Privacy Policy
1. Who We Are
DeepFunded spółka z ograniczoną odpowiedzialnością ("DeepFunded", "we", "us") is the data controller for personal data collected through deepfunded.com. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Polish data protection law.
| Controller | DeepFunded sp. z o.o. |
| Registered office | [street, number], [postal code] [city], Poland · KRS: [•] · NIP: [•] |
| Privacy contact | [email protected] |
| Data Protection Officer | Not appointed at this time. [Review before launch: large-scale identity verification involving biometric data may trigger the obligation to appoint a DPO under Art. 37(1)(b) GDPR.] |
2. What Personal Data We Collect
From all website visitors
- Server logs: IP address, date and time of request, browser type, requested page, referrer. Used for security and troubleshooting only.
From registered users
- Account data: full name, e-mail address, and a salted, one-way hash of your password (we never store your password in plain text).
- Challenge data: the configurations you build, purchase records, challenge status, and — once trading platforms are connected — performance data, trade history, and payout requests.
- Support correspondence you send to us.
Identity verification (KYC)
Verification is carried out through our processor Sum and Substance Ltd (Sumsub) using its verification flow embedded in our dashboard. In the course of verification, Sumsub processes on our behalf: identity document data and images, a selfie/liveness recording, and biometric templates derived from your face for the purpose of uniquely identifying you (a special category of data under Art. 9 GDPR). We receive and store the verification result, status, reason codes for rejection, and a reference identifier — not your document images or biometric templates, which remain in Sumsub's infrastructure.
Payments
Payments are processed by [Paydiverse — insert full legal name] as an independent payment processor. We do not receive or store your full card number, CVC, or other full payment credentials; we receive confirmation of payment and basic transaction metadata.
Cookies and similar technologies
We currently use only what is strictly necessary for the Services to work — see Section 9. We do not currently use analytics or advertising trackers. If we introduce them, we will update this Policy and ask for your consent first.
3. Purposes and Legal Bases
| Creating and managing your account, providing Challenges, dashboards and Payouts | Performance of a contract — Art. 6(1)(b) GDPR |
| Processing payments and keeping accounting records | Contract — Art. 6(1)(b); legal obligations (tax and accounting) — Art. 6(1)(c) |
| Identity verification before Payouts; fraud prevention and enforcement of the Rules | Legitimate interests — Art. 6(1)(f) (protecting the integrity of our evaluation programs); for biometric data processed during verification — your explicit consent, Art. 9(2)(a), collected at the start of the verification flow |
| Customer support and complaint handling | Contract — Art. 6(1)(b); legitimate interests — Art. 6(1)(f) |
| Security of the Website and Services (logs, abuse prevention) | Legitimate interests — Art. 6(1)(f) |
| Establishing, exercising or defending legal claims | Legitimate interests — Art. 6(1)(f) |
| Direct marketing (only if introduced) | Consent — Art. 6(1)(a), which you may withdraw at any time |
Providing account and verification data is a contractual requirement — without it we cannot provide the Services or process Payouts. You may refuse biometric verification, but we will then be unable to release Payouts.
4. Recipients of Personal Data
We do not sell personal data. We share data only with the following categories of recipients, to the extent necessary and under data processing agreements where they act as our processors:
- Sum and Substance Ltd (Sumsub) — identity verification (see Section 2);
- [Paydiverse — full legal name] — payment processing;
- [Hosting provider — name, country] — infrastructure and hosting;
- [Trading platform providers — e.g. MetaQuotes / Match-Trade — confirm] — simulated trading environment and performance data, once connected;
- [E-mail / support tooling providers] — communication;
- Professional advisers (legal, accounting) bound by confidentiality; and public authorities where we are legally required to disclose.
5. International Transfers
We store data primarily within the EU/EEA. Where a provider processes data in the United Kingdom (e.g., Sumsub), transfers rely on the European Commission's adequacy decision for the UK. Where any provider processes data outside the EEA without an adequacy decision, we use Standard Contractual Clauses and supplementary safeguards. You can request a copy of the relevant safeguards via [email protected].
6. Retention Periods
| Account and challenge data | Duration of the relationship, then up to 6 years after closure (limitation period for claims under Polish law) |
| Invoicing, transaction and accounting records | 5 years from the end of the tax year concerned (Polish tax and accounting law) |
| Verification (KYC) results and status | Duration of the relationship + [•] years — set with counsel; align with Sumsub's retention configuration for document and biometric data |
| Support correspondence and complaints | Up to 6 years after the matter is closed |
| Technical/server logs | Up to 12 months, unless needed longer for a specific security incident |
After these periods, data is deleted or irreversibly anonymised.
7. Security
We apply technical and organisational measures appropriate to the risk, including: TLS encryption in transit, one-way salted password hashing, session tokens stored in httpOnly/secure cookies, access to personal data restricted on a need-to-know basis, and periodic review and testing of our infrastructure. No system is perfectly secure; we will notify you and the supervisory authority of personal data breaches where the GDPR requires it.
8. Your Rights
Subject to the conditions in the GDPR, you have the right to: access your data and obtain a copy; rectification; erasure; restriction of processing; data portability; and to withdraw consent at any time (without affecting processing before withdrawal).
Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests — including fraud-prevention profiling. If you object, we will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. Where data are processed for direct marketing, you may object at any time and we will stop unconditionally.
To exercise your rights, e-mail [email protected]. We respond within one month (extendable by two further months for complex requests, in which case we will inform you).
You also have the right to lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland — uodo.gov.pl — or with the supervisory authority of your habitual residence.
9. Cookies and Local Storage
| "token" cookie (essential) | Keeps you signed in. httpOnly, Secure, SameSite=Strict; expires after 7 days. |
| "df_user" (localStorage, functional) | Stores your display name so the interface can greet you; removed on logout. |
Because these are strictly necessary or user-requested functional storage, no consent banner is currently required. If we introduce analytics or advertising technologies (e.g., Google Analytics or Meta Pixel), we will first deploy a consent mechanism compliant with the GDPR and the Polish Electronic Communications Law, and update this Policy.
10. Automated Decision-Making
Two elements of the Services involve automated processing that may significantly affect you:
- Identity verification: Sumsub performs automated document and biometric checks; unclear results are escalated to human review.
- Risk engine: compliance with challenge rules is evaluated by our risk engine; payout disqualifications are initially reviewed manually and may become automated as the system matures.
In each case you have the right to obtain human intervention, to express your point of view, and to contest the decision — contact [email protected] or use the complaints procedure in the Terms of Service.
11. Children
The Services are intended for persons 18 years and older. We do not knowingly collect data from anyone under 18; if we learn that we have, we will delete it.
12. Changes to This Policy
We may update this Policy from time to time. Registered users will be notified by e-mail of material changes at least 14 days before they take effect. The current version is always available at deepfunded.com/privacy.
13. Contact
Privacy questions and rights requests: [email protected]
General support: [email protected]