Privacy Policy

Last updated: 13 September 2026

Draft pending legal review. This document describes accurately what the RemidaFX platform does with personal data — it was written from the system itself, not from a template. It still needs to be reviewed and adopted by a qualified lawyer in the jurisdiction of the operating entity before it is relied upon.

1. Who we are 2. What we collect 3. Why, and on what basis 4. Who else processes it 5. How long we keep it 6. Your rights 7. How it is protected 8. Transfers outside the EEA 9. Contact

1. Who we are

The data controller is Remida Int LLC, an International Business Company registered in Saint Lucia under number 2026-004567, registered office 1st Floor, Bourbon House, Bourbon Street, Castries, Saint Lucia · c/o Financial & Corporate Services Ltd, P.O. Box 1695 ("RemidaFX", "we").

This policy covers both the public website at remidafx.com and the trading platform at app.remidafx.com. The two behave differently and are described separately where it matters.

2. What we collect

The public website

The website collects nothing. There is no analytics, no advertising pixel, no third-party script, and no cookie. The typeface is served from our own server rather than from Google Fonts, specifically so that visiting the site does not disclose your IP address to a third party.

Our web server writes standard access logs (IP address, timestamp, requested page, user agent) as part of operating and securing the service. See retention.

The trading platform

Data	Where it comes from
Email address and password	You, at registration. The address is confirmed by a link we email you. The password is stored only as a bcrypt hash — we cannot read it.
First and last name, date of birth, residential address	You, at registration. We need them to know who holds the account and to check them against your identity documents.
Sign-in codes and, if you turn it on, your authenticator secret and recovery codes	Generated by the platform. Codes are stored scrambled and expire; the authenticator secret is stored encrypted.
Country of residence	You, at registration.
Identity documents and the data on them	You, during identity verification (KYC).
Trading accounts, balances, positions, orders and every ledger movement	Generated by your use of the platform.
Deposits and withdrawals, including amounts, currency and method	You, and the payment processor.
External account link details: broker server, account number and investor password	You, only if you choose to mirror an external MetaTrader account. Stored encrypted.
Audit log of significant actions, IP addresses and session tokens	Generated by the platform.
Referral code, if you registered through a partner	You, or the link you arrived from.

About the investor password. It is a read-only credential of your MetaTrader account: it can view positions but cannot trade and cannot withdraw. We ask for it only to mirror your positions, we store it encrypted, and we never ask for your master password — nor should you give it to us or to anyone else.

2. Why, and on what basis

Purpose	Legal basis (GDPR Art. 6)
Opening and operating your account, executing your orders, paying out withdrawals	Performance of a contract
Identity verification, sanctions and anti-money-laundering checks	Legal obligation
Keeping accounting and transaction records	Legal obligation
Security, fraud prevention, access logs, audit trail	Legitimate interest in protecting the service and its clients
Service notifications (margin, deposits, withdrawals, account status)	Performance of a contract
Attributing a client to a partner who introduced them	Performance of a contract with the partner, and our legitimate interest in paying it correctly

We do not use your data for profiling or automated decisions that produce legal effects on you. Risk rules such as margin call and stop-out are mechanical, applied to your account balance rather than to a profile of you, and their thresholds are published before you open the account.

We do not sell personal data, and we do not share it for advertising.

4. Who else processes it

Processor	What it handles	Where
CoreSettle — payment processing	Deposits: name, email, amount and payment details. Card and bank details are entered on their page and never reach our servers.	Canada / EU
Vultr — hosting	Operates the servers on which the platform and the database run.	Amsterdam, Netherlands (EU)
Let's Encrypt (ISRG) — TLS certificates	Domain names only. No personal data.	United States

We will also disclose data to regulators, courts or law enforcement where we are legally required to.

This list is kept current. If a processor is added — an analytics provider, an email delivery service, a liquidity provider receiving order data — this page is updated before it begins processing.

5. How long we keep it

Identity documents and AML records: seven years after the relationship ends, the period required by the Money Laundering (Prevention) Act of Saint Lucia.
Transaction, ledger and accounting records: seven years, aligned to the same statutory period.
Account and profile data: for as long as the account exists, then for the retention periods above.
External account credentials: deleted when you unlink the account.
Web server access logs: 90 days, then deleted.
Audit logs: retained for the life of the account, because they are what lets you and us reconstruct what happened.

6. Your rights

If you are in the EEA or the UK you have the right to: access your data; correct it; erase it; restrict or object to processing; receive it in a portable format; and withdraw consent where consent is the basis.

Two limits are worth stating plainly rather than burying:

Erasure does not override legal retention. We cannot delete identity documents or transaction records that anti-money-laundering and accounting law require us to keep. We can close your account and stop all other processing.
Verification is required before we act on a request, precisely so that nobody else can obtain or delete your data by asking.

Requests go to privacy@remidafx.com. We answer within one month. You also have the right to complain to your national data protection authority.

7. How it is protected

All traffic is encrypted in transit (TLS 1.2 and 1.3 only); plain HTTP is redirected.
Passwords are stored as bcrypt hashes and are never recoverable, by us or by anyone.
External account credentials are encrypted at rest with a key held outside the database.
The database is not reachable from the internet; it is authenticated and confined to the internal network.
Administrative actions are recorded in an audit log with the identity of who performed them.
Backups run nightly and are encrypted.
Client funds are held in accounts segregated from the company's own.

8. Transfers outside the EEA

The platform and its database are hosted in the European Union. Where a processor is outside the EEA — see the table above — the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision.

9. Contact

Privacy enquiries: privacy@remidafx.com. We have not appointed a data protection officer: the appointment is not mandatory for an organisation of this size and activity. Privacy requests are handled by the team reachable at privacy@remidafx.com. Postal address: Remida Int LLC, 1st Floor, Bourbon House, Bourbon Street, Castries, Saint Lucia · c/o Financial & Corporate Services Ltd, P.O. Box 1695.