Draft: to be checked by a qualified professional. The fields in square brackets must be filled in before publication.
Privacy notice
under Article 13 of Regulation (EU) 2016/679 ("GDPR") · last updated: [DATA DI PUBBLICAZIONE]
This notice explains what data we collect when you ask for the free FDB AURUM indicator licence, why we collect it, who we share it with, how long we keep it and how you exercise your rights.
1. Data controller
[DATI DI FABRIZIO: name or company name, address, VAT number]
Controller's privacy contact: [CONTATTO DEL TITOLARE].
You can exercise many of your rights yourself, at any time, from the My data page of the website (section 8). For the other rights, and for any privacy question, use the contact above.
No data protection officer (DPO) has been appointed, because one is not required for this activity.
2. What data we process
a) Form data, step 1 (required to get the licence): first name, last name, email address, MetaTrader 5 account number, broker, broker server name, account type (real or demo), country, preferred language, and your choices on the acceptance and consent boxes, with date, time and version of the text.
b) Optional contacts in step 1: phone or WhatsApp, Telegram username, Instagram username, only if you type them.
c) Profile data, step 2 (optional): trading experience and years, style, timeframes, instruments traded, band of capital put into trading, goal, use of indicators or EAs, how you heard about us, age band, region or province, city, whether you agree to be contacted again and, if you type them, your Telegram username or phone number. Step 2 also holds the optional box for the profiling consent.
d) Technical and security data: IP address, date and time of requests, browser type (user agent), result of the email check, number of code attempts, requests for a new link or for the My data page and, if used, the result of the anti-spam check.
e) Licence data: licence identifier, issue date, the account it is issued for, the licence itself (a signed string that contains the account number), date and number of downloads.
What we do not collect. The FDB AURUM indicators do not connect to the internet and send no data at all: we do not know when you use them, on which charts, or which trades you make. We never ask for your account password or for payment details. We do not ask for special categories of data (Article 9 GDPR) such as health, political or religious opinions: please do not type them in the free-text fields.
The page uses no profiling cookies and no third-party analytics tools, and it loads no resources from other websites. [IF CLOUDFLARE TURNSTILE IS ENABLED: Cloudflare's anti-spam check may use technical browser data to tell people apart from automated programs; see section 5.]
3. Why we process it and on what legal basis
| Purpose | Data | Legal basis | Are you required to provide it? |
|---|---|---|---|
| Issuing the licence, confirming your email, sending you the download link and letting you ask for a new one | a, e, d (email and code) | performance of a contract to which you are a party, namely the free licence to use (Art. 6(1)(b)) | yes: without this data we cannot give you the licence |
| My data page: sending you the access link, showing you your data, recording the consents you change, preparing the copy to download, erasing your data | a, b, c, e, d | compliance with a legal obligation, namely answering requests about your rights (Art. 6(1)(c) and Articles 12-22) | no: you use it only if you wish |
| Marketing: news, updates and initiatives from FDB AURUM by email and on the optional contacts you entered | name, email, language, b | consent (Art. 6(1)(a)), optional box in step 1 | no |
| Profiling: using your profile answers to understand your trader profile and send you communications better suited to you | c, together with a | consent (Art. 6(1)(a)), optional box in step 2 | no |
| Anonymous statistics about users (for example how many use H4, how many come from Telegram) | c, in aggregate form | legitimate interest in improving the indicators and the guide (Art. 6(1)(f)) | no |
| Being contacted for your opinion on the indicators, only if you ask for it in your profile | the email, Telegram or phone you give | consent (Art. 6(1)(a)) | no |
| Security and abuse prevention: preventing automated registrations, duplicate licences, abuse of codes and links | d, a | legitimate interest in protecting the service and the licences (Art. 6(1)(f)) | yes, it is part of the service |
| Proof of consent and legal defence: keeping a record of when and how you accepted the terms or gave a consent | boxes, date, time, version of the text, IP | legitimate interest (Art. 6(1)(f)) and the duty to demonstrate consent (Art. 7(1)) | yes |
The marketing consent and the profiling consent are separate, optional and can be withdrawn at any time from the My data page, with no effect on your licence. Withdrawing them does not make unlawful what was done before.
Without the profiling consent, your profile answers are separated from your details and made anonymous within 30 days of collection or of the withdrawal of consent, in the copy on the Google sheet too. From then on they are used only for statistics.
Automated decisions. We do not take decisions based solely on automated processing that produce legal effects concerning you. The automatic abuse checks (for example "too many requests") only serve to stop abuse and lift themselves after a while. If you believe you have been blocked by mistake, contact the controller: [CONTATTO DEL TITOLARE].
4. How we process the data
The data is processed with IT tools. The main archive is a database on a virtual private server (VPS) run on the controller's behalf. A copy of the form and profile data is kept in a Google sheet shared only between the controller and [NAME OF LUIGI OR OF THE TECHNICAL MANAGER, ROLE TO BE DEFINED: for example processor under Article 28]. The sheet never holds verification codes, licence keys, download links, My data links or IP addresses.
Confirmation codes are valid for a few minutes and can be tried a limited number of times. Download links and My data links are random, they expire, and the server stores them only in a form that cannot be read back (a cryptographic hash). Communication between your browser and the server is encrypted (HTTPS).
5. Who we share the data with
The data is not sold or made public. It may be received, only for the purposes above, by:
- [NAME AND COUNTRY OF THE VPS PROVIDER TO BE FILLED IN], which hosts the server and the database;
- Google (Google Ireland Ltd. and Google LLC), for the shared spreadsheet (Google Sheets and Apps Script) and for sending the emails with the code, the download link and the My data link (Gmail);
- Telegram (Telegram FZ-LLC and affiliated companies), for an internal notice to the controller at each new confirmed registration, which holds only the registration's sequence number, the account type (real or demo), the broker and the country: never name, email, account number or licence;
- [ONLY IF ENABLED] Cloudflare (Cloudflare Inc.), for the Turnstile anti-spam check;
- the controller's advisers (for example accountant or lawyer) and public authorities, where the law requires it.
These providers process the data as processors (Article 28 GDPR) under their terms for the services used, or as independent controllers for their own purposes, under their own privacy notices.
6. Transfers outside the European Union
Google, Telegram and, if enabled, Cloudflare may also process the data outside the European Union, for example in the United States or in the United Arab Emirates. In these cases the transfer relies on an adequacy decision of the European Commission (for the United States, the EU-US Data Privacy Framework, for the companies that take part in it) or on the standard contractual clauses approved by the Commission (Article 46 GDPR). [CHECK THE COUNTRY OF THE VPS: if it is outside the EU, state it here with the relevant safeguard.] You can ask the controller for a copy of these safeguards: [CONTATTO DEL TITOLARE].
7. How long we keep the data
| Data | Period |
|---|---|
| Registration started but email never confirmed | erased within 7 days |
| Confirmation codes | a few minutes, then unusable |
| Download links | 30 days or 20 downloads, then unusable |
| My data links | 24 hours, then unusable |
| Licence data, form data and optional contacts | as long as the licence exists, or until you ask for erasure |
| Marketing data | until you withdraw consent, and in any case no longer than 24 months from the last meaningful contact (for example an opened email or a request from you), unless consent is renewed |
| Profile data with the profiling consent | until you withdraw consent, and in any case no longer than 12 months from collection or from the last update |
| Profile data without the profiling consent | separated from your details and made anonymous within 30 days of collection or of the withdrawal of consent, in the copy on the Google sheet too |
| Technical and security logs (IP, browser, attempts) | 90 days, including those saved with the registration and with your requests; they remain only in the proof of consents (last row) |
| Proof of consents and of the acceptance of the terms | as long as your data stays in the database; on erasure it is deleted too [TO BE ASSESSED WITH THE PROFESSIONAL: any minimum retention for legal defence] |
What happens on erasure. We delete from the database your name, email, contacts, broker and server, profile, consents, links and events, and we remove your row from the Google sheet. Only the licence number and the account number it was issued for remain, marked as deleted, together with the date of erasure: the account number is kept so that a second licence is never issued for the same account (each account can be registered only once, section 3, security and anti-abuse), the date so that we know the request was carried out. Backup copies of the database are protected and kept for 30 days: your data leaves them when the oldest copies are removed. [TO BE ASSESSED WITH THE PROFESSIONAL: Google Sheets keeps the version history of the sheet, where the removed row is still visible to the controller.]
[PERIODS TO BE CONFIRMED WITH THE PROFESSIONAL.]
8. Your rights
You always have these rights, free of charge: access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20), objection to processing based on legitimate interest (Article 21) and withdrawal of consent at any time (Article 7(3)).
From the My data page, on your own. On the website, open My data and type the email you asked for the licence with: if it is registered and confirmed, we send you a link, valid for 24 hours and only for that page. From there you can:
- see your data (access): form details, account, broker and server, consents with date and version of the text, profile, number of downloads and your licence;
- download it as a file in JSON format, readable by a computer (portability);
- give or withdraw the marketing consent and the profiling consent;
- erase your data, with the consequences described in section 7.
You can also withdraw the marketing consent through the link included in every promotional email.
Rectification. Registering again does not correct your data: each email and each account number can be registered once, so a second registration would be refused. To correct data that is wrong or incomplete, contact the controller: [CONTATTO DEL TITOLARE]. The account number is written into the signed licence: changing it requires a new licence, and this is not a service we offer.
The other rights (restriction, objection, questions about this notice): contact the controller, [CONTATTO DEL TITOLARE]. We reply within one month. To protect your data, we may ask you to confirm the request from the email you registered with.
Erasure and the licence. The indicators check the licence on their own, without internet: erasing your data does not switch off a licence that is already installed, and the licence cannot be revoked. After erasure, however, we can no longer send you a new link and you can no longer enter the My data page.
Complaints. If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome · www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.
9. Minimum age
The licence is only for people aged 18 or over. We do not knowingly collect data from minors: if we find a registration by a minor, we erase it.
10. Changes
We may update this notice. The version in force is always on this page, with the date at the top. If the changes affect processing based on your consent, we will ask you for it again.