Privacy and Cookies Policy

At virpoint.com, operated by Finstar Technologies LTD ("we," "us," "VirPoint," or "the Company"), your privacy is a priority. This Privacy and Cookies Policy explains how we collect, use, store, and protect your personal information. It also outlines your rights under applicable data protection laws, including the General Data Protection Regulation (GDPR) and other international standards. By using virpoint.com, you agree to this policy. If you do not agree, you should refrain from using our services.

Who We Are

VirPoint is owned and operated by Finstar Technologies LTD, a privately held company registered in the Marshall Islands.

• Registered Address: Trust Company Complex, Ajeltake Road, Majuro, MH96960, Marshall Islands

• Operating Address: 100 Bishopsgate, London EC2N 4AG

• Email: support@virpoint.com

For the purposes of data protection law, Finstar Technologies LTD is the data controller, meaning we determine how and why your personal data is processed.

Scope of Services

VirPoint provides an online trading platform focused on contracts for difference (CFDs). In order to deliver our services, we collect and process personal information for:

• Account registration and management

• Identity verification (KYC) and anti-money laundering compliance

• Processing deposits and withdrawals

• Execution of trades

• Customer support and communications

• Regulatory reporting and compliance obligations

What Data We Collect

We may collect and process the following categories of personal data:

• Identification details (name, date of birth, nationality)

• Contact details (address, phone number, email)

• Financial and transactional data (bank details, card details, crypto wallet addresses, deposit and withdrawal history)

• Verification documents (passport, ID card, driver’s licence, proof of address)

• Communication records (emails, chats, call recordings)

• Device and technical data (IP address, browser type, operating system, device identifiers)

• Behavioural data (usage patterns, trading activity, preferences)

• Marketing preferences and consent records

How We Collect Data

Data is collected through:

• Direct input from you during account registration and when updating details

• Transactions, deposits, withdrawals, and trading activity

• Communications with our support team

• Automated means such as cookies and analytics tools

• Third-party providers including payment processors, identity verification services, and regulatory authorities

Cookies Policy

Cookies are small text files placed on your device to enhance your browsing and trading experience.

VirPoint uses:

• Essential cookies: for account login and platform functionality

• Performance cookies: to monitor usage and improve platform speed and reliability

• Functionality cookies: to store user preferences

• Advertising cookies: to tailor marketing messages and campaigns

You can manage or disable cookies through your browser or the cookie banner provided on virpoint.com. Please note that disabling certain cookies may affect platform performance.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual necessity: to provide services you request by opening an account and trading

• Legal obligation: to comply with AML, KYC, tax, and other regulatory requirements

• Legitimate interests: to improve our platform, prevent fraud, and ensure security

• Consent: for marketing communications and the use of non-essential cookies

Marketing Preferences

By registering with VirPoint, you agree to receive service updates and marketing communications. You can opt out at any time by using the “unsubscribe” link in emails or by contacting support@virpoint.com.

Automated Decision-Making

VirPoint may use automated systems to monitor accounts, identify unusual activity, and flag suspicious behaviour for compliance review. These measures help detect potential money laundering or fraud. If your account is restricted as a result, you may request a manual review by contacting support@virpoint.com.

Data Retention

Data is retained only as long as necessary under applicable law:

• Personal and financial data: 5 years after account closure or last transaction, in line with AML obligations

• Communication records: 3 years

• Call and video recordings: up to 12 months, unless required longer for compliance or disputes

• Marketing preferences: retained until consent is withdrawn

• Cookies: retained between session-only and up to 12 months, depending on type

Data Protection and Security

We take appropriate technical and organisational measures to safeguard your data, including:

• Encryption of sensitive information

• Access controls and authentication measures

• Regular security audits and monitoring

In the event of a data breach, affected users will be notified without undue delay, and remedial action will be taken.

Third-Party Processors

VirPoint partners with trusted third-party providers for services such as:

• Identity verification

• Payment processing

• IT support and infrastructure

• Analytics and customer engagement (e.g. Google Analytics, Intercom, HubSpot)

All third parties are required to comply with GDPR and maintain appropriate data protection safeguards.

Cross-Border Data Transfers

Data may be transferred outside the European Economic Area (EEA) where necessary. In such cases, safeguards are applied, including:

• Adequacy decisions by the European Commission

• Standard Contractual Clauses (SCCs)

• Additional security measures such as encryption and pseudonymisation

Your Rights Under GDPR

You have the following rights:

• Access to your personal data

• Correction of inaccurate data

• Erasure of data where permitted (“right to be forgotten”)

• Restriction of processing

• Objection to processing based on legitimate interests

• Data portability

• Withdrawal of consent for marketing and cookies

To exercise these rights, email support@virpoint.com. We will respond within 30 days as required by law.

Video and Call Recording

For compliance, training, and dispute resolution, VirPoint may record calls, chats, or video interactions. These records are securely stored and retained for up to 12 months, unless law requires longer retention.

Legal Jurisdiction

This Privacy and Cookies Policy is governed by the laws of the Marshall Islands. Disputes arising under this policy will fall under the jurisdiction of the courts of the Marshall Islands.

Changes to This Policy

VirPoint may update this policy from time to time. Updates will be communicated by email or on the website. Continued use of virpoint.com after changes constitutes acceptance of the revised policy.

Last Updated: 18 September 2025