Privacy and Personal Data Protection Policy

1. General Provisions

Exispro LTD, operating under the trade name World Forex (hereinafter — the Company), respects your right to privacy and is committed to ensuring an appropriate level of personal data protection.

This Policy sets out how the Company collects, uses, stores, discloses, and otherwise processes personal data of clients, prospective clients, website visitors, and other persons interacting with the Company.

By visiting the Company’s websites, using the Company’s communication channels, or opening an account / trading account, you confirm that you have read this Policy and understand the principles governing the processing of your personal data.

2. Commitment to Data Protection

The Company seeks to comply with applicable personal data protection requirements, including the Personal Data Protection Act 2019 (PDPA) and other applicable privacy and data protection laws.

The Company applies reasonable technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration, unlawful disclosure, or other misuse.

3. Why We Collect Personal Data

The Company may collect and process personal data for, among others, the following purposes:

to identify and verify clients;
to open, maintain, and administer accounts, trading accounts, and related services;
to provide the Company’s services;
to comply with AML / KYC / CFT and other mandatory requirements;
to communicate with clients regarding service matters, notifications, requests, and inquiries;
to analyze and improve products, services, websites, and user experience;
to conduct internal analytics, research, and quality control;
to prevent fraud, abuse, and other unlawful activity;
to comply with legal, regulatory, and official requirements;
to send clients information, notices, news, and updates where permitted by applicable rules and the client’s communication preferences.

4. What Personal Data We May Collect

The Company may collect and process the following categories of data:

first name, surname, patronymic where applicable, date of birth, and gender;
contact details, including phone number, e-mail address, and residential address;
information regarding employment, profession, experience, knowledge, acceptable risk level, and client profile;
information regarding income, source of funds, source of wealth, assets, liabilities, and financial standing;
payment instrument details, including bank accounts, bank cards, and electronic wallets;
data relating to the use of websites, apps, trading platforms, and other services, including IP address, device specifications, access logs, cookies, location data, and other technical information;
records of communications with the Company, including e-mails, phone calls, chat messages, and other correspondence;
documents and information provided for identification, AML / KYC / CFT, and legal compliance purposes.

5. Identification and Documentation

The Company may request and retain documents and information necessary for identification, verification, and AML / KYC / CFT procedures, including:

passport;
driver’s licence;
national identity card, where applicable;
proof of residential address;
documents confirming source of funds and/or source of wealth;
any other documents or information that the Company reasonably considers necessary for the performance of its functions and obligations.

If the Client does not provide data or documents required for a particular service or for compliance with applicable law, the Company may refuse to provide or may restrict access to that service.

6. Lawful Bases for Processing

The Company may process personal data on one or more lawful bases, including:

where processing is necessary for the performance of a contract or steps taken prior to entering into a contract;
where processing is necessary for compliance with legal and regulatory obligations;
where processing is necessary for the legitimate interests of the Company, provided such interests do not override the rights and freedoms of the data subject;
where the data subject has given consent, if processing cannot be properly based on another lawful basis.

7. Who Personal Data May Be Disclosed To

The Company may disclose personal data to:

IT, hosting, analytics, communications, data storage, and infrastructure support providers;
providers of trading platforms, applications, communication systems, and other technical services;
payment systems, banks, and payment service providers involved in transaction processing;
auditors, consultants, lawyers, insurers, and other professional advisers;
affiliates, introducing brokers, partners, and agents, to the extent necessary and where there is an appropriate basis for such disclosure;
courts, governmental authorities, regulators, law enforcement agencies, and other competent bodies where required by law or by a justified official request;
any other persons where disclosure is necessary for contract performance, protection of the Company’s rights, fraud prevention, compliance with law, or has been authorized by the data subject.

8. Storage of Personal Data

The Company stores personal data in protected electronic systems and, where applicable, in paper files and other media, applying reasonable safeguards.

The Company retains personal data for no longer than necessary for the purposes for which it was collected, unless a longer retention period is required by law, AML / KYC / CFT rules, regulatory requirements, service conditions, protection of the Company’s rights, or dispute resolution.

9. Accuracy and Updating of Data

Clients must provide accurate and up-to-date data and update such data when necessary.

You may contact the Company to request correction, clarification, or updating of your personal data. The Company will make the appropriate changes where permitted by applicable law and where such changes do not conflict with legal or regulatory retention obligations.

10. Your Rights

To the extent provided by applicable law, a data subject may have the right to:

request access to their personal data;
request correction of inaccurate or incomplete data;
request erasure where continued processing is no longer required;
object to certain types of processing;
request restriction of processing;
request data portability where applicable;
withdraw consent where processing is based specifically on consent.

These rights are not absolute and may be restricted where processing is necessary to comply with legal obligations, prevent fraud, comply with AML / KYC / CFT requirements, protect the Company’s rights, or otherwise as permitted by applicable law.

11. Cookies and Technical Data

The Company may use cookies, server logs, analytics tools, and other technical means in order to operate websites and services, improve security, analyze usage, and enhance user experience.

You may adjust your browser settings to limit the use of cookies; however, this may affect the proper functioning of certain website features.

12. Security

The Company implements and maintains reasonable technical and organizational security measures designed to protect personal data.

However, no transmission of data over the Internet or by electronic means can be considered fully secure, and therefore the Company cannot guarantee absolute protection against all possible threats.

13. Changes to This Policy

The Company may update this Policy from time to time. The current version will be published on the relevant page of the website.

Continued use of the website, services, or account after an update to this Policy shall mean acceptance of the updated version to the extent permitted by applicable law.

14. Language

The English-language version of this Policy shall be the official version. In the event of any inconsistency between the English version and any translation, the English version shall prevail.

15. Data Protection Contact

For matters related to personal data processing and the exercise of data subject rights, you may contact the Company at: [email protected].