Privacy policy

Effective date: 7 September 2026. Version 1.8.

Your privacy is very important to us. This notice is provided by OptAxe Limited ("OptAxe", "we" or "us") and sets out our policies on the collection, sharing and use of personal information.

OptAxe Limited is the controller of the personal data described in this policy. We are registered in England and Wales, company number 13361894, with our registered office at 6 Brook Street, London W1S 1BB, and we are authorised and regulated by the Financial Conduct Authority (FRN 1002237) to operate a multilateral trading facility.

For the purposes of the UK General Data Protection Regulation ("UK GDPR") as incorporated into UK law by the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018 ("DPA 2018"), together "Data Protection Law", we are the controller of the personal data you provide. Please read the following carefully to understand OptAxe's practices regarding the treatment of your personal data. Should you have any questions, please email us at [email protected].

1. How we collect information about you

We may collect personal data about you through:

• Information provided directly to us by you, or by another person on your behalf, through our website, by email or post, or in person.
• Information that we obtain in relation to any transactions between you and us.
• Recording and monitoring of telephone conversations and electronic communications with you, as described in section 12.

We may also, in some circumstances, receive personal information about you from third parties, such as service providers or trading counterparties, regulatory or law enforcement agencies, credit reference agencies and agencies conducting background checks. Personal information may also be obtained from publicly accessible sources, such as public databases, industry associations, social media and online professional networks.

2. Why we collect information about you, and our lawful basis

We collect and use your personal information for the purposes set out below. For each purpose, we identify the lawful basis under UK GDPR Article 6 on which we rely.

Where we rely on legitimate interests under Article 6(1)(f), we have conducted a legitimate interests assessment and are satisfied that our interests are not overridden by your rights and freedoms. You have the right to object to processing on this basis. See section 10.

Where we process special category data as defined in UK GDPR Article 9, we rely on the additional condition in Article 9(2)(b), covering employment, social security and social protection obligations, or Article 9(2)(f), covering legal claims, as applicable.

3. The types of personal data we may collect

Depending on our relationship with you and the purpose of processing, the personal data we collect may include:

• Identity and contact details, for example name, date and place of birth, nationality, address, email address, telephone number, signature and identification documents.
• Financial and due diligence information, for example bank account details, source of funds, assets or net worth, credit history, and records of criminal or administrative offences.
• Records of our dealings and communications with you.

Where necessary, and subject to the conditions in UK GDPR Article 9, this may include special category data.

4. What are the consequences of failing to provide your personal information

As a regulated financial services firm, we are subject to legal and regulatory obligations that may require us to collect and store your personal information, such as requirements to comply with applicable law on the prevention of financial crime, tax and regulatory reporting, or the rules on recording and monitoring of communications described in section 12.

We may also need to collect and use your personal information for the purposes of entering into or performing a contractual arrangement between us.

A refusal to provide us with personal information may, depending on the purpose for which it is required, result in consequences such as our inability to communicate with you, the termination of any service or contractual arrangement, or, where we have a reasonable suspicion of illegal activity, a report by us to regulatory or enforcement agencies.

5. Do we use automated decision-making processes

No. We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal effects concerning you.

6. Where does OptAxe store my personal data

Your personal data is hosted on Google Cloud Platform, held primarily in the United Kingdom with disaster recovery resilience in the European Economic Area. See section 8. We maintain appropriate technical and organisational measures to keep it secure, as required by UK GDPR Article 32. Further detail is available to participants and applicants on request.

7. Do we share your personal information with third parties

We may share your personal data with third parties, to the extent relevant to the purpose for which we collected it, including:

• Our affiliates or other entities within our group, or our clients.
• Any person to whom we have a right or obligation to disclose personal data, or where disclosure is necessary to protect or defend our rights or property, including regulators, courts, and governmental, regulatory or law enforcement agencies.
• Our internet, IT, telecommunications and other service providers, including legal advisers, accountants, payroll administrators, and insurance and employee benefits providers.
• Service providers and trading counterparties to our clients, including placement agents, brokers, banks, trading venues, clearing houses, custodians, corporate services providers, fund administrators and CRM providers.
• Credit reference agencies and other third parties conducting background checks in the context of employment or client and counterparty due diligence.
• Any person as directed by you.
• Any person to whom we transfer any of our rights or obligations under any agreement, or in connection with a sale, merger or consolidation of our business, or other transfer of our assets.

8. Transfers of personal information outside the United Kingdom

Due to the international nature of our business, your personal data may be transferred to countries outside the UK, including jurisdictions where we or our clients conduct business or have service providers, some of which may not offer the same level of data protection as Data Protection Law.

In these circumstances, we take steps to ensure that any such transfer is lawful and that your data remains protected, including by relying on one or more of the following safeguards as required by UK GDPR Chapter V:

• UK adequacy regulations: transfers to countries designated as adequate by the UK Secretary of State under section 17A of the DPA 2018.
• International Data Transfer Agreements, or the UK Addendum to the EU Standard Contractual Clauses: contractual protections approved by the ICO.
• Other appropriate safeguards as permitted under UK GDPR Article 46.

You may request further information about the specific mechanisms used for any particular transfer by contacting us at [email protected].

9. For how long do we keep your personal information

We will generally keep personal information for as long as necessary in relation to the purpose for which it was collected, or for such longer period as required under applicable law or regulation.

As a regulated entity authorised by the FCA, OptAxe is required to maintain records for a prescribed period: five years from the ceasing of a business relationship, or from the making of a record in the case of non-clients, or seven years where specifically requested by the Financial Conduct Authority, in line with FCA SYSC 9.1. Information falling within these requirements is retained accordingly.

Any information outside the scope of these requirements will be retained whilst relevant and useful, and securely destroyed when it ceases to be so, or where you specifically request this, subject to our overriding legal obligations.

We will periodically review the purposes for which we hold information about you and decide whether to retain it, update it, or securely delete it.

10. Your data subject rights

You have the following rights under Data Protection Law in respect of the personal data we hold about you, set out in UK GDPR Articles 15 to 22. You may exercise these rights by contacting us at [email protected].

• Right of access, Article 15: to request a copy of the personal data we hold about you.
• Right to rectification, Article 16: to request correction of inaccurate or incomplete information.
• Right to erasure, Article 17: to request deletion of your personal data, the right to be forgotten, subject to our overriding legal obligations.
• Right to restriction of processing, Article 18: to request that we limit the way we use your data in certain circumstances.
• Right to data portability, Article 20: to receive your personal data in a structured, commonly used and machine-readable format, where processing is based on consent or contract and is carried out by automated means.
• Right to object, Article 21: to object to our use of your data where we rely on legitimate interests, including for direct marketing purposes, which we will always honour without requiring justification.
• Right to withdraw consent, Article 7(3): where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint with the Information Commissioner's Office. See section 14.

Please note that some of these rights are not absolute and may be subject to conditions or limitations under Data Protection Law. We will respond to any request within one month of receipt, as required by UK GDPR Article 12.

11. Cookies

Our website sets a small number of cookies that are strictly necessary for the site to function and to keep it secure. These do not require your consent. With your consent, we also use Google Analytics 4 to understand how visitors use the site: which pages are viewed, how people arrive, and broad location and device information. This helps us to improve it. Google Analytics sets two cookies, _ga and _ga_VK14MT7L4V, which last up to 13 months and allow us to recognise a returning browser. We do not use them to build a profile of you, to track you across other websites, or for advertising, and we do not sell or share the data. When you first visit the site, a banner asks whether you accept analytics cookies. No analytics cookies are set unless you accept, as required by the Privacy and Electronic Communications Regulations 2003. We record your choice in your browser's local storage so that we do not ask again. You can change your choice at any time using the Cookie settings link in the footer, or by clearing your browser's site data for this website. If you decline, or before you make a choice, no cookies or identifiers are set. Google may still receive a record of the page you viewed and your IP address, without any identifier, which it uses only for aggregate measurement. Google Analytics is provided by Google, which may process this data outside the UK.

12. Recording and monitoring of communications

We may record and monitor telephone conversations and electronic communications with you for the purposes of:

• Ascertaining the details of instructions given, the terms on which any transaction was executed, or any other relevant circumstances.
• Ensuring compliance with our regulatory obligations.
• Detecting and preventing the commission of financial crime.

Copies of recordings will be stored for a minimum of five years, or such longer period as we may determine from time to time, in accordance with our obligations under SYSC 10A and MAR 1.

13. How to contact us

If you have any questions about this privacy policy, or requests regarding the personal data we hold about you, please contact our data protection lead.

Email: [email protected]

Post: Compliance Team, OptAxe Limited, 6 Brook Street, London W1S 1BB.

14. Complaining to the ICO

If you are not satisfied with our response to any request, or you believe we are processing your personal data in a manner that is inconsistent with Data Protection Law, you have the right to complain to the Information Commissioner's Office.

Website: ico.org.uk

Helpline: 0303 123 1113

Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

15. Changes to this policy

We may, from time to time, review and update this privacy policy. The latest version will always be available on our website. Where changes are material, we will notify you by email or through a prominent notice on our website. We recommend that you check this page each time you visit our website to remain aware of any changes affecting the handling of your personal data.

OptAxe Limited is authorised and regulated by the Financial Conduct Authority (FRN 1002237) to operate a multilateral trading facility. Registered in England and Wales, company number 13361894. Reference DP-005 version 1.8.