1. Who we are
PropFirmCRM is a business-to-business SaaS provider offering a white-label CRM, hosted Platform 5 trading accounts, real-time risk management, KYC and PSP integrations, affiliate systems and automated payouts to proprietary trading firms ("Customers"). When we provide the platform to a Customer, the Customer is typically the controller of trader personal data, and PropFirmCRM acts as a processor. When you interact with our public website or marketing, PropFirmCRM is the controller.
2. Information we collect
2.1 Information you provide directly
- Identity and contact details — name, business email, phone, company, role.
- Account and billing data — login credentials, plan, billing address, VAT/tax IDs, payment method tokens (stored by our PSP, not by us).
- Support and communications — messages you send us, demo requests, survey responses.
2.2 Information collected automatically
- Device and connection data — IP address, browser, operating system, time zone, language.
- Usage data — pages viewed, features used, referring URLs, session timestamps.
- Cookies and similar technologies — see our Cookie Policy.
2.3 Information from third parties
- KYC and identity verification providers (e.g. Sumsub, Veriff).
- Payment service providers and card networks.
- Integration partners explicitly connected by you or your firm.
- Publicly available sources used for sales prospecting in line with applicable law.
3. How we use information
- To provide, operate, maintain and improve the Services.
- To process payments, subscriptions, payouts and challenge purchases.
- To verify identity and comply with KYC, AML, sanctions and fraud-prevention obligations.
- To detect, investigate and prevent abuse, breach of terms or harmful activity.
- To provide customer support, technical assistance and dispute resolution.
- To send service updates, security alerts, billing notices and (with consent where required) marketing.
- To meet legal, regulatory, accounting and tax obligations.
4. Legal bases for processing
Where the GDPR or UK GDPR applies, we rely on one or more of the following legal bases:
- Contract — to provide the Services you or your firm has requested.
- Legitimate interests — for security, fraud prevention, service improvement and direct B2B communications, balanced against your rights.
- Legal obligation — for tax, accounting, KYC/AML and lawful requests.
- Consent — for non-essential cookies and certain marketing, where required by law.
5. Sharing and subprocessors
We share data only with vetted subprocessors that are necessary to operate the Services, bound by written data processing agreements and appropriate security obligations. Categories include:
- Cloud hosting and infrastructure providers.
- KYC and identity verification providers (Sumsub, Veriff and similar).
- Payment processors and payout rails (Stripe, card networks and approved partners).
- Email delivery and customer-communication providers.
- Analytics, error monitoring and security tooling.
- Professional advisors (legal, accounting, auditors) under confidentiality.
An up-to-date list of subprocessors is available on request to info@propfirmcrm.com.
6. International data transfers
We may transfer personal data outside the EEA, the UK or your country of residence. Where we do, we rely on appropriate safeguards including Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, or other lawful transfer mechanisms.
7. Data retention
We retain personal data only for as long as necessary to fulfil the purposes set out in this Policy, to provide the Services, and to comply with legal, tax, accounting and dispute-resolution obligations. Retention periods vary by data category and are reviewed periodically.
8. Your rights
Depending on your jurisdiction, you may have the following rights:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete data, subject to legal exceptions.
- Restriction or objection — limit or object to certain processing.
- Portability — receive data in a structured, machine-readable format.
- Withdraw consent — at any time, without affecting prior lawful processing.
- Complaint — lodge a complaint with your local supervisory authority.
To exercise any of these rights, contact info@propfirmcrm.com. Where you are a trader of one of our Customers, please direct requests to that firm first; we will assist them as their processor.
9. Security
We implement administrative, technical and physical safeguards designed to protect personal data, including encryption in transit and at rest, least-privilege access control, audit logging, secure software-development practices and continuous monitoring. No system is perfectly secure; if we become aware of a personal data breach affecting you, we will notify you and any regulators as required by law.
10. Children
The Services are intended for businesses and adult users. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, contact us and we will take appropriate steps.
11. Automated decision-making
Some risk, fraud-detection and KYC features rely on automated processing to evaluate behaviour against configured rules. Material decisions that produce legal or similarly significant effects are reviewable by a human operator on request, subject to applicable law.
12. Changes to this Policy
We may update this Policy from time to time. Material changes will be communicated by posting an updated version on this page and, where appropriate, by direct notice. The "Last updated" date above reflects the most recent revision.
13. Contact
For any privacy request, question or complaint, write to info@propfirmcrm.com.