Privacy and Cookie Policy

INFORMATION OF THE JOINT CONTROLLERS WITH RESPECT TO THE PROCESSING OF PERSONAL DATA
made pursuant to Articles 13 and 14 of EU REGULATION No. 2016/679 ("GDPR")


The goal of UCapital24 S.p.A. and UCapital24 Ltd (the "Companies," the "Joint Controllers," or "we") is to synergistically provide a Proprietary Trading service, (hereinafter "Prop") which consists of a "trading challenge" that allows people to test their trading skills in financial instruments by opening demo trading accounts, i.e., without the use of real money, subject to the rules set forth in the general terms and conditions of the service.

The Joint Controllers have signed a joint controllers agreement, the extract of which is available at their registered offices, for the purpose of defining, pursuant to Article 26 of Regulation (EU) 2016/679 (hereinafter, "GDPR"), the processing of personal data carried out under co-ownership for the administrative, organizational, accounting and promotional/marketing management of the activities and services rendered jointly by the two Companies.

The joint Controllers wish to provide the Interested Parties with certain information regarding the processing of their personal data, as defined below, which the same may collect and process through the website https://ucapitalprop.com   through which you can access the Prop service, in the capacity of User of the website or Customer of the services rendered.

Where not otherwise specified, this Policy applies as a disclosure - pursuant to Articles 13 and 14 of Regulation (EU) No. 2016/679 (hereinafter the "GDPR") - made to those who interact with the above site ("Users", "Interested Parties", or "you").

1. Joint data controllers. Data Processors.

In relation to personal data collected for the use of services available on the website https://ucapitalprop.com, the Data Controllers are:

UCapital24 S.p.A., with registered office at Via dei Piatti 11, 20123, Milan (MI), C.F. and P.IVA 10144280962. The updated list of data processors is available, upon request, at the offices of the Joint Controller.

UCapital24 Ltd, with registered office at Salisbury House, 81 High Street, Potters Bar, Hertfordshire, United Kingdom, EN6 5AS, Company Number: 11107665. The updated list of data processors is available, upon request, at the office of the Joint Controller.

The Joint Controllers hold in the highest regard the right to privacy and the protection of their Users' personal data. For any information in connection with this privacy policy, Users may contact, as the designated point of contact by the Joint Controllers themselves, UCapital24 S.p.a.

However, it remains the right of the Interested Parties to contact indifferently both Joint Controllers at any time, using the following methods:

For UCapital24 S.p.a by writing an e-mail to privacy@ucapital24.com or by sending a registered letter with return receipt to the company's registered office at Via dei Piatti 11, 20123, Milan (Mi).

For UCapital24 Ltd by writing an e-mail to support@ucapitalprop.com or by sending an international registered letter to the company's registered office at Salisbury House, 81 High Street, Potters Bar, Hertfordshire, United Kingdom, EN6 5AS.

2. Data Protection Officer.

The Joint Controller UCapital24 S.p.A. has appointed a Data Protection Officer ("DPO" or "RDP"), pursuant to Article 37 of the GDPR, who is responsible for supervising compliance with the legislation protecting personal data and acting as a point of contact for data subjects and who can be contacted for any needs inherent to the processing of personal data by writing to the following e-mail address: dpo@ucapital24.com .

3. Categories of personal data processed, source from which they originate, and why we use Data Subjects' data. Purposes and legal basis of the processing. Consequences if data is not provided.

Following is a list of all the purposes for which we collect Users' personal data, Purposes and legal basis of processing, Legitimate interests pursued.

The personal data collected will be processed:

A) For website navigation and activities related to the functioning and operation of the web page:

  1. Purpose of processing: to enable web browsing and, in case of computer crimes, to ascertain possible liability.
  2. Data processed: The computer systems and software procedures responsible for the operation of this web page acquire, in the course of their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes IP addresses, domain names, URIs.
  3. Legal basis: provision of services aimed at enabling users to navigate this website; legitimate interest consisting in ensuring the proper functioning of computer systems and to proceed with the investigation of possible crimes (possibly also based on the existence of a legal obligation) pursuant to Article 6, c. 1, lett. f) of the GDPR.
  4. Retention period: 30 days after the date of collection, unless legal provisions or measures of Public Authorities impose a different retention time in relation to investigations related to possible computer crimes.
  5. Provision of personal data: the provision of personal data is mandatory for the pursuit of the legitimate interests of the Joint Controllers indicated in the preceding points. Failure to provide it will result in the impossibility of following up on the User's requests and carrying out the activities indicated above.

B) Filling out the contact form:

  1. Purpose of processing: By filling out the forms on the website, Data Subjects may, depending on specific indications, obtain information about the services provided by the Data Controllers or request to be contacted.
  2. Data processed: mandatory: first name, last name, email. Optional free text message and telephone number.
  3. Legal basis: execution of the contract for the sale and purchase of products or pre-contractual measures taken as a result of a request from the Data Subjects pursuant to Article 6, c.1, lett b) of the GDPR.
  4. Storage period: two years from the completion of the form.
  5. Provision of personal data: the provision of personal data is optional, but necessary to process Users's requests. Failure to provide the data will result in the impossibility to send the form and thus to handle Users' requests.

C) Registration on the wainting list:

  1. Purpose: By filling in the required fields, Users will be able to join the wainting list to receive exclusive updates, early access and special opportunities.
  2. Data processed: data to be provided obligatorily, if you want to proceed to the completion of the registration form for the waiting list: first name, last name, email, phone number.
  3. Legal basis: execution of the contract for the sale and purchase of products or pre-contractual measures taken as a result of your request under Article 6, c.1, lett b) of the GDPR.
  4. Storage period: two years from the completion of the form.
  5. Provision of personal data: the provision of personal data is optional, but necessary to process Users' requests. Failure to provide data will result in the inability to send the form and thus to handle Users' requests.

D) Registration to the personal area:

  1. Purpose of processing: creation of a restricted area ("account") that will allow Users to view content regarding their personal position and access free training content. Specifically, the User will be redirected to the login and registration page of the Market Intelligence website https://marketintelligence.ucapital24.com/login.html  which allows them to use and purchase Prop services, create their own reserved area and, at the same time, create an account within the Social UCapital24 (for the processing of data carried out through the Social and for Market Intelligence, please refer to the relevant Privacy Policy).
  2. Data processed: personal and contact data indicated in the online form related to the registration to the reserved area (username, first name, last name, e-mail, password, date of birth). The essential data for the use of our services are marked with an asterisk: therefore, in the absence of the provision of this information we will not be able to make available the service requested by the User.
  3. Legal basis: execution of the website registration contract pursuant to Art. 6 c. 1 lett. b) of the GDPR.
  4. Retention period: the account and data related to it will be deleted 3 years after the deletion of the account or in case of non-use of the account for more than 3 years. Any User may request the deletion of his/her account by sending an e-mail to support@ucapitalprop.com.
  5. Provision of personal data: The provision of personal data is optional, but necessary (with regard to the data defined as mandatory) for the use of our services: in the absence of the provision of this information, the Joint Controllers will therefore not be able to make available the service requested by the User, i.e. the creation of the personal area.

E) Online purchasing of Prop services:

  1. Purpose of processing: processing of purchase orders placed online on the website https://marketingelligence.ucapital24.com and carrying out related activities (sending the confirmation e-mail, opening the demo account and sending the login credentials for the service on the Metatrade platform, invoicing, payment management, possible activation of the order return and refund process, return management, etc.).
  2. Data processed: contact data (first name, last name, e-mail address, phone number, data for billing purposes). We do not process data related to the means of payment indicated by Users (e.g., payment card number and security code), which are instead collected exclusively by the operator of the chosen payment service.
  3. Legal Basis: The processing of such data does not require the consent of the data subjects as it is necessary for the performance of a contract to which the Data Subject is a party or the execution of pre-contractual measures taken at the request of the same pursuant to Article 6, c.1, lett b) of the GDPR.
  4. Retention period: time necessary to fulfill contractual and regulatory obligations regarding the purchase and sale of products and services (e.g., tax regulations), usually equal to 10 years from the date of purchase.
  5. Provision of personal data: The provision of personal data is optional, but necessary to manage and process Users' requests and for the fulfillment of contractual obligations on the part of the Joint Controllers. Failure to provide the data will result in the inability of the Joint Controllers to fulfill their contractual obligations.

F) Customer Care:

  1. Purposes of  processing: the Joint Controllers make available to the Users a support service managed directly by UCapital24 S.p.a. (via telegram and whatsapp chat, telephone, e-mail, online form) for any request related to the purchase of their products or the use of their services.
  2. Data processed: data necessary to respond to the requests that will be addressed to Customer Care (in particular, for the chat support service, we will ask you to provide your name and e-mail address).
  3. Legal basis:
    • execution of the contract for the purchase and sale of products or pre-contractual measures taken as a result of a request from the Data Subjects pursuant to Article 6, c.1, lett b) of the GDPR;
    • with respect to the chat support service, legitimate interest in preventing so-called "chat spam" pursuant to Art. 6, c. 1, lett. f) of the GDPR.
  4. Retention period: time strictly necessary to fulfill the requests of Data Subjects. Relevant conversations are deleted weekly and no phone numbers are saved in any way.
  5. Provision of personal data: The provision of personal data is optional, but necessary to handle and process Users' requests. Failure to provide the data will result in the inability of the Data Holders to handle Users' requests.
  6.  

G) Sending of commercial communications (for direct marketing purposes):

  1. Purpose of the processing: sending commercial communications via e-mail, SMS, Whatsapp, Telegram and cell phone regarding products related to the services offered by the Joint Data Controllers.
  2. Data processed: contact data (e.g. first name, last name, e-mail address, telephone number).
  3. Legal basis: the consent of the Data Subjects pursuant to Article 6, c. 1, lett. a) of the GDPR, which can be revoked at any time by writing to privacy@ucapital24.com .
  4. Retention period: until the User revokes consent.
  5. Provision of personal data: the provision of personal data is optional. Failure to provide data will not have any consequence on the usability of the services and remains at the complete discretion of the User.

H) For registration for the newsletter service:

  1. Purpose of processing: to send informative communications via e-mail that will have as their subject news regarding the services offered by the Joint Controllers.
  2. Data processed: first name, last name, email.
  3. Legal basis: the consent of the interested party (according to art. 6 c. 1 lett. a) GDPR) that can be revoked at any time by clicking on the unsubscribe button in the footer of the emails.
  4. Retention period: the Personal Data of the Data Subjects will be processed until the Data Subject decides to unsubscribe from the service by clicking on the unsubscribe button in the footer of the emails.
  5. Provision of Personal Data: the provision of Personal Data is optional. Failure to provide data will have no consequence on the usability of the services and remains at the complete discretion of the User.

I) Proximity marketing (soft spam) for its customers/users:

  1. Purpose of processing: for the purpose of sending, by the Joint Controllers, information via email (not for telephone communication) about products and/or services provided by the Joint Controllers (and not by third parties) regarding services similar or related to those already purchased or for which the User has registered or shown interest (so-called "soft spam");
  2. Data processed: contact data such as first name, last name, e-mail.
  3. Legal Basis: If the User is already a customer of the Contractors, or has registered for certain services and there is a balance of interests, the legal basis may consist of the legitimate interests of the Contractors (pursuant to Art. 6 c. 1 lett. f) of the GDPR) and therefore consent is not required for sending advertising communications.
  4. Retention period: for the duration of the existing contractual relationship with the customer or until the User who has demonstrated interest in a service exercises his or her right to object to the processing of his or her personal data for marketing purposes, and in any case no longer than 3 years from the time of data collection.
  5. Provision of personal data: the provision of data is optional. Failure to provide data will have no consequence on the usability of the services and it remains at the complete discretion of the User to decide to object to the processing of their personal data for marketing purposes.

L) Legal obligations to which the Co-Processors are subject:

  1. Purpose of processing: to fulfill legal obligations to which the Joint Data Controllers are subject (e.g. accounting, tax, administrative);
  2. Data processed: tax and billing data of clients.
  3. Legal basis: the processing is necessary to fulfill a legal obligation to which the Joint Controllers are subject pursuant to Art. 6, c. 1, lett. c) of the GDPR.
  4. Retention Period: the Joint Controllers will process the Personal Data of the Data Subjects for the time strictly necessary to achieve the purposes indicated in the aforementioned purposes.
  5. Provision of Personal Data: the provision of data is mandatory in order to follow up on legal obligations of the Joint Controllers indicated in the points above. Failure to provide it will result in the inability of the Joint Controllers to carry out the activities indicated above.

M) Anti-fraud and establishment, exercise or defense of a right:

  1. Purpose of processing: to verify the correspondence between the acquiring party and the holder of the selected payment instrument and the establishment, exercise or defense of a right of the Data Controllers, including in court.
  2. Data processed: first name, last name, order details and information on the type of payment instrument used to make the purchase, more generally, no new and specific provision of Personal Data is therefore required, as the Joint Controllers will pursue this additional purpose by processing, where necessary, the Personal Data already collected.
  3. Legal basis: legitimate interest in preventing and combating fraud and the exercise or defense of a right of the Data Controllers under Article 6(f) of the GDPR.
  4. Retention period: two years following the collection of the data or for the duration of any judgment.
  5. Provision of personal data: it is mandatory for the pursuit of the legitimate interests of the Data Controllers indicated in the points above. Failure to provide it will result in the impossibility of carrying out the activities indicated above.

4. Recipients and possible categories of recipients of personal data. 

Personal data may be made accessible to, brought to the attention of, or communicated to the following parties, who will be appointed by the Joint Data Controllers, as appropriate, as data processors or authorized persons, or will act as independent data controllers:

  • employees and/or collaborators in any capacity of the Data Controllers;
  • suppliers and partners of the Contractors who provide services and all activities related to the Site, IT or marketing service providers etc. appointed as data processors, through the signing of a contract;
  • freelancers and consultants for the purposes of legal, financial and accounting management of the activities of the Contactors (such as accounting, administrative, legal operators etc.) and credit institutions and insurance companies, acting as autonomous data controllers.
  • public authorities or police forces, in cases provided for by law.

It should be noted that Data Subjects's data will be stored in Servers located within the European Union.

5. Transfer of data to countries outside the European Union:

Personal data collected may be transferred outside the European Union. In this case, the transfer will take place in compliance with the provisions of the EU Regulation 2016/679 ("GDPR"). In particular, data will be transferred only upon signing Standard Contractual Clauses approved by the EU Commission by Decision No. 2021/914/EU or to Countries that can guarantee an adequate level of protection of personal data and therefore recipients of an Adequacy Decision adopted by the EU Commission.

In this last regard, please note that iI website https://ucapitalprop.com  currently uses analytics cookies from Google Ireland Ltd. Any possible transfers of data to the United States enjoy the legal basis of Article 45 of the GDPR, an Adequacy Decision having come into force in July 2023 with respect to the United States which provides for the possibility of transferring data to U.S. companies that have undergone the required certification mechanisms. Google holds all the required and necessary certifications in order to be able to carry out the data transfer in compliance with the applicable regulations.

6. Cookies

Cookies are small text files that visited sites send to the User's terminal, where they are stored, and then retransmitted to the same sites on the next visit. Cookies allow sites to function properly and efficiently to enhance the User's experience by allowing the from time to time relevant site to store information in the memory of the User's computer or other device.

Cookies can be classified in different ways, i.e., depending on the site that generates them, depending on their duration, and depending on their purpose of use.

Classification of cookies according to the site that generates them:

  • First Party Cookies: are generated by the site that the User is visiting and only that site can read this data.
  • Third Party Cookies: are generated by other sites, outside of the one the User is visiting. When the User visits a page on a site, he or she may encounter content posted by external sites such as Facebook, Twitter, You Tube, Vimeo or others, and those sites may generate cookies. The site covered by this policy has no control over them. Users are requested to check such sites and their Privacy Policies.

Classification of cookies according to their duration:

  • Temporary (or session) cookies: have no expiration date, and are deleted as soon as the browsing session ends or the browser is closed.
  • Persistent cookies: have an expiration date and remain on the computer even when the browsing session ends or after closing the browser. They can be read by the site that created them on subsequent visits to the same site.

Classification of cookies according to their purpose of use:

  • Technical cookies
  • Profiling cookies
  • Analysis cookies

In detail combining the classifications we have:

  • First-party Technical Cookies: This type of cookie allows certain sections of the Site to function properly. They are of two categories, temporary (or session) and persistent (see above). These cookies are necessary to properly display the site and in relation to the technical services offered, they will therefore always be used and sent, unless the visitor changes the browser settings (with the possibility, however, of not taking full advantage or making some services offered by the site unusable). Technical cookies are those used, for example, to authenticate, to take advantage of multimedia content such as flash player or to allow the choice of navigation language. In general, it is not necessary to acquire the User's prior and informed consent. The legal basis for their use is the legitimate interest of the Joint Controllers in the smooth operation of the website. In addition, analytical cookies through which the Joint Controllers learn only statistical information, collected in aggregate form, about the number of visitors and how they use the website are also assimilated to technical cookies. If the information is not collected in aggregate form and instead includes identifying data (e.g., the IP address used by the User's device that has not been anonymized), the cookies responsible for collecting this additional data will be qualified as "profiling cookies," active only with the user's consent.

  • Technical Cookies to integrate third-party functions: This type of cookies integrates functionality developed by third parties within the pages of the site such as icons and preferences expressed in social networks for the purpose of sharing site content or for the use of third-party software services (such as software to generate maps and additional software offering additional services). These cookies are sent from third-party domains and partner sites that offer their functionality between the pages of the site.

  • Third-party service analytics cookies: These cookies are used in order to collect information about Users' use of the site: pages visited, time spent on the site, source traffic origins, geographic origin, age, gender and interests for the purpose of marketing campaigns. These cookies are sent from third-party domains external to the site and according to current regulations can be assimilated to technical cookies "if tools are adopted to reduce the power of identification and the third party does not cross-reference the information collected with others it already has" or can be assimilated to profiling cookies otherwise.

  • Profiling cookies: These are those cookies necessary to create User profiles in order to send advertising messages in line with the preferences expressed by the User within the pages of the site. This type of cookie is not currently operating within the Site in question.

  • Social widgets and plug-ins: some widgets and plug-ins made available by social networks may use their own cookies to facilitate interaction with the site in question;

Technical cookies do not require the acquisition of prior and informed consent from the User for their installation. The legal basis for their use is the legitimate interest of the Joitn Controllers in the smooth operation of the website.

On the other hand, with regard to non-technical cookies, the User's prior consent will be requested at first access. Without such consent, cookies will not be able to be installed on the User's device, who will be able to manage their preferences at any time. Any consent given to the use of cookies is valid for 6 months, after which the cookie banner will be shown again to renew your preferences.

Listed below are, in detail, the cookies installed on the page https://ucapitalprop.com . For each cookie are given the following data: source, cookie name, type, duration and purpose.

List of cookies that require prior consent from the User
Consent is required for the following cookies, without which they will therefore not be installed on Users' devices.

Source: UCapital Academy
Cookie's name: Cookie_ga
Type of Cookie: analysis
Duration: 1 year 1 month 4 days
Purpose: Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors.


Source: UCapital Academy
Cookie's name: _gid Duration
Type of Cookie: analysis
Duration: 1 day
Purpose: Google Analytics sets this cookie to store information on how visitors use a website while also creating an analytics report of the website's performance. Some of the collected data includes the number of visitors, their source, and the pages they visit anonymously.


Source: UCapital Academy
Cookie's name: _gat
Type of Cookie: performance
Duration: 1 minute
Purpose: Google Universal Analytics sets this cookie to restrain request rate and thus limit data collection on high-traffic sites.


How to disable cookies by browser configuration:
In general, Cookies can be disabled by the User by controlling and/or modifying the settings of his/her browser according to the instructions made available by the respective providers at the links provided below:

More information on cookies is available at http://www.youronlinechoices.com/it .

7. Rights of Data Subjects.

Data Subjects may exercise the rights set forth in Articles 7, c. 3, and 15 et seq. of the GDPR by sending an e-mail to privacy@ucapital24.com , or, alternatively, a communication by registered letter with return receipt to the registered office of UCapital24 at Via dei Piatti 11, 20123, Milan (MI), identified by the Data Subjects as the point of contact.

The Interested Party may, in particular:

  • obtain confirmation as to whether or not personal data concerning him/her are being processed and the purposes of such processing;
  • access his or her personal data and information about the processing, as well as request a copy of such personal data;
  • obtain rectification of inaccurate personal data and supplementation of incomplete personal data;
  • obtain, if one of the conditions provided for in Article 17 of the GDPR exists, the deletion of personal data concerning him or her;
  • obtain, in the cases provided for in Article 18 of the GDPR, the restriction of processing;
  • if the conditions of Article 20 of the GDPR are met, receive the personal data concerning him or her in a structured, commonly used, machine-readable format and request its transmission to another data controller, if technically feasible.

Right to object to processing for the pursuit of the legitimate interest of the Joint Data Controllers.

Each Data Subject has the right to object at any time to the processing of his or her personal data carried out in pursuit of a legitimate interest of the Joint Data Controllers. In the event of opposition, personal data will no longer be processed, unless there are legitimate grounds for processing that override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defense of a legal claim.

Right to withdraw consent.

Where consent is required for the processing of personal data, each Data Subject may, in addition, revoke any consent already given at any time, without affecting the lawfulness of the processing based on the consent given prior to revocation. Consent may be revoked by writing an e-mail to privacy@ucapital24.com .

Right to file a complaint with the Guarantor.

Each Interested Party may file a complaint with the Italian Data Protecion Authority in the event that he or she believes that his or her rights under the GDPR have been violated, in the manner indicated on the Italian Authority's website accessible at: www.garanteprivacy.it .

8. Changes to this policy

This policy may be subject to updates or changes (also due to new legislation or regulations) for this reason Users are invited to check this document regularly. Substantive changes will in all cases be highlighted via the Site or notified by e-mail.

Date of last revision: 18/01/2024