GDPR Compliance

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It applies to any organization that processes the personal data of individuals in the European Economic Area (EEA), regardless of where the organization is based.

TradingForms is fully committed to GDPR compliance. We process personal data of EU/EEA residents and have implemented technical and organizational measures to ensure that our data practices meet or exceed GDPR requirements.

Under GDPR Article 6, every processing activity must have a valid lawful basis. TradingForms uses the following lawful bases, depending on the type of processing:

Under GDPR, a "Data Controller" is the entity that determines the purposes and means of processing personal data. TradingForms Ltd. is the Data Controller for all personal data collected through our platform.

Our Data Protection Officer is responsible for monitoring our compliance with GDPR, providing advice on data protection impact assessments, and acting as the primary contact point for supervisory authorities and data subjects.

TradingForms processes personal data about several categories of individuals ("data subjects") in the course of providing our services.

TradingForms operates globally and may transfer personal data outside the EEA. Under GDPR Chapter V, such transfers require appropriate safeguards to ensure data receives equivalent protection.

We use Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to third countries. For transfers to the UK, we rely on the UK's adequacy decision granted by the EU Commission.

• SCCs: We have executed the latest version of EU Standard Contractual Clauses with all sub-processors receiving EEA data
• Transfer Impact Assessments: We conduct TIAs for all high-risk international transfers
• Data Residency Options: Enterprise customers can request EU-only data residency — contact ${DPO_EMAIL}
• Sub-processor Updates: We maintain a current list of sub-processors and notify customers 30 days before adding new ones

GDPR's storage limitation principle (Article 5(1)(e)) requires that personal data is kept no longer than necessary for its purpose. Our retention periods are set to align with legal obligations, business necessity, and user expectations.

GDPR Article 32 requires controllers to implement appropriate technical and organisational measures (TOMs) to ensure a level of security appropriate to the risk. Our TOMs include:

GDPR Article 33 requires notification of personal data breaches to the relevant supervisory authority within 72 hours of discovery. Article 34 requires notification to affected individuals when the breach is likely to result in high risk.

GDPR Article 35 requires a Data Protection Impact Assessment (DPIA) before carrying out processing that is likely to result in a high risk to individuals' rights and freedoms. TradingForms conducts DPIAs proactively.

We carry out DPIAs for the following types of processing activities:

• New product features that involve processing sensitive personal data (e.g., payroll data, bank account details)
• Large-scale processing of employee payroll data on behalf of business customers
• New third-party integrations that involve sharing personal data with new sub-processors
• International data transfers to countries without an EU adequacy decision
• Automated decision-making or profiling that produces legal or similarly significant effects
• Systematic monitoring of users through analytics or performance tracking tools

DPIA results are reviewed by our DPO and, where required, consulted with the relevant supervisory authority prior to processing commencing. Summaries of our DPIAs are available to enterprise customers upon request.

TradingForms acts as a Data Processor when processing personal data on behalf of our business customers. We engage the following sub-processors to help deliver our services. All sub-processors are bound by Data Processing Agreements that meet GDPR Article 28 requirements.

Under GDPR Article 77, you have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data infringes GDPR. You can contact the supervisory authority in your EU member state of residence or the authority where the alleged infringement occurred.

Our lead supervisory authority for GDPR purposes is:

Before lodging a formal complaint, we encourage you to contact us first at dpo@tradingforms.com. We are committed to resolving data protection concerns quickly and fairly, and most issues can be resolved without formal regulatory involvement.

Our Data Protection Officer is your primary point of contact for any GDPR-related questions, rights requests, or concerns. The DPO operates independently and is not subject to instructions from management regarding their data protection responsibilities.