Privacy Policy
Your privacy is our priority. Find all relevant information below.
Introduction and Purpose
XSpot Wealth (EU) Ltd. (hereinafter referred to as the “Company”) is a Cypriot Investment Firm incorporated and registered under the laws of the Republic of Cyprus with registration number HE320496. The Company is authorised and regulated by the Cyprus Securities and Exchange Commission under licence number 235/14.
The Company provides investment and ancillary services to clients on a cross-border basis within the European Economic Area in accordance with the provisions of Directive 2014/65/EU (MiFID II) and may also provide services to clients in third countries where permitted under applicable legislation.
The Company recognises the importance of protecting the privacy and personal data of its clients, prospective clients, and users of its website and electronic platforms. The Company is committed to ensuring that personal data is processed in a lawful, fair, and transparent manner and in accordance with applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679.
This Privacy Policy describes the principles and procedures followed by the Company in relation to the collection, processing, storage, protection and disclosure of personal data. The purpose of this Policy is to ensure transparency and accountability regarding the manner in which personal data is handled in the course of the Company’s business activities.
Data Controller
For the purposes of applicable data protection legislation, the Company acts as the data controller with respect to personal data collected and processed in connection with the services it provides.
Any queries regarding the processing of personal data or requests relating to the exercise of data protection rights may be directed to the Company using the following contact details:
XSpot Wealth (EU) Ltd
Kritis 32, Papachristoforou Building, 2nd Floor, 3087 Limassol,Cyprus
Telephone: +357 25571044 Email: support@xspotwealth.com
Data Protection Officer
The Company has appointed a Data Protection Officer who is responsible for overseeing compliance with applicable data protection legislation and advising the Company on its obligations under such legislation.
The Data Protection Officer also serves as the primary point of contact for data subjects and supervisory authorities in relation to matters concerning the processing of personal data and the implementation of this Privacy Policy. The Data Protection Officer may be contacted at: fdimitriou@bcsce.com
Scope and Legal Framework
This Privacy Policy applies to all personal data processed by the Company in connection with the provision of its services. This includes personal data relating to clients, prospective clients, website users, representatives of corporate clients, and individuals interacting with the Company in the course of its business operations.
The Company processes personal data in accordance with applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679, Law 125(I)/2018 of the Republic of Cyprus on the Protection of Natural Persons with regard to the Processing of Personal Data, the ePrivacy Directive 2002/58/EC relating to electronic communications, and other relevant national or international regulations governing the protection of personal data.
Legal Basis for Processing
The Company processes personal data only where a lawful basis exists under applicable data protection legislation. Personal data may be processed where such processing is necessary for the performance of a contract with the client, including the opening and maintenance of investment accounts and the provision of investment and ancillary services.
Processing may also be carried out where it is necessary for compliance with legal and regulatory obligations applicable to the Company. Such obligations may arise from financial services legislation, anti-money laundering regulations, tax reporting requirements, and regulatory obligations imposed by competent supervisory authorities.
In certain circumstances, the Company may process personal data on the basis of its legitimate interests, provided that such interests do not override the fundamental rights and freedoms of the data subject. Legitimate interests may include fraud prevention, system security, internal administrative purposes, and the improvement of services.
Where required by law, the Company may process personal data based on the consent of the data subject, particularly in relation to marketing communications. Data subjects may withdraw their consent at any time without affecting the lawfulness of processing carried out prior to such withdrawal.
Categories of Personal Data
In the course of providing its services, the Company may collect and process various categories of personal data. Such data may include identification and contact information such as name, date of birth, nationality, identification document details, residential address, telephone number and email address.
The Company may also process financial and employment information, including banking details, income and wealth information, employment status and occupation. In addition, the Company processes information relating to the client’s investment knowledge and experience, financial situation and investment objectives for the purpose of conducting suitability and appropriateness assessments in accordance with applicable regulatory requirements.
The Company may further process technical and electronic data generated through the use of its website or electronic systems, including IP addresses, device identifiers, browser information and usage data. Records of communications between the client and the Company, including emails, telephone conversations and electronic communications, may also be retained in accordance with applicable regulatory obligations.
Sources of Personal Data
Personal data may be obtained directly from clients during the account opening process or through communications with the Company. In certain circumstances, the Company may also obtain information from third-party sources including financial institutions, credit reference agencies, identity verification service providers, publicly available databases and other entities assisting the Company in complying with its legal and regulatory obligations.
Automated Decision-Making and Profiling
The Company may process certain personal data through automated systems for the purposes of client onboarding, compliance screening, risk assessment, fraud prevention, and suitability or appropriateness assessments required under applicable financial regulations.
Such processing may involve profiling based on financial information, trading experience, investment objectives, or other relevant information provided by the client.
Where automated decision-making significantly affects clients, the Company will ensure that appropriate safeguards are implemented, including the possibility for human review and the right for clients to express their views and contest decisions where applicable.
Purposes of Processing
The Company processes personal data for the purposes of providing investment and ancillary services, managing client accounts, executing transactions, and complying with regulatory obligations. Personal data may also be processed to conduct client due diligence, perform suitability assessments, detect and prevent fraud or financial crime, and ensure the security and integrity of the Company’s systems.
From time to time the Company may communicate with clients to provide information regarding its services, market developments, or other relevant updates. Clients may opt out of receiving marketing communications at any time.
Disclosure of Personal Data
The Company does not sell or otherwise commercially disclose personal data to third parties. However, personal data may be shared where necessary with regulatory authorities, financial institutions, professional advisors, service providers, and other entities assisting the Company in the provision of its services.
Such disclosures may also occur where required by law or where necessary to comply with legal or regulatory obligations. In particular, information may be disclosed to regulatory authorities, including the Cyprus Securities and Exchange Commission, as well as tax authorities in connection with obligations arising under international tax reporting frameworks such as FATCA and CRS.
The Company ensures that all third parties with whom personal data is shared are subject to appropriate confidentiality and data protection obligations.
International Data Transfers
In the course of providing its services, the Company may transfer personal data to service providers, affiliates, or regulatory authorities located outside the European Economic Area (EEA).
Where such transfers occur, the Company ensures that appropriate safeguards are implemented to ensure that personal data remains adequately protected in accordance with applicable data protection legislation.
Such safeguards may include:
- Transfers to jurisdictions recognized by the European Commission as providing an adequate level of data protection
- The use of Standard Contractual Clauses approved by the European Commission
- Transfers that are necessary for the performance of a contract with the client
- Transfers required for compliance with legal or regulatory obligations
The Company takes all reasonable steps to ensure that personal data transferred internationally is treated securely and in accordance with this Privacy Policy and applicable legal requirements.
Processing of Children’s Data
The Company’s services are intended for individuals who are at least eighteen (18) years of age. The Company does not knowingly collect or process personal data relating to individuals under the age of eighteen.
If the Company becomes aware that personal data relating to a minor has been collected without appropriate authorization, the Company will take steps to delete such data without undue delay.
Recording of Communications
Telephone conversations and electronic communications between clients and the Company may be recorded in accordance with applicable regulatory requirements. Such recordings may be retained for a period of up to seven years and may be used as evidence of communications or transactions carried out with the Company.
Clients may request access to recordings of communications relating to them, subject to applicable legal and regulatory restrictions.
Data Security
The Company implements appropriate technical and organisational measures to ensure the security of personal data and to protect such data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Access to personal data is restricted to authorised personnel who require such information for the performance of their duties. The Company maintains internal procedures designed to detect, investigate and respond to potential data security incidents.
Personal Data Breach Notification
The Company maintains procedures designed to detect, investigate, and respond to potential personal data breaches.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, the Company will notify the competent supervisory authority without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach, in accordance with applicable legal requirements.
Where the breach is likely to result in a high risk to affected individuals, the Company will also notify those individuals without undue delay, unless an exemption under applicable legislation applies.
Rights of Data Subjects
Clients’ Rights of Access to Their Personal Information
Clients have the right to obtain confirmation as to whether the Company is processing their personal data and, where applicable, to access the personal data held about them. Access includes a detailed description of the categories of data processed, the purposes of processing, the recipients or categories of recipients to whom the data has been disclosed, and the retention period applied.
Clients may submit a written request via email to backoffice@xspotwealth.com or by post to the Company’s registered address. Upon receipt of a valid request, the Company will provide a copy of the personal data in a commonly used and machine-readable format where technically feasible.
The Company will respond to access requests without undue delay and, in any case, within the timeframe prescribed under applicable data protection legislation. If requests are manifestly unfounded, excessive, or repetitive, the Company may charge a reasonable administrative fee to cover the cost of providing the information.
Clients’ Right to Erase Their Personal Information
Clients may request that the Company erase their personal data where one of the following conditions applies: the data is no longer necessary for the purposes for which it was collected; consent has been withdrawn and no other legal basis exists for processing; the client objects to the processing and no overriding legitimate grounds exist; or the personal data has been unlawfully processed.
The Company will assess each request in accordance with applicable legal and regulatory requirements, as certain obligations, such as anti-money laundering or record-keeping requirements, may limit the ability to erase personal data immediately. Where a request cannot be fully honored, the Company will communicate the reasons for refusal to the client in writing.
Requests for erasure may be submitted to backoffice@xspotwealth.com, and the Company will take reasonable steps to comply without undue delay.
Clients’ Rights Subject to Access
Clients also have rights related to the accuracy, rectification, and portability of their personal information. Clients may request that any inaccurate or incomplete data be corrected or updated. They may also request that their data be transferred to another data controller where technically feasible.
Additionally, clients have the right to object to certain processing activities, including direct marketing, profiling, or processing based on the Company’s legitimate interests, subject to applicable legal restrictions. Clients exercising these rights should submit their request in writing to backoffice@xspotwealth.com, and the Company will respond in accordance with legal timelines.
Clients may also withdraw any previously given consent for processing at any time. Withdrawal does not affect the lawfulness of prior processing.
Data Retention
The Company retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal, regulatory, and operational requirements.
Retention periods may vary depending on the nature of the data and the purpose for which it is processed. In particular:
- Client account records, onboarding documentation, and transaction data are retained for a minimum period required under applicable financial regulations.
- Telephone recordings and electronic communications relating to client transactions may be retained for up to seven (7) years in accordance with regulatory requirements.
- Anti-money laundering and customer due diligence documentation is retained for the period required under applicable AML legislation.
- Marketing-related personal data is retained until the client withdraws consent or opts out of receiving such communications.
At the end of the applicable retention period, personal data will be securely deleted, anonymized, or otherwise disposed of in accordance with the Company’s internal data retention and destruction procedures.
Complaints
Clients who believe that their personal data has been processed in violation of applicable data protection legislation have the right to file a complaint with the Company. Complaints should be submitted to complaints@xspotwealth.com and should include the client’s full name, contact details, description of the issue, and any supporting documentation or prior correspondence.
The Company is committed to investigating complaints in a fair, thorough, and timely manner. Clients will receive acknowledgment of receipt of their complaint and regular updates regarding the progress and resolution of the matter.
If a client is not satisfied with the outcome, they may lodge a complaint with the supervisory authority, namely the Office of the Commissioner for Personal Data Protection (Cyprus).
Contact details are as follows:
Iasonos 1, 1082 Nicosia, Cyprus
Email: commissioner@dataprotection.gov.cy
Website: www.dataprotection.gov.cy
Cookies
The Company uses cookies and similar technologies on its website to enhance functionality, improve user experience and maintain the security of its systems. Where required, users are asked to provide consent for the use of non-essential cookies through the website’s cookie consent mechanism.
Further information regarding the use of cookies is available in the Company’s Cookies Policy.
Updates to this Policy
The Company may amend or update this Privacy Policy from time to time in order to reflect changes in legal or regulatory requirements or changes in its business practices. Any updated version of this Policy will be published on the Company’s website and will indicate the date of the latest revision.
Related Policies
This Privacy Policy should be read together with the Company’s Cookies Policy, Terms and Conditions and other applicable policies governing the use of the Company’s services, all of which are available on the Company’s website at XSpot Wealth | Legal Documentation.
Updated at: 07.05.2026