Data Privacy Policy

1. Applicable Data Privacy Regulations

Although Oval Peak Partners Limited operates as an unregulated foreign exchange broker, we are committed to complying with relevant data protection laws, including but not limited to:

• The UK General Data Protection Regulation (UK GDPR)

• The Data Protection Act 2018

• Applicable provisions of the EU GDPR for clients based in the European Economic Area (EEA)

• Any local data privacy regulations applicable to clients in other jurisdictions

We adopt a principles-based approach to privacy, adhering to the standards of data minimization, lawfulness, fairness, transparency, and accountability.

2. Safeguarding Measures for Third-Party Data Sharing

We implement strict security protocols to ensure data shared with third parties is:

• Encrypted both at rest and in transit using industry-standard methods (e.g., TLS/SSL, AES-256)

• Shared only with vetted third-party processors under written agreements with data protection clauses

• Accessed strictly on a need-to-know basis, and only for pre-authorized purposes such as client onboarding, payment processing, or regulatory screening

Regular audits and risk assessments are conducted to confirm compliance with our data-sharing agreements.

3. Data Processing Registers

We maintain an up-to-date Data Processing Register in accordance with Article 30 of the UK GDPR. This includes:

• Categories of data subjects and personal data processed

• Purposes of processing

• Third-party recipients and international transfers

• Retention schedules

• Security and technical safeguards

• Lawful bases for each data processing activity

4. Incident Response Plan

In the event of a suspected or confirmed data breach, our Incident Response Plan includes:

• Immediate containment and investigation of the incident

• Internal notification to the Data Protection Officer (DPO) and relevant stakeholders

• Detailed breach log entry with time stamps, system affected, and data types involved

• Root cause analysis and remedial actions within 72 hours

5. Notification Procedures for Personal Data Breaches

If a personal data breach poses a risk to individuals’ rights or freedoms:

• We will notify the UK Information Commissioner’s Office (ICO) within 72 hours

• If the risk is high, we will also notify affected individuals without undue delay

• Notifications will include: nature of the breach, categories of data involved, likely consequences, and mitigation steps

Records of all data breaches are retained regardless of whether notification is required.

6. GDPR Principles and Individual Rights

We uphold the following GDPR-aligned principles:

• Lawfulness, Fairness, and Transparency – Clients are informed of their data use through our privacy notice.

• Purpose Limitation – Data is collected only for specified, legitimate purposes.

• Data Minimization – Only data necessary for operations is collected.

• Accuracy – Data is kept up-to-date.

• Storage Limitation – Personal data is deleted when no longer required.

• Integrity and Confidentiality – Security measures are in place to protect data.

• Accountability – A designated DPO oversees our compliance efforts.

Individuals may exercise their rights (access, rectification, erasure, restriction, objection, data portability) by contacting privacy@[yourcompany].com.

7. Third Parties and Jurisdictional Controls

The following third parties may access client personal data:

Third Party

Purpose

Jurisdiction

Controls in Place

AWS (Amazon Web Services)

Cloud hosting

UK/EU

Standard Contractual Clauses (SCCs)

Stripe

Payment processing

US

EU-US Data Privacy Framework compliant

Jumio

KYC/ID verification

EU/US

DPIAs and DPA signed

Google Workspace

Internal communications

EU/US

Data processing agreement + encryption

We perform due diligence and review contracts to ensure these third parties adhere to applicable data protection rules.

8. Consent Collection and Retention

Consent is obtained:

• During account registration, via explicit checkboxes and affirmative action

• For specific activities such as marketing, via opt-in choices

Consent is logged with timestamp, IP address, and purpose. Clients may withdraw consent at any time using account settings or by contacting us directly.

All data is logged for a mandatory 5 year "data retention" period under our industry specific guidelines.

9. Data Privacy Impact Assessments (DPIAs)

DPIAs are conducted:

• Before launching new data-intensive services or tools

• When changing how personal data is processed

• In any high-risk processing scenarios (e.g., biometric verification)

Our DPIA process includes:

• Identifying data types, stakeholders, and risks

• Consulting the DPO

• Applying mitigation and security controls

• Documenting outcomes and monitoring over time

10. Notification Process to Individuals and Authorities

Where required by law, our breach notification process includes:

• Evaluation by the DPO to determine severity and risk

• Reporting to the ICO or relevant regulator within 72 hours

• Clear, timely communication to individuals, including:

  • Nature of the breach

  • Information compromised

  • Recommendations for personal protection

  • Contact point for further information

All incidents are documented for audit and legal review purposes.

Contact
For any questions or to exercise your rights, please contact:
Email: enquiries@ovalpeakpartners.com
Contact: John Murphy