Privacy Policy

ZAD Ventures FZE (“we”, “us”) operates OneTapTrade and is the data controller for personal data processed through the Platform. This Policy explains our practices under the UAE Federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “PDPL”) and applicable data protection laws. Questions: privacy@onetaptrade.com.

1. Data We Collect

We do not seek to collect sensitive personal data. Do not submit sensitive data (health, biometric, government IDs) through the Platform unless we request it for identity verification under our financial crime obligations.

2. Connection Credentials — Specific Commitments

2.1. Connection credentials are encrypted at rest and in transit, held separately from general account data, and accessible only to the systems that operate the services you have activated.

2.2. We use connection credentials solely to generate and transmit trading orders and to read the state of your account, for the Bots you have activated. We do not use them to withdraw or transfer funds. On MetaTrader we hold your master (main) password, which permits trading but not withdrawal — withdrawals are processed only through your broker’s own client portal, using separate credentials, and we have no access to it. Where a venue connects by API key instead, we ask you to issue a trading-only key with withdrawal permissions disabled.

2.3. Credentials are never shared with other users, sold, or used for any purpose other than operating your Bots.

2.4. You may delete a connection at any time from the Platform. Deletion removes the stored credential from active systems immediately and from backups within 30 days. Deleting a connection here does not change your password at your broker. To be certain no further orders can be placed, also change your master password in your broker’s client area (or revoke the API key, where a venue connects that way).

2.5. Staff access to credential stores requires multi-factor authentication and is logged. Credentials are not readable in plain text by staff.

2.6. We do not ask for, store or use your broker client-portal login, your investor password, or any credential that would let funds be moved.

3. Lawful Bases and Purposes (PDPL Article 4)

Purpose Lawful basis Provide the Platform, operate your account, Contract performance process subscriptions Operate Bots, transmit orders, maintain Contract performance, following your the brokerage connection express Trading Authorization Retain authorization and execution Legal obligation and legitimate interest records in evidencing instructions given Service communications (password resets, Contract performance / legal obligation billing, critical notices, Bot alerts) Platform security, fraud prevention, logs Legitimate interest in securing our systems (limited scope under PDPL) Identity verification, sanctions and financial Legal obligation crime screening Marketing emails/SMS/push Consent — separate opt-in, withdrawable at any time Analytics and product improvement Consent (via cookie banner) for non-essential processing Legal compliance, dispute defence, Legal obligation tax/accounting

Consent standard: consent is specific, informed, unambiguous and freely given. Pre-ticked boxes are never used. You may withdraw consent at any time via account settings, unsubscribe links, or privacy@onetaptrade.com, without affecting the lawfulness of prior processing. Withdrawing marketing consent does not affect your Trading Authorization, which is revoked separately.

4. Sharing and Recipients

We share data only with: (a) service providers under contract — cloud hosting, payment processing, email delivery, analytics — bound to process data per our instructions; (b) your broker, to the extent necessary to transmit the orders you have authorised; (c) authorities where required by UAE law or to meet financial crime obligations; (d) successors in a corporate transaction, with notice.

We do not sell personal data. We do not share your trading activity, positions or strategy logic with other users, with data brokers, or with any third party for their own commercial purposes.

5. International Transfers

Where data is transferred outside the UAE (for example to cloud regions or processors abroad), transfers are made on the basis of your consent, contractual necessity, or contractual safeguards modelled on recognised standard contractual clauses, as permitted by PDPL Articles 22–23. A list of material transfer destinations is available on request. Note that transmitting orders to a broker located outside the UAE necessarily involves a transfer to that jurisdiction.

6. Your Rights (PDPL Article 13)

Subject to law, you may request access (free of charge), rectification, erasure, restriction of processing, objection, and data portability in a structured, machine-readable format. Submit requests to privacy@onetaptrade.com. We respond within 30 days. You may also lodge a complaint with the UAE Data Office.

Limits on erasure. We must retain authorization records, execution logs and billing records for the periods in Section 7, because they evidence instructions you gave and transactions carried out on them. We will erase everything not subject to a retention obligation.

7. Retention

• Connection credentials: until you delete the connection; purged from backups within 30

days

• Trading Authorization records, order and execution logs: 5 years from the date of

the relevant activity, as evidence of instructions given and acted on

• Bot configurations and strategy code: life of the account, then 12 months
• Account data: life of the account + 24 months (dispute defence)
• Billing and tax records: minimum 5 years, as required by UAE tax law
• Consent records: duration of processing + 2 years
• Security and access logs: 12 months unless required for an ongoing investigation

Data is then securely deleted or anonymised.

8. Security

We apply encryption in transit and at rest, segregated storage for brokerage credentials, role-based access controls, multi-factor authentication for administrative access, access logging, and periodic security assessments, consistent with PDPL Article 20. No system is perfectly secure; your obligations for securing your own account and credentials are set out in the Terms.

9. Breach Notification

In the event of a personal data breach we will notify the UAE Data Office without undue delay (target: within 72 hours of confirmation) and affected users where the breach is likely to result in risk to their data, in accordance with the PDPL. Where a breach affects brokerage connection credentials, we will notify affected users immediately and instruct you to change your master password at your broker (or revoke the key, where one is used), regardless of assessed risk level.

10. Children

The Platform is not directed at persons under 18. We do not knowingly collect children’s data. If you believe a minor has registered, contact privacy@onetaptrade.com for deletion.

11. Changes

We will post changes with a revised date and, for material changes, notify you by email or in-Platform notice 14 days in advance.

This page reproduces the text of the signed PDF, which remains the authoritative version of this document.