Last updated: January 5, 2021
Your continued use of the Services after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.
We collect several types of information from and about users of our Services, including information:
We collect this information:
Information you provide to us
To establish an account and access our Services, we'll ask you to submit certain identifying information about yourself. As we add new features and Services, you may be asked to provide additional information. Please note that we may not be able to serve you as effectively or offer you our Services if you choose not to share certain information with us. Any information you provide to us that is not required is voluntary.
We may collect the following types of information from you:
Please note that when you authorize read access to financial accounts, such as digital asset wallet information, in order to calculate Risk Metrics, calculation input data received is not seen or stored by us. Our calculators operate through a privacy-preserving system, and we only have access to the Risk Metrics displayed on the platform.
Information we collect from you automatically
As you navigate through and interact with our Site and use the Services, we may use automatic data collection technologies to collect certain information. This information helps us address customer support issues, improve the performance of our Site and applications, provide you with a streamlined and personalized experience, and protect your account from fraud by detecting unauthorized access. Information collected automatically includes:
For example, we may automatically receive and record the following information on our server logs:
We may also use identifiers to recognize you when you access our Site via an external link, such as a link appearing on a third party site.
Information collected from third parties
The Risk Metric calculation outputs X-Margin produces from the financial data you provide fall under this category. The types of data we may anonymize or collect in the aggregate include account balance, directional exposure metrics, aggregate position metrics, and other financial data made available to the system from API keys provided by you. We may use anonymized or aggregate customer data for any business purpose, including for risk analysis and to perform and improve our products and services.
Our primary purpose in collecting personal information is to provide the Services. We generally use personal information for risk analysis and to perform our Services.
We may use this information in the following ways:
X-Margin will not use your personal information for purposes other than those purposes we have disclosed to you, without your permission. We may request your permission to allow us to share your personal information with third parties. You may opt out of having your personal information shared with third parties, or allowing us to use your personal information for any purpose that is incompatible with the purposes for which we originally collected it or subsequently obtained your authorization. If you choose to so limit the use of your personal information, certain features or the entirety of our Services may not be available to you.
Legal Bases for Processing your Information
For individuals who are located in the European Economic Area, the United Kingdom or Switzerland (collectively "EEA Residents") at the time their personal data is collected, we rely on legal bases for processing your information under Article 6 of the EU General Data Protection Regulation ( "GDPR"). We generally only process your data where we are legally required to, where processing is necessary to perform any contracts we entered with you (or to take steps at your request prior to entering into a contract with you), for our legitimate interests to operate our business or to protect X-Margin 's or your, property, rights, or safety, or where we have obtained your consent to do so. Below is a list of the purposes described in our policy with the corresponding legal bases for processing.
|Section & Purpose of Processing||Legal Bases for Processing|
|To enforce our terms in our user agreement and other agreements|
To provide our Services
To provide Service communications
To provide customer service
To ensure quality control
|Based on our contract with you or to take steps at your request prior to entering into a contract.|
|For research and development purposes|
To enhance your experience
To facilitate corporate acquisitions, mergers, or transactions
To engage in direct marketing activities
|Based on our legitimate interests. When we process your personal data for our legitimate interests, we always ensure that we consider and balance any potential impact on you.|
|To maintain legal and regulatory compliance|
To detect and prevent fraud and/or funds loss
To ensure network and information security
|Based on our legal obligations, the public interest, or in your vital interests.|
|To enhance your experience|
To engage in third party marketing activities For any purpose
|Based on your consent.|
Direct Marketing: Direct marketing includes any communications to you that are only based on promoting our products and services. We will only contact you by electronic means (email or SMS) based on our legitimate interests, as permitted by applicable law, or your consent. To the extent we can rely on legitimate interest under the applicable law, we will only send you information about our Services that are similar to those which were the subject of a previous sale or negotiations of a sale to you. If you are a new customer, we will contact you by electronic means for marketing purposes only if you have consented to such communication. If you do not want us to send you marketing communications, please go to your account settings to opt-out or contact us at email@example.com. You may raise such objection concerning initial or further processing for purposes of direct marketing, at any time and free of charge.
Third Party Marketing: We will obtain your express consent before we share your personal information with any third parties for marketing purposes.
We take care to allow your personal information to be accessed only by those who require access to perform their tasks and duties, and to share only with third parties who have a legitimate purpose for accessing it. We will never sell or rent your personal information to third parties without your explicit consent. We will only share your information in the following circumstances:
Examples of account connections include:
Information that we share with a third party based on an account connection will be used and disclosed under the third party's privacy practices.
We maintain appropriate physical, technical and administrative safeguards to protect the security and confidentiality of the personal information you entrust to us.
We may store and process all or part of your personal and transactional information, including certain payment information, such as your encrypted bank account and/or routing numbers, in the US and elsewhere in the world where our facilities or our service providers are located. We protect your personal information by maintaining physical, electronic, and procedural safeguards in compliance with the applicable laws and regulations.
For example, we use computer safeguards such as firewalls and data encryption, we enforce physical access controls to our buildings and files, and we authorize access to personal information only for those employees who require it to fulfill their job responsibilities.
However, we cannot guarantee that loss, misuse, unauthorized acquisition, or alteration of your data will not occur. Please recognize that you play a vital role in protecting your own personal information. When registering with our Services, it is important to choose a password of sufficient length and complexity, to not reveal this password to any third parties, and to immediately notify us if you become aware of any unauthorized access to or use of your account.
We store your personal information securely throughout the life of your Account. We will only retain your personal information for as long as necessary to fulfill the purposes for which we collected it, including to satisfy any legal, accounting, or reporting obligations or to resolve disputes. While retention requirements vary by jurisdiction, information about our typical retention periods for different aspects of your personal information are described below.
As a reminder, when you input your financial account information, such as digital asset wallet information, in order to calculate Risk Metrics, data inputs from these sources are not seen or stored by us. Our calculators operate through a privacy-preserving system.
Our Services are not intended for children under 13 years of age. No one under age 13 may provide any personal information to or on the Site. We do not knowingly collect personal information from children under 13. If you are under 13, do not use or provide any information on this Site. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact us at firstname.lastname@example.org.
X-Margin may transfer, store, and process your information in data centers around the world, where X-Margin facilities or service providers are located or in other countries. Appropriate safeguards will be implemented, such as standard data protection clauses, with data recipients or processors approved by competent authorities. By communicating electronically with X-Margin, you acknowledge and agree to your personal information being processed in this way.
Depending on the applicable law where you reside, you may be able to assert certain rights related to your personal information identified below. If any of the rights listed below are not provided under law for your operating entity or jurisdiction, X-Margin has absolute discretion in providing you with those rights.
Your rights to personal information are not absolute. Depending upon the applicable law, access may be denied: (a) when denial of access is required or authorized by law; (b) when granting access would have a negative impact on another's privacy; (c) to protect our rights and properties; (d) where the request is frivolous or vexatious, or for other reasons.
How to make a privacy request or lodge a complaint:
You can make privacy rights requests or lodge complaints relating to your personal information by logging into your account or contacting us at email@example.com. When we receive an individual rights request via other intake methods, we may take steps to verify your identity before complying with the request to protect your privacy and security.
If you reside in the EU, you can file a complaint with the International Centre for Dispute Resolution by phone at +1.212.484.4181, or by visiting the website http://info.adr.org/safeharbor, or your relevant data protection authority.
In the UK, the relevant data protection authority is Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, 0303 123 1113, firstname.lastname@example.org.
In Ireland, the relevant data protection authority is the Data Protection Commission, Canal House, Station Road, Portarlington, R32 AP23 Co. Laois; phone: +353 (0761) 104 800; LoCall: 1890 25 22 31; Fax: +353 57 868 4757; email: email@example.com
In addition to the rights provided for above, if you are a California resident, you have the right to request information from us regarding whether we share certain categories of your personal information with third parties for the third parties' direct marketing purposes. To the extent we share your personal information in this way, you may receive the following information:
Effective January 1, 2020, pursuant to the California Consumer Privacy Act of 2018 ("CCPA"), California residents have certain rights in relation to their personal information, subject to limited exceptions. Any terms defined in the CCPA have the same meaning when used in this California Privacy Rights section.
Should we engage in any of the activities listed in this section, your ability to exercise these rights will be made available to you in your account settings. You can exercise your rights by going to your account settings or contacting us at firstname.lastname@example.org so that we may consider your request.
If you are a California resident, you may designate an authorized agent to make a request to access or a request to delete on your behalf. We will respond to your authorized agent's request if they submit proof that they are registered with the California Secretary of State to be able to act on your behalf, or submit evidence you have provided them with power of attorney according to California Probate Code section 4000 to 4465. We may deny requests from authorized agents who do not submit proof that they have been authorized by you to act on their behalf, or are unable to verify their identity.