Who is responsible
[legal entity name], trading as Eon Quant, [street address], [e-mail], decides how your data is used (the controller). Our representative in the European Union: [name, address, e-mail]. Later the Swiss company [company name] takes this role; we will tell you first.
What we collect
- Your name, e-mail address, country of residence and your confirmation that you are 18 or over.
- Your invitation code.
- Your sign-in data: a password, stored only as a secure hash, and your two-step sign-in settings.
- The account size you type and the dial you choose, because together they set how large the copied positions are, and whether you start with the next trade or join trades in progress.
- Your Interactive Brokers account number, which we pass to an independent third-party trade-copying provider (“the provider”) only so it can request the connection. Once the link is approved we keep only its last four digits.
- What the provider tells us back: its own connection reference and the state of your link.
- Which terms and notices you accepted, and when.
- Security records: sign-ins, changes to your account and the requests you make, with time, device and IP address; our host also logs IP addresses of visits for security.
We never ask for your broker login, password, identity documents or broker forms: if Interactive Brokers needs them, you send them to the provider. We do not see card details; when paid plans start, the payment processor handles them.
Name, e-mail, country, the account size and the account number are needed to set up copying; without them we cannot provide the service. News e-mails are optional.
Why we use it, and on what basis
- To run your account and the service you asked for: the contract with you.
- To keep invoices and records the law requires: a legal obligation.
- To protect accounts and stop misuse: our legitimate interest in security.
- To send occasional product news, only if you ticked the box: your consent, which you can withdraw at any time.
We make no automated decisions about you and build no profiles.
Who receives it
- The provider, in the United States, receives your name, e-mail, country, IP address, Interactive Brokers account number and the position size your dial sets, to set up copying. It has its own privacy policy, which you accept when you sign its agreement. Ask us and we tell you its name.
- Our database host stores the data in Zurich, Switzerland.
- Our website host in the United States serves the site.
- [e-mail provider] sends sign-in and service e-mails.
- A payment processor, when paid plans start, processes payments; it also acts on its own account for fraud checks and its legal duties.
- Our accountant and authorities, where the law requires it.
We do not sell your data and do not share it for advertising.
Transfers abroad
Switzerland is recognised by the EU as giving adequate protection. Transfers to the United States rely on the EU-US and Swiss-US Data Privacy Frameworks where the recipient is certified, and otherwise on the European Commission’s standard contractual clauses. Write to us for a copy of those clauses.
How long we keep it
- Account data: while you hold an account, then [12 months], only to answer questions or claims about the service.
- The full Interactive Brokers account number: only until the link is approved; then the last four digits. Encrypted backups may hold it for up to [backup period] more.
- The provider’s connection reference: while you hold an account.
- Records of what you accepted (including news consent), with the IP address they came from: at least 3 years, or 1 year after the contract ends if that is longer.
- Invoices: [10 years], as accounting law requires.
- Security records: [90 days], longer only when needed to investigate an incident.
If you delete your account, everything else is deleted or made anonymous; the provider keeps its own records under its own policy.
Your rights
You can ask to see, correct, delete or receive a copy of your data, to restrict or object to its use, and withdraw consent at any time. In Settings you can export your data and delete your account yourself. Otherwise write to [e-mail]; we answer within one month (30 days under Swiss law). You may also complain to a data-protection authority, for example the Garante in Italy or the FDPIC in Switzerland.
Security
We use two-step sign-in for every account, encrypted connections, passwords stored as hashes, access limited to what each part of the system needs, and logs of every request that can change your account. If you lose your authenticator, we confirm it is you by e-mail and your account details before resetting it.
Changes
We announce changes to this policy by e-mail before they apply. The date at the top shows the current version.