Privacy Policy

Introduction and scope

This Privacy Policy explains what personal information Geldtrades collects, why we collect it, how we use, share, store and protect it, and the choices and rights you have. We want it to be easy to read, so we explain things in plain English.

It applies to the Geldtrades website at geldtrades.com and the Geldtrades app (the web app you reach when you sign in), including sign-up, sign-in, identity verification, your wallet, deposits and withdrawals, copying strategies, trading as a lead trader, customer support and our emails. It does not apply to websites or services run by others that we link to or rely on (see "Third-party links").

Geldtrades is a copy-trading service for residents of Uganda. We handle personal data in line with Uganda’s Data Protection and Privacy Act, 2019. By using Geldtrades you confirm you have read this policy. If you do not agree with it, please do not use the service.

Who we are

Geldtrades is operated from Kampala, Uganda. For the purposes of the Data Protection and Privacy Act, 2019, Geldtrades decides how and why your personal data is used and is the data controller.

You can reach us at support@geldtrades.com for support and privacy requests, and at contact@geldtrades.com for general enquiries.

Information we collect

We collect only what we need to run the service, meet our legal duties and keep accounts safe. The table shows what we collect, where it comes from and why.

We do not knowingly collect special categories of sensitive data beyond what identity documents contain, and we do not use your data to make decisions about you by automated means alone that significantly affect you.

Google user data

You can create a Geldtrades account or sign in with your Google account. This section explains exactly what we do with the information Google gives us.

Which Google data we access. We ask Google for three scopes only: openid, email and profile. These tell us who you are. In practice we read these items from the identity token Google returns: your Google account ID (a unique identifier), your email address, whether Google has verified that address, and your name. Google may also include a link to your profile picture; we do not read or store it. We do not request or receive any Gmail, Google Drive, Google Calendar or Contacts data, or any other Google service data, and we never see your Google password.

Why we use it. We use this information only to create your Geldtrades account or sign you in, to link your Google sign-in to your Geldtrades account, to show your name on your account where one is provided, to run security and fraud checks on sign-in, and to send you account notices (for example when Google sign-in is linked or removed, or if you need to recover your account). We do not use it for anything else.

How it is stored and protected. We keep your Google account ID and the email address Google gave us in our database, with access limited to our systems and authorised staff. Sign-in with Google uses a secure server-side flow with a one-time state value, a nonce and PKCE, and our server checks the signature, issuer, audience and expiry of Google’s identity token before it trusts it. We do not store any Google access token or refresh token: after we confirm your identity, the tokens are discarded. We store nothing from Google beyond what is listed in this section. If you are new, this information is held for a short time (minutes) in a single-use record while you finish sign-up, and then it becomes your account record.

Sharing. We do not sell your Google user data. We do not share it with advertisers, data brokers or other third parties, and we never use it for advertising, profiling or to build marketing audiences. We pass it on only to service providers that help us run your account under contract (for example our cloud hosting and email providers), or when the law or a court requires it.

Who can see it. No one at Geldtrades reads your Google user data, except where needed for security (for example investigating abuse or a suspected account takeover), to help you with a support request that you have asked us to look at (with your consent), or where the law requires it.

Retention and deletion. We keep Google-sourced information for as long as your Geldtrades account is open, or until you disconnect Google. When you unlink Google, we delete the Google sign-in record (the account ID and the email recorded with it) from your account. You can unlink from Settings in the Geldtrades app (you will need another way to sign in, such as a password, and a fresh security check). You can also ask us to delete your account and data by emailing support@geldtrades.com from the email address on your account; some records must be kept by law (see "Data retention"). Your account email address stays on your account until the account itself is deleted.

Revoking access. You can remove Geldtrades’s access to your Google account at any time at https://myaccount.google.com/permissions.

Geldtrades's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

We use personal information to:

• create and manage your account, and let you sign in securely;
• verify your identity and check eligibility (18 or over, resident of Uganda);
• process deposits and withdrawals, keep your wallet ledger, and issue statements;
• allocate your money to the strategies you choose, value units every hour and charge fees;
• prevent fraud, money laundering and abuse, and keep Geldtrades secure;
• send you service messages such as security alerts, payment confirmations and changes to our terms;
• send product updates by email, only if you opted in (you can opt out at any time);
• answer your questions, resolve disputes and provide support;
• meet our legal and regulatory obligations and respond to lawful requests from authorities;
• understand how the service is used so we can fix faults and improve it, using aggregated or de-identified data where we can.

We do not sell personal data, and we do not use it for third-party advertising.

Legal bases

The Data Protection and Privacy Act, 2019 requires a lawful reason for using personal data. We rely on the following.

Sharing and disclosure

We do not sell your personal data. We share it only with the following, and only as needed for the purpose described.

Service providers act on our instructions under contract and may use your data only to provide their service to us. Lead traders see strategy-level information such as the number of copiers and assets under copy; we do not give them your contact details.

Information received from Google is shared only as described under "Google user data".

Cookies and similar technologies

We use only the cookies the service needs, and two that remember your display choices. We do not use advertising, analytics or cross-site tracking cookies. Because every cookie below is essential or a preference you set yourself, we do not show a cookie banner. You can block or delete cookies in your browser, but signing in will not work without the essential ones. Our Cookie Policy lists them too.

International transfers

Geldtrades is based in Uganda, but some of the providers we use, such as cloud hosting, email delivery, identity verification and the trading venues, may store or process data in other countries. When your personal data is sent outside Uganda we do it only as the Data Protection and Privacy Act, 2019 permits: to a country or organisation that gives protection at least equal to Ugandan law, with your consent, or where it is necessary to provide the service you asked for. We require our providers to protect it with appropriate safeguards.

Data retention

We keep personal data only for as long as we need it. We keep data for as long as your account is open and afterwards for the period required by law, including anti-money-laundering record-keeping rules. When data is no longer needed it is deleted or anonymised.

Data security

We use measures that suit the risk. These include encrypted connections (HTTPS) to our website, passwords stored only as one-way hashes, two-factor authentication (required before you can withdraw), encryption of secrets such as authenticator keys, limiting access to personal data to staff who need it, and a record of staff actions on sensitive data.

No online service is completely secure and we cannot promise that data will never be accessed without authority. Please keep your password and authenticator private. We will never ask you for your password, Mobile Money PIN or two-factor codes. If a security incident affects your personal data we will tell you and the authorities as the law requires.

Your rights and choices

Under the Data Protection and Privacy Act, 2019 you have rights over your personal data. You can ask us to:

• Access: tell you whether we hold your personal data and give you a copy;
• Correction: correct data that is wrong or incomplete;
• Deletion: delete data we no longer need or should not hold, subject to records we must keep by law;
• Objection and restriction: stop or limit certain uses, including direct marketing;
• Portability: give you your data in a commonly used format, where this applies;
• Withdraw consent: stop uses that rest on your consent, such as product emails or optional Google sign-in.

How to ask: email support@geldtrades.com from the email address on your account (or contact us from inside your account), say which right you want to use, and we may ask you to confirm your identity. We will answer within 30 days. There is no fee unless a request is clearly unreasonable or repeated.

Complaints: if you think we have not handled your data properly, please tell us first so we can put it right. You also have the right to complain to Uganda’s Personal Data Protection Office, which is run by the National Information Technology Authority, Uganda (NITA-U), or to go to court.

Account deletion

You can close your account at any time after withdrawing your funds. To have your account and personal data deleted, email support@geldtrades.com from the email address on your account. We will confirm your identity, pay out any remaining balance to a verified payout destination in your name, and then delete or anonymise your data within 30 days, except records we must keep by law, such as financial and anti-money-laundering records, which are kept for the legally required period and then deleted.

Deleting your account also deletes the Google sign-in record linked to it. To stop Google sharing information with Geldtrades in future, also remove access at https://myaccount.google.com/permissions.

Children

Geldtrades is for adults only. You must be 18 or older to create an account. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us information, email us and we will delete it.

Third-party links

Our website and emails may link to websites and services we do not run, such as Google, payment processors, trading venues and help resources. Their privacy practices are their own and this policy does not cover them. Please read their policies before giving them information.

Changes to this policy

We may update this policy when our service, providers or legal duties change. The date it was last updated is at the top, and every version is listed at the bottom of this page. If a change is material we will tell you by email or in the app before it takes effect, and where the law requires it we will ask for your consent again. If you do not agree with a change you can close your account.

Contact

Questions, privacy requests and complaints: support@geldtrades.com.

General enquiries: contact@geldtrades.com.

Geldtrades, Kampala, Uganda.