Privacy Policy

01 Definitions

In this policy, Brunevo means the operator of the platform trading under the name Brunevo; personal data means information relating to an identified or identifiable individual; processing means any operation performed on that data; and the data subject is you, the individual the data describes. Where the policy distinguishes the controller, who decides why and how data is processed, from processors, who process it on the controller's instructions, the distinction is drawn explicitly.

02 Personal data we collect

We collect the personal data needed to provide the service you ask for. At registration: your first name, last name, email address and telephone number. During verification, under our AML/KYC policy: identity document details, address confirmation and, where a liveness check runs, the associated selfie capture. Through using the platform: your account settings, strategy preferences, transaction records and the content of messages you send to support.

We do not collect special-category data beyond what the liveness check strictly requires, and we do not collect data from third parties for profiling. If you choose not to provide data that a service requires, that specific service cannot be provided; everything else on this site remains open to you.

03 Usage data

Usage data is the technical trail of a visit: IP address, browser type and version, device characteristics, referring pages, the addresses of pages visited and the times of visits. It is generated automatically and used to keep the service running, detect abuse and understand, in aggregate, how the site is used.

IP addresses are also processed briefly by the geo service that decides which currency to display prices in for a visitor. That decision happens at request time and is not used to build a profile of your location history.

04 Cookies

The site uses a small number of cookies and equivalent technologies: strictly necessary ones that keep your session working and remember security choices, functional ones that store preferences such as display currency, and, where analytics is enabled, measurement cookies covered in the analytics section below. You can refuse or delete non-essential cookies in your browser without losing access to the site.

Essential cookies remain active because without them sign-in sessions and anti-abuse controls cannot function. No advertising cookies are set by the platform itself.

05 Controllers and processors

Brunevo is the controller for the personal data described in this policy. Processors, meaning providers that handle data on our instructions only, include the identity-verification provider running document and liveness checks, the email service delivering our messages, hosting and IT providers operating infrastructure, and the payment providers processing deposits and withdrawals.

Each processor operates under a written agreement binding it to process data only on our instructions and to apply appropriate security measures. Processors never receive more data than their function requires, as described in the disclosure section below.

06 How your data is used

We use your data to answer enquiries and provide the service: creating and running your account, executing the verification process, operating strategies you have selected, processing deposits and withdrawals, and sending the reports and notifications that are part of the platform. We use it to meet legal obligations, including record-keeping required by the anti-money laundering framework and responses to lawful requests from competent authorities. And we use it to keep the service safe: fraud prevention, abuse detection and the security monitoring described on the Security page.

What we do not do is sell your data, or share it for third parties' independent marketing. Data shared with providers is shared to make the service work, under the constraints above.

07 Legal bases for processing

Processing rests on three legal bases. Contract: the processing necessary to provide the account and services you have asked for, including registration data and transaction records. Legal obligation: verification, record-keeping and reporting required by applicable law. Legitimate interests: security monitoring, fraud prevention and the aggregate analysis needed to keep the platform working, each balanced against your interests and limited to what the purpose requires.

Consent is used where the law demands it specifically: marketing communications you have asked to receive, and any non-essential cookies. Consent can be withdrawn at any time through the unsubscribe link in any marketing message or your browser settings, and withdrawal does not affect processing already carried out.

08 Data retention

Retention follows purpose. Registration and account data are kept for the life of the account and for a reasonable period after closure, so that records of your own history remain available to you and to us. Verification data under AML requirements is retained for the statutory period applicable to such records after the relationship ends. Transaction records are retained per the accounting and tax periods that apply to them. Support correspondence is kept while an account is open and for a shorter archive period afterwards.

When a retention period ends, data is deleted or irreversibly anonymised. Backups age out on a fixed schedule, which means deletion is completed in practice within one backup cycle.

09 Transfers of data

Service providers used by the platform may operate outside the United Kingdom. Where personal data is transferred to such a provider, the transfer is covered by the safeguards the law requires for that destination, such as the international data transfer mechanisms adopted under UK data protection law, and the provider remains bound by its processing agreement.

The practical list is short: verification checks, email delivery and payment processing. No transfer exists for the purpose of avoiding protections; each exists because the best available provider for that function operates there.

10 Disclosure of data

Data is disclosed only in defined circumstances: to processors performing the functions described in this policy; to affiliated companies involved in providing the service, under the same obligations; to regulators and competent authorities where a legal obligation applies; to payment providers to the extent a transaction requires it; and to professional advisers under confidentiality.

We may also disclose data where necessary to establish or defend legal claims. Disclosure is never made for third-party marketing, and there is no sale of personal data, full stop.

11 Security of data

Security measures are described in operational detail on the Security page: encryption in transit and at rest, access limited to teams whose role requires it and logged, two-factor authentication available to every user, and an audit history recording security-relevant events. This policy incorporates that page by reference as the technical description of the safeguards.

No system is perfect, and the law does not pretend otherwise; the obligation is to apply appropriate measures and to respond to incidents promptly. If a breach affects your rights, you will be informed as the law requires.

12 Your rights as a data subject

You have the right to access the personal data we hold about you and to receive a copy; to have inaccurate data corrected; to have data erased where no overriding obligation requires retention, for example where AML record-keeping applies; to restrict processing while a dispute over accuracy is resolved; to object to processing based on legitimate interests; and to receive your data in a portable, machine-readable format where processing rests on contract and is automated.

To exercise any right, write to [email protected]. Requests are answered within one month, and we may ask what is strictly necessary to confirm your identity before acting. If you believe a right has not been honoured, you may complain to the UK Information Commissioner's Office, which is named here without a link as a matter of policy on this site.

13 Service providers

Service providers process data only for the functions they are engaged to perform. Identity verification: document and liveness checks. Email delivery: transactional and, with your consent, marketing messages. Hosting and IT: operating the platform and its storage. Payments: deposits, withdrawals and related fraud controls. Analytics, where enabled: the aggregate measurement described below.

Each provider receives the minimum data its function needs. The verification provider does not receive your transaction history; the payment provider does not receive your verification documents. This smallest-necessary rule governs every new provider before it is connected.

14 Analytics

The site's own measurement is deliberately thin: aggregate page statistics that tell us whether a page is doing its job, without profiling individuals. The platform carries a slot for Google Analytics that is currently inactive; if the operator enables it, this page will be updated with the specific categories of cookies it sets and the choices you have.

Analytics data is never used to make automated decisions about you, and it is never combined with your verification data.

15 Advertising and retargeting

The platform itself runs no advertising retargeting. If you arrive at the site through an advertisement, the advertising platform's own policies govern the measurement of that advertisement on its side; no advertising identifier is added to your account record by us.

Should this change, consent would be sought first and this section rewritten before any such technology is switched on.

16 Links to third-party sites

The site links to third-party resources for convenience, such as payment providers' own help pages. Once you follow a link off this site, the destination's privacy policy governs, and we are not responsible for the practices of third parties. We link only to providers we actually use and to official bodies.

The same applies in reverse: mention of Brunevo on another site is no evidence of that site's standing, as the fraud warning page explains.

17 Children

The platform is intended for adults. Accounts are not offered to persons under eighteen, and verification exists in part to enforce exactly that limit. We do not knowingly collect data from children; if we learn that data of a child has reached us, it is deleted promptly once identified.

If you believe a minor has provided data to the platform, write to [email protected] and the matter will be treated with priority.

18 Changes to this policy

This policy may be updated to reflect changes in the service, providers or the law. The current version is always the one published on this page, and it applies from the moment of publication. Material changes, ones that affect what we collect or who we share it with, are announced on the site and, for account holders, by email before they take effect.

The date of the latest revision is available from support at any time, together with any previous version you ask to see.

19 Contact

Questions about this policy, the data we hold or your rights go to [email protected], handled by the Client Support & Compliance team during Monday to Friday, 9:00–18:00 UK time. Postal correspondence is received at London, United Kingdom.

A request that this policy does not answer clearly counts as feedback on the policy, and we would rather fix the wording than have you guess.