Privacy Policy

XM ZA (Pty) Ltd (hereinafter the “FSP” or “we”) is incorporated under the laws of South Africa with registration number 2018/527968/07 and is registered under the Companies and Intellectual Property Commission (http://www.cipc.co.za). The FSP is authorized and regulated by the Financial Sector Conduct Authority (“FSCA”) to act as a Financial Service Provider (FSP No. 49976) and provide intermediary services in connection with derivative products, and operates under the Financial Advisory and Intermediary Services Act (“FAIS Act”) (Act 37 of 2002).

The development of a standard operating procedure to ensure adequate protection of users/clients personal information which becomes available to the FSP and its personnel is of utmost importance for the effective operations and risk management of the FSP. Moreover, internal control mechanisms to constantly review and measure adherence to said procedures are important risk management tools and assist the FSP in treating its users/clients fairly.

This policy covers the website www.xmza.com and all its related sub-domains and mobile applications (if any) that are registered and operated by XM ZA (Pty) Ltd.

This policy applies to all visitors of the website who are accessing or using the FSP’s website and/or mobile applications.

The FSP is committed to protecting the privacy of all users/clients’ Personal Information which it processes, in accordance with the provisions of the International Principles of Information Protection, the Basic Provisions of the Constitution of South Africa 1996, the Protection of Personal Information Act 4 of 2013, any other applicable law or regulation on data privacy and personal data protection as well as with this policy.

Act

means the Protection of Personal Information Act No. 4 of 2013

Data Subject

means any identifiable, living, natural person, and where it is applicable, an dentifiable, existing juristic person.

Policy

means this policy on the lawful processing and protection of client information

Procedure

means a statement or number of statements, contained in a separate yet linked document, the effect of which is to prescribe those things that must be done or omitted in order to ensure adherence with this policy and the Act

Processing

means any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including

a) the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;

b) dissemination by means of transmission, distribution or making available in any other form; or

c) merging, linking, as well as restriction, degradation, erasure or destruction of information.

Responsible Party

means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing of personal information.

Unique Identifier

means any identifier that is assigned to a data subject and is used by a responsible party for the purposes of the operations of that responsible party and that uniquely identifies that data subject in relation to that responsible party.

In terms of the PoPI Act, Personal Information is defined as information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to:

a) information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;

b) information relating to the education or the medical, financial, criminal or employment history of the person;

c) any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;

d) the biometric information of the person;

e) the personal opinions, views or preferences of the person;

f) correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;

g) the views or opinions of another individual about the person; and

h) the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

The conditions for the lawful processing of Personal Information by or for a responsible party are the following:

Accountability

The FSP shall ensure that the conditions set out in the PoPI Act, and all the measures that give effect to such conditions, are complied with at the time of the determination of the purpose and means of the processing and during the processing itself.

Processing Limitation

• Minimality

Personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant and not excessive.

• Consent, justification and objection

1. Personal information may only be processed if:

a) the data subject consents to the processing;

b) processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party;

c) processing complies with an obligation imposed by law on the responsible party;

d) processing protects a legitimate interest of the data subject;

e) processing is necessary for the proper performance of a public law duty by a public body; or

f) processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.

2. The data subject may withdraw his, her or its consent at any time, provided that the lawfulness of the processing of Personal Information before such withdrawal or the processing of personal information in terms of points (b) to (f) above will not be affected.

3. A data subject may object, at any time, to the processing of personal information:

a) in terms of points (d) to (f) above, in the prescribed manner, on reasonable grounds relating to his, her or its particular situation, unless legislation provides for such processing; or

b) for purposes of direct marketing other than direct marketing by means of unsolicited electronic communications.

4. If a data subject has objected to the processing of personal information in terms of subsection (3), the responsible party may no longer process the personal information.

• Direct collection of Personal Information from the Data Subject

The type of information we may collect and hold includes (but is not limited to) personal information about:

a) website visitors/potential clients;

b) third parties such as service providers;

c) current and prospective employees; and

d) other people with whom we come into contact during the course of our business operations.

We shall obtain the information directly from the data subject unless required or allowed by law to obtain the information from another source. Particularly, we may collect Personal Information about individuals:

a) from the use of our website or mobile application(s) (e.g., cookies, IP address, device model and ID);

b) from information disclosed to us directly by an individual through any means of communication such as telephone, email, fax, letter, etc.;

c) from third party sources, including publicly available sources, the Internet, social media platforms, introducing brokers and affiliates, our business contacts, credit reporting bodies providing identity verification services, and financial institutions (e.g., banks, credit card processors), subscription-based intelligence/screening databases, etc.;

d) from webinar/seminar sign-up forms;

e) from subscriptions to our news’ updates;

f) In some circumstances we may be provided with personal information about an individual from somebody else, for example a referral from another person. We will take reasonable steps to ensure that the individual is made aware of the matters set out in this Privacy Policy. We may also occasionally receive unsolicited personal information about individuals. In the event we receive personal information about an individual which is unsolicited by us and not required for the provision of our services, we will securely destroy/delete the information (provided it is lawful and reasonable for us to do so).

We may ask for other Personal Information from time to time (for example, through market research or surveys or offers). Further, if you visit any of our offices or premises, we may have CCTV which will record your image.

Purpose Specification

• Specific purpose

Due to the nature of the FSP’s operations (i.e., merely providing a website, through which visitors can be directed to the product supplier’s own website – i.e., no client onboarding, no market making and no trading platform(s) are offered) the Personal Information it collects about visitors are very limited. The Personal Information are collected for the following purposes:

• to conduct our business of providing intermediary services (i.e., online and offline marketing) in relation to CFDs or other derivative products towards the product supplier;

• to provide individuals with information about the product supplier’s services, products and promotions;

• protect our business and other clients from fraudulent or unlawful activity;

• to enhance the security of the FSP’s network and information systems;

• to maintain our accounts and records;

• to investigate and resolve any concerns or queries an individual may have;

• to manage any legal actions involving the FSP;

• to collect and analyse statistical information regarding the number of visitors to our website. The FSP may provide this statistical data to third parties solely for statistical purposes and in an effort to improve the FSP’s marketing campaign;

• to comply with our legal and regulatory obligations;

• to help us manage and enhance our services;

• to receive professional advice (e.g., legal advice).

• Retention and Restriction of Records

Records of Personal Information must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed, unless:

a) retention of the record is required or authorised by law;

b) the FSP reasonably requires the record for lawful purposes related to its functions or activities;

c) retention of the record is required by a contract between the parties thereto; or

d) the data subject has consented to the retention of the record.

Records of personal information may be retained for periods in excess of those contemplated above, for historical, statistical or research purposes if the FSP has established appropriate safeguards against the records being used for any other purposes.

The FSP must destroy or delete a record of personal information or de-identify it as soon as reasonably practicable after it is no longer authorised to retain the record. The destruction or deletion of a record of Personal Information must be done in a manner that prevents its reconstruction in an intelligible form.

Further Processing Limitation

Further processing of Personal Information must be in accordance or compatible with the purpose for which it was initially collected. To assess whether further processing is compatible with the purpose of collection, the FSP will take account of:

a) the relationship between the purpose of the intended further processing and the purpose for which the information has been collected;

b) the nature of the information concerned;

c) the consequences of the intended further processing for the data subject;

d) the manner in which the information has been collected; and

e) any contractual rights and obligations between the parties.

Information Quality

The FSP must take reasonably practicable steps to ensure that the Personal Information is complete, accurate, not misleading and updated where necessary. In taking these steps the FSP must have regard to the purpose for which Personal Information is collected or further processed.

Security safeguards

Personal Information which the FSP collects and holds is to be treated by the SP as confidential and will not be used for any purpose other than those specified in this policy

Any Personal Information that you provide to the FSP will be treated as confidential and shared only with the parties mentioned in this policy. Such Personal Information will not be disclosed to any other third party except if such disclosure is required under any regulatory or legal proceedings.

The FSP offers high protection Personal Information that you provide in connection with the use of the website or through other means as mentioned above. The FSP encrypts all Personal Information as it is transferred to the FSP and thus makes all necessary effort to prevent unauthorized parties from viewing any such information.

Personal Information provided to the FSP also resides on secure servers and is again accessible only to authorized personnel via password.

The following information may be collected from visitors/potential clients, depending on the means through which you provide us such information (e.g., website, email):

a) Full name, residential address and contact details (e.g., email address, telephone number, etc.);

b) Details of visitors’ visits to the FSP’s website and information collected through cookies and other tracking technologies including IP address and domain name, browser version, operating system and geolocation;

c) Your marketing and communication data (e.g., preferences; selections; marketing permissions and consents; etc.);

d) Identification information and verification information regarding your trading account with the product supplier in case you, on your own initiative, provide this information through an email in order to get assistance (e.g., date of birth, place of birth, gender, copy of identification documents);

e) Behavior data/information and movement on the website (e.g., session information, visits and actions taken on the website, and other information about your interactions with our website);

f) Other information that may be contained in any correspondence you have with us via email.

Your Personal Information shall be kept strictly confidential. The FSP shall not disclose such information to a third party, except: (a) to the extent that it is required to do so pursuant to any applicable laws, rules and/or regulations; (b) if there is a duty to the public to disclose; (c) if our legitimate business interests require disclosure; or (d) at your request or with your consent or to persons described in this policy. The FSP will endeavor to make such disclosures on a ‘need-to-know’ basis, unless otherwise instructed by a regulatory authority. Under such circumstances, the FSP will notify the third party regarding the confidential nature of any such information.

As part of using your personal information for the purposes set out above, the FSP may disclose your personal information to:

• other entities of the Trading Point Group who provide financial services and/or administrative and support services;

• our service providers and specialist advisers who have been contracted to provide us with administrative, financial, legal, tax, compliance, insurance, research or other services;

• business introducers/affiliates with whom we have a mutual business relationship;

• third-party apps’ providers when you use our mobile app(s), communication systems and trading platforms which are provided to us by third-parties;

• credit providers, credit reporting or reference agencies, courts, tribunals and regulatory authorities as agreed or authorized by law;

• governmental and regulatory bodies/authorities (e.g., FSCA) and law enforcement agencies where required by law and in response to other legal and regulatory requests, enquiries or investigations;

• service providers for the provision of the required support in connections with website visits and traffic monitoring through cookies;

• organisations involved in a potential transfer or sale of all or part of our assets or business;

• market research companies;

• court of Law;

• the Information Regulator;

• any third-party where such disclosure is required in order to enforce or apply our Terms and Conditions of Business (Customer Agreement) or other relevant agreements;

• anyone authorized by you.

We endeavor to disclose to these third-parties only the minimum personal information that is required to perform their contractual obligations to us and on a need-to-know basis. Our third-party service providers are not permitted to share or use personal information we make available to them for any other purpose than to provide services to us.

Generally, we require that organizations outside the Trading Point Group who handle or obtain personal information to acknowledge the confidentiality of this information, undertake to respect any individual’s right to privacy and comply with all relevant data protection laws and this Policy. Please note that the use of your personal information by external third parties who act as data controllers of your personal information is not covered by this Policy and is not subject to our privacy standards and procedures. We encourage you to check with each third-party as to their privacy practices and procedures.

The FSP respects the privacy of any users who accesses its website(s), and it is therefore committed to taking all reasonable steps to safeguard any existing or prospective clients, applicants and website visitors. We process any visitors’/potential clients’ personal data in accordance with the applicable data protection laws and regulations to ensure your Information is secured against loss, unlawful access or accidental destruction of data.

The FSP implements and maintains appropriate technical and organizational measures to ensure the confidentiality, safeguarding and protection of any personal information from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed by the FSP.

The FSP also ensures that any processing activity to such personal information is in accordance with the applicable data protection laws and regulations. We regularly train all of our employees and raise awareness regarding the importance of maintaining, safeguarding and respecting your personal information and privacy.

We take breaches of individuals’ privacy very seriously and will impose appropriate disciplinary measures, including dismissal where necessary.

The personal information is securely stored in a safe location and only authorized personnel have access to it via secure access control. All personal information is transferred to the FSP over a secure encrypted connection and thus all necessary measures are taken to prevent unauthorized parties from viewing any such information.

Other measures we have in place include, but are not limited to:

• requiring our employees to use passwords and two-factor authentication when accessing the FSP’s systems;

• applying Chinese walls and employees only have access to the personal data required for the purposes of their job duties and respective tasks they handle;

• employing firewalls, intrusion detection systems and virus scanning tools;

• using dedicated secure networks or encryption when we transmit electronic data for purposes of outsourcing;

• implementing a clean desk policy in all premises occupied by us and/or associated companies and providing secure storage for physical records; and

• employing physical and electronic means such as access cards, cameras and security guards to protect against unauthorized physical access.

Transmission of information via the internet is not always completely secure but the FSP endeavors to protect your personal data by taking serious precautions. Once we have received your information, we will apply procedures and security features to try to prevent unauthorised access

Any service provider to whom we outsource any aspect relating to data collection abides by the terms of this policy.

We shall ensure, in the event of a breach of security regarding personal information that we notify the Information Regulator and the affected data subjects as soon as reasonably possible, by such means and media as are appropriate in the circumstances to enable them to take steps to protect their interests.

We shall ensure, when requested to transfer data across the borders of South Africa, that we do so only with the consent of the data subject and thereafter only to a jurisdiction which has rules on the protection of data substantially similar to those contained in this policy and the PoPI Act.

Personal information is generally held electronically in our secure databases.

Any personal information collected, will recorded and kept in encrypted files for 5 years.

Information and Access to Personal Information

You have the right to be notified on whether Personal Information about you is being collected and whether your Personal Information has been accessed or acquired by an unauthorized person. You may also request a copy of the Personal Information the FSP holds about you.

Correction, Destruction or deletion

You have the right to request, where necessary, the correction, destruction or deletion of your Personal Information.

Object

You have the right to object, on reasonable grounds relating to your particular situation to the processing of your Personal Information.

You may also object to the processing of your Personal Information for purposes of direct marketing other than direct marketing by means of unsolicited electronic communications as well as for purposes of direct marketing by means of unsolicited electronic communications.

Object to automated processing

It is also your right not to be subject, under certain circumstances, to a decision which is based solely on the basis of the automated processing of your Personal Information intended to provide a profile of you.

Submit complaint to the Regulator

You have the right to submit a complaint to the Information Regulator regarding the alleged interference with the protection of your Personal Information (https://justice.gov.za/inforeg/).

To exercise any of the above rights or submit any inquiry about this policy you may contact us at support@xmza.com.

The FSP reserves the right to review and amend this policy from time to time for any reason and notify you of any such amendments accordingly by posting an updated version of this policy on its website.

You are responsible for regularly reviewing the policy and any amendments thereof.

By submitting your details and/or using our website, you accept the terms and conditions of this policy and consent to the processing of your Personal Information by the FSP as set out in this Policy.

When an individual accesses our website, our website uses cookies which allow us to identify the individual’s browser. Cookies do not identify the individual; they simply allow us to track usage patterns so that we can measure the level of interest in various areas of its site. All browsers allow individuals to be notified when they receive a cookie and elect whether to accept it.

On devices where cookies are not available (such as some mobile phones and tablets), we may use identifiers such as Apple’s identifier for Advertising (IDFA) and Google’s Android Advertising (AAID) to collect behavioral information. These advertising identifiers do not constitute Personal Information.

Furthermore, we use cookies for re-marketing features in order to allow us to reach out to users who have previously visited our website(s) and have shown an interest in our products and services. Periodically, we may use third party vendors, such as Google and AdRoll, to display our ads over the internet to you, based on your previous use of our website(s). You can opt out this particular use of cookies at any time by visiting Google’s Ads Settings page and the DoubleClick opt-out page or as they later update those facilities.

The FSP uses session ID cookies and persistent cookies. A session ID cookie expires after a set amount of time or when the browser window is closed. A persistent cookie remains on your hard drive for an extended time period. You can remove persistent cookies by following directions provided in your web browser's ‘Help’ file.

To support targeted advertising campaigns, we may collect your IP address. We also store IP addresses in server logs for anti-fraud and security reasons.

We do not combine Personal Information with behavioral information. The purpose of collecting this information is to provide you with a more relevant and effective experience on our website, including presenting webpages according to your needs or preferences.

Our website privacy policy can be accessed by clicking on the privacy hyperlink button on our website.