM) accounts, and anyone who contacts us.

It should be read with our Cookie Policy, our AML & KYC Policy and the Client Agreement. Section 10 is the part most people are looking for, and section 11 explains the one request we cannot grant.

03The law we apply

We process personal data in accordance with the Data Protection Act, Cap. 8.18 of the Revised Laws of Saint Lucia, to the extent it is in force, and with the data protection principles it sets out: lawfulness and fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.

Where you are located in the European Economic Area or the United Kingdom, our processing of your data is also subject to the General Data Protection Regulation, and the rights it gives you are available to you in full. Where the law of another country applies to our processing of your data, we comply with it.

Some data subject rights under the Saint Lucia Act have not yet been brought into force. Rather than rely on that, we extend the core rights in section 10 to every client, wherever they live, as a matter of policy.

04What we collect

We do not seek special-category data such as health, religious belief, political opinion or trade union membership. If you volunteer it, we will not use it. In particular, we do not require you to declare or evidence a religious observance in order to open a swap-free (Islamic) account, and we do not record one. Where a facial image is processed for liveness verification, it is used only to confirm that you are the person in your identity document.

05Where it comes from

• From you — when you apply for an account, upload documents, trade, fund your account, or contact us.
• From your device — automatically, when you use our website, trading platform or programmatic interfaces. See our Cookie Policy.
• From third parties — identity verification and electronic data providers; sanctions, politically exposed person and adverse media databases; payment providers and banks; the introducing partner who referred you; and competent authorities.

06Why we use it, and on what basis

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and we will explain that assessment on request.

07Automated processing and profiling

We use automated systems to analyse account activity. You should know this, because some of it can lead to a decision that affects you:

No measure that restricts your account, voids a transaction, delists a strategy, suspends a pool or terminates the relationship is applied by a machine alone. A person reviews the analysis, and you are notified and given an opportunity to respond before such a measure becomes final, except where an immediate risk requires us to act first — in which case you are notified within two business days.

You may ask for an explanation of an automated analysis affecting you, ask for the underlying trade-level data, contest the outcome, and require human review.

• Anti-money-laundering monitoring — automated rules flag unusual funding, trading or withdrawal patterns for human review.
• Risk scoring — an automated score determines the depth of due diligence applied to your file and how often it is reviewed.
• Trading pattern analysis — automated measures of order flow are used to identify the prohibited practices set out in the Client Agreement.
• Copy Trading and PAMM figures — provider statistics, pool shares, high-water marks and fees are computed automatically from account records, and divergence between a provider or manager account and the accounts or shares depending on it is monitored.
• Applicant matching — a new application is checked against retained records, so that a person whose earlier account was closed or terminated is recognised. See section 11.

08Who we share it with

We do not sell your personal data, and we do not share it for another organisation's marketing. We share it only with:

Every processor acting on our behalf is engaged under a written contract requiring them to act only on our instructions, to keep the data secure, and to return or delete it when the engagement ends.

• technology and platform providers, including trading platform, bridge, hosting, CRM and communications providers, who process data on our instructions;
• identity verification, sanctions screening and fraud prevention providers;
• banks, payment institutions and card acquirers, so that your deposits and withdrawals can be processed;
• liquidity and execution providers, in the form of anonymised or aggregated order data — they do not receive your identity;
• professional advisers such as auditors, lawyers and accountants, bound by confidentiality;
• the introducing partner who referred you, limited to the fact of your registration and aggregate volume — a partner never receives your identity documents, your balances or your withdrawal details;
• other users of the Copy Trading service, where you are a strategy provider — limited to your display name and the statistics we calculate from your trading. A provider never receives a follower's identity, and a follower never receives a provider's personal details;
• the manager of a pooled account you invest in, limited to the size and timing of your investment and your percentage share — a manager does not receive your identity documents or your contact details, and other investors in the pool receive nothing about you at all;
• courts, regulators, tax authorities, financial intelligence units and law enforcement, where we are required or permitted to disclose — including reports we are obliged to file with the United States Financial Crimes Enforcement Network as a registered Money Services Business;
• a purchaser or successor, if the business or part of it is transferred, subject to the same protections.

09International transfers

We operate internationally, and your data may be processed in countries other than the one you live in — including Saint Lucia, the United Arab Emirates where our operational office is located, member states of the European Union, and other countries where our service providers operate.

Where data is transferred out of a territory whose law restricts such transfers, we rely on an appropriate safeguard: an adequacy decision where one exists, or contractual clauses approved for that purpose, or your explicit consent where neither is available. You may ask us which safeguard applies to a particular transfer.

10Your rights

You may ask us to:

Write to [email protected]. We respond within thirty (30) days, and will tell you if a request is complex and needs longer. There is no charge. We will verify your identity before acting, so that no one else can exercise your rights.

• Give you a copy of the personal data we hold about you, and tell you how we use it.
• Correct it if it is inaccurate or incomplete.
• Delete it where we no longer have a lawful reason to keep it. Much of what we hold is subject to the retention obligation in section 11, and we cannot delete that before the period ends — but everything outside it, we will.
• Restrict or object to processing that relies on our legitimate interests, including profiling. We will stop unless we can show compelling grounds that override your interests.
• Receive your data in a portable format where we process it by automated means on the basis of consent or contract.
• Withdraw consent at any time where we rely on it. This does not affect the lawfulness of what we did before you withdrew it.
• Object to marketing at any time, with no reason required and no effect on your account.

11Verification records: why we cannot delete them on request

This section exists because it is the single most common request we receive, and because you are entitled to a straight answer rather than a deflection.

The position

The identity, address and payment-ownership documents you provide, the checks we run on them, and the record of the decision we reached are records we are required to create and required to keep. We retain them for seven (7) years from the end of our relationship with you.

Within that period we cannot delete them, and a request that we do so will be declined. That applies however the request is framed, whichever channel it arrives through, and whether it is presented as a support request, as a data protection request, or as a condition of closing your account. We will not agree to it in order to end a conversation and then not do it; we would rather tell you now.

Why

The obligation arises from the Money Laundering (Prevention) Act, Cap. 12.20, the Proceeds of Crime Act, Cap. 3.04 and the Anti-Terrorism Act, Cap. 3.16 of the Revised Laws of Saint Lucia, and from the record-keeping duties that attach to our registration with FinCEN as a Money Services Business. It is not a policy we chose and it is not applied selectively.

There is also a plainer reason. A verification file that its own subject could erase on request would not do the job the law requires of it. The point of holding the record is that it remains available to be checked — including against a later application in the same name.

What we will do instead

If you no longer want an account with us, tell us and we will act on it. At your request we will:

Either step ends your exposure to the market and your relationship with us. Neither deletes the verification record, and we will not tell you otherwise.

How a retained record is held

In confidence, and not as an active account. Access is restricted to compliance staff who need it for their role, and every access is logged. It is never used for marketing, never sold, never shared with an introducing partner, and never transferred except to a processor bound by written confidentiality obligations, or to a court, competent authority or financial intelligence unit making a lawful request. The security measures in section 13 apply to it in full, and at the end of the retention period it is deleted or irreversibly anonymised without any request from you.

What it means if you come back

Because the record persists, a person whose account was closed or terminated cannot obtain a fresh account by presenting the same identity as a new applicant. Where a new application matches a retained record we will link the two, and where the earlier account was terminated for a prohibited practice, for false information, or for a matter we were required to report, we may decline the new application. Deleting the file on request would make that check impossible — which is precisely why the request cannot be granted.

If the GDPR applies to you

The right to erasure under Article 17 is real, and we honour it. It is also expressly subject to an exception where processing is necessary for compliance with a legal obligation to which the controller is subject, and the retention described above falls within that exception. So the right is not extinguished — it is limited to the data outside the obligation, and over that data it operates in full. If you would like the reasoning applied to your specific file, ask, and we will set it out.

• 1. Close the account and return the balance properly due to you, by a verified method in your own name; or
• 2. at our discretion and at your request, suspend the account, so that it cannot be traded, funded or accessed while it stays on file.

12How long we keep it

When a retention period ends, data is deleted or irreversibly anonymised.

13Security

We apply technical and organisational measures appropriate to the sensitivity of the data: encryption in transit and at rest, access restricted to staff who need it for their role, multi-factor authentication on administrative systems, logging of access to client records, segregation of environments, staff confidentiality obligations and training, and contractual security obligations on our processors.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to you, we will notify you and the relevant authority without undue delay, tell you what happened, what data was involved and what we are doing about it.

Two things you can do: keep your credentials to yourself — including any API key — and remember that we will never ask you for your trading password. Anyone who does is not us.

14Marketing

We send marketing only where you have consented. Every message contains an unsubscribe link that works immediately, and you can also change your preferences in the Client Portal or write to us.

Opting out of marketing does not stop service messages — statements, margin notifications, security alerts and changes to our terms — because those relate to the operation of your account and we are obliged to send them.

15Children

Our services are not offered to anyone under 18, and we do not knowingly collect data about children. If we discover that an account has been opened by a minor, we will close it and delete the data except what we are legally required to keep.

16If you are unhappy with how we handle your data

Tell us first, at [email protected], or raise a formal complaint at [email protected]. Our Complaints Handling Policy sets out the timeframes.

You may also complain to the Data Protection Commissioner of Saint Lucia. If you are in the European Economic Area or the United Kingdom, you may complain to the supervisory authority in your country of residence, place of work, or where you believe the issue occurred. Complaining to us first is not a precondition.

17Changes to this policy

We review this policy at least annually and whenever our processing changes materially. The version published on this page is the current version, and its issue date is shown at the top. Where a change materially affects your rights, we will tell you directly rather than rely on you noticing.

Data protection enquiries and rights requests: [email protected] | Complaints: [email protected]