Privacy policy

Who we are

This website, xterminalpro.com, is published by GOLDX TECH LTD, a company registered in England and Wales, company number 16112718, whose registered office is at 167–169 Great Portland Street, 5th Floor, London, England, W1W 5PF. We are the data controller for the personal data described in this policy.

You can reach us at [email protected].

What this policy covers — and what it does not

This policy covers this website only.

Traders do not have accounts with us. A trader signs up with the firm they trade with, gives that firm whatever identity documents it requires, and reaches the terminal from that firm's own dashboard. We do not operate a sign-up page for traders, we do not collect or store identity documents, and we hold no KYC records. Our platform is a trading tool the firm runs for its own customers.

If you are a trader at a firm that uses Xterminal, the privacy notice you need is that firm's, not this one, and you exercise your rights through them.

What we collect

We do not have accounts on this site. There is nothing to sign up for, nothing to log in to, and no form to fill in. As a result we collect very little.

When you visit a page

Our web server writes a log line: the time of the request, the page requested, the response code, the browser's user-agent string, and a shortened form of your IP address.

We shorten it before it is written, never afterwards. For an IPv4 address we keep the first three parts and discard the last; for IPv6 we keep the first three groups. What remains identifies a network, which is enough to see that one source is overloading the site, and not enough to pick out a household. We do not keep the full address anywhere.

Those logs are then encrypted at the end of each day with a key whose other half is not kept on our server. Once a day's log is encrypted, nothing running on that machine can read it back — including us, and including anyone who breaks into it. It can only be opened deliberately, by a person holding a key kept elsewhere, to investigate a specific incident.

When you write to us

If you email us we receive your email address, your name if you give it, and whatever you choose to put in the message.

That is the complete list. We run no analytics, we embed no tracking pixels, we load no fonts, scripts or resources from anyone else's servers, and we show no advertising. Nothing on this site reports your visit to a third party for their own purposes.

Cookies

This site sets no cookies. Not for analytics, not for preferences, not for advertising. There is no cookie banner because there is nothing to consent to.

Our network provider, Cloudflare, may set a strictly necessary cookie in order to tell a human visitor from an automated one when it detects suspicious traffic. That cookie carries no profile of you and is not used to track you between sites.

Why we process it, and our lawful basis

What	Why	Lawful basis
Server logs	To operate the site, diagnose faults, and detect and block attacks and abuse	Our legitimate interests in keeping the site available and secure
Your email to us	To read it and reply to it	Our legitimate interests in responding to people who contact us; or steps prior to entering a contract, where you are asking about buying our product

We have considered whether these interests are overridden by your rights. Server logs carry a shortened address, are kept briefly, are encrypted at rest, are not combined with anything else, and are not used to build a picture of any individual. We think the balance is a fair one, and you can object — see Your rights below.

Who else sees it

Cloudflare, who provide the network and security layer in front of this site. Every request reaches us through them, so they process your full IP address and request details on our behalf, under their own retention policy. The shortening and encryption described above are what we do on our own server; they do not and cannot change what our network provider sees in order to route your request to us.

Our email provider, who host the mailbox that receives our contact address.

We do not sell personal data, we do not share it for anyone else's marketing, and no third party receives your visit for their own purposes.

Where it goes

Cloudflare operates a global network and may process request data outside the United Kingdom. Such transfers are made under the safeguards UK data protection law requires — for these providers, the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or transfer to a country the UK has found adequate.

How long we keep it

Server logs: 14 days. They rotate daily, are encrypted, and the fourteenth-oldest is deleted automatically, whether or not anyone remembers. There is no long-term archive of who visited this website.

One honest limit, because a privacy policy that overclaims is worse than one that admits a boundary: the current day's log is written in the ordinary way and is encrypted when it rotates, so it exists unencrypted on our server for up to a day. That is why we shorten the address at the moment of writing rather than relying on the encryption alone.

Email: for as long as the conversation is live, and afterwards for as long as we may need it for our business records — ordinarily no more than six years, which is the period English law allows a contractual claim to be brought.

Your rights

Under UK data protection law you have the right to ask us for a copy of the personal data we hold about you; to have it corrected if it is wrong; to have it erased; to have our use of it restricted; to object to our using it on the basis of legitimate interests; and to receive it in a portable form where that right applies.

To exercise any of them, email [email protected]. We will respond within one month. We will not charge you, and we will not treat you any differently for asking.

One practical limit, stated honestly: a server log entry is a shortened address and a timestamp and nothing else. If you ask us for your data we will need something to search on, and we may not be able to connect a log line to you as a person. We are not permitted to collect more data than we need in order to make that easier, and we will not.

Complaints

If you think we have handled your personal data badly, please tell us first — we would rather fix it. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113.

Changes

If we change this policy we will change the date at the top. If a change matters — if we start collecting something new, or using it for something new — we will say so plainly rather than quietly reissue the page.