MFX Hub Privacy Statement
This statement explains how KUDMANI PTY LTD (ABN 46 620 061 814), trading as MFX Hub ("we", "us", "our"), handles personal information when you use MFX Hub, including its API, SDKs, console and status page (the "Service").
We handle personal information under the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where we process personal information in the United Kingdom or the European Union, or about people there, we also follow the UK GDPR and the EU GDPR. Where we store data in other regions, we also follow the data protection laws that apply there.
1. Who this statement covers
- Our customers' people: the representatives, technical and billing contacts, and users of organisations that use the Service.
- Visitors to our status page and anyone who reports an issue to us.
Our customers decide which Trading Accounts they connect and what their code does. For personal information in that trading data, we act on our customer's behalf and follow their instructions.
2. What we collect
| Kind | What it includes | Where it comes from |
|---|---|---|
| Contact details | Name, email address, mobile number and role of your organisation's contacts | You, or your organisation |
| Sign-in details | Email address, role, when you last signed in and when your session ends | Our sign-in provider, when you sign in |
| Trading Account details | Broker server, account number and the sign-in credentials you give us | You, through the Service |
| Trading data | Orders, positions, deals, history and account state that pass through the terminals we run for you | Your broker, through your terminals |
| Your code | Expert advisors and other code you upload, and the results of our checks on it | You |
| Issue reports | Your email address, what you tell us, and a one-way hash of your IP address | You, on the status page |
| Technical data | IP addresses, request details, timings and error records | Your use of the Service |
| Correspondence | Emails and messages you send us | You |
We do not collect payment card details. We do not ask for or keep sensitive information such as health or political opinions, and we ask you not to send it.
3. How we protect credentials
Trading Account credentials are encrypted with keys held in a hardware security module. They are never written to logs, never shown back to anyone, and are released only to the terminal that signs in for you, for a single use that expires within a minute. Every release is recorded.
4. Why we use it
| Purpose | Basis under the UK and EU GDPR |
|---|---|
| To provide the Service: run your terminals, carry your orders and data, check your code | Performing our contract with you |
| To secure the Service, prevent misuse and investigate faults | Our legitimate interest in a safe and reliable Service |
| To send service notices, such as code review results, incidents and changes to our terms | Performing our contract, and our legitimate interest |
| To answer issue reports and support requests | Our legitimate interest in helping you |
| To meet legal and tax obligations | Legal obligation |
We do not sell personal information and do not use it for advertising.
5. Who we share it with
We share personal information only with:
- Microsoft, which hosts the Service on Azure, stores encryption keys, and sends our email through Exchange Online;
- Cloudflare, which carries traffic to the Service, protects the console's sign-in, and checks that issue reports come from a person;
- Google, whose servers deliver the fonts on our status page and so receive your IP address;
- your broker, because the terminals we run for you connect to it at your instruction;
- our professional advisers, and authorities where the law requires it.
Each provider handles the information under its own obligations to protect it.
6. Where it is stored
We store and process the Service's data in Microsoft Azure regions around the world. Customers on an enterprise plan may choose the regions their data is stored in. For other plans, we choose the regions. Cloudflare carries traffic through its global network. We are based in Australia and may access the data from there.
When we transfer personal information out of the United Kingdom or the European Union, we rely on an adequacy decision or on standard contractual clauses. When we disclose it outside Australia, we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles.
7. How long we keep it
| Information | How long |
|---|---|
| Technical logs | Up to 90 days |
| Records of calls to your terminals | 30 days, or 90 days for calls that failed |
| Orders and their results | 13 months online, then archived |
| Position and account snapshots | 6 months online, then archived for 2 years |
| Market quotes | Not stored |
| Trading Account credentials | Until you remove the Trading Account, then purged within 90 days |
| Contact and sign-in details | While your organisation uses the Service, and for 30 days after it leaves |
| Audit records of actions taken in your Account | For the life of the Service |
8. Your rights
You can ask to see the personal information we hold about you, to correct it, or to have it deleted. Where the UK or EU GDPR applies, you can also object to or restrict our use of it, and ask for a copy in a portable form. We answer within 30 days. We may need to confirm who you are first, and the law may require us to keep some records.
If you are unhappy with how we handled your information, contact us first. You may also complain to the Office of the Australian Information Commissioner (oaic.gov.au), the UK Information Commissioner's Office (ico.org.uk), or the data protection authority where you live in the European Union.
9. Cookies
The status page sets no tracking cookies. When you report an issue, Cloudflare's check may set a cookie needed to confirm that you are a person. The console uses cookies needed to keep you signed in. We do not use advertising or analytics cookies.
10. Children
The Service is for businesses and adults. It is not intended for anyone under 18.
11. Changes to this statement
We publish each version of this statement with its version number and the date it takes effect. Earlier versions remain available. We tell our customers' nominated contacts about changes that materially affect them.
12. Contact us
Write to [email protected] with "Privacy" in the subject, or to KUDMANI PTY LTD, New South Wales, Australia.