Privacy and cookies

Who is responsible for your data

The controller of your data is DIONIX SOFTWORKS S.R.L., with its registered office at București, Sector 5, Str. Dr. Leonte Anastasievici nr. 9, cam. 2, et. 1, ap. 2, cod poștal 050464, entered in the Trade Register under no. J2024038563007, tax ID 50834541.

For any request about your personal data, write to [email protected] or open a ticket from your account.

We have no data protection officer (DPO). Your requests reach the person responsible for data protection in the company, at the same address.

Where the data comes from

Most of it comes from you: when you register, order, write in tickets and add your bank account. Some arises from using the service, such as your trades and IP address.

From others we receive only: the check's result and the confirmed name, from Didit; the payment confirmation and billing details, from Stripe; your email address, name and an identifier, from Google, if you choose to sign in with Google.

Without an email and password we can't create your account, without billing details we can't issue your invoice, and without the identity check and a bank account we can't pay you rewards. The rest of the data arises as you use the service.

Your account and its security

• Account: your email address, your password (kept only as an argon2 hash, which we cannot read), your chosen language and the date you confirmed your email.
• Security: your IP address and browser (user agent) when you sign in and in your active sessions, your security history (sign-ins, password changes, turning on two-step verification) and sign-in attempts, used to limit password guessing.
• Two-step verification: the authenticator app secret, stored encrypted, and your recovery codes, stored only as hashes.

When you choose a password, we check whether it appears in public data breaches, using the Have I Been Pwned service. We only send the first 5 characters of a hash of the password; we send neither the password nor your email.

If you choose to sign in with Google, Google confirms who you are, and we keep your email address, name and the identifier we receive. We never see your Google password and have no access to your Google account.

Why: to create and protect your account, sign you in and write to you in your language.

Orders, payments and acceptances

• Orders: the product, account size, amounts, VAT and order status.
• Payment: processed by Stripe. We keep your Stripe customer ID and the payment references. We never see or store your card details. You enter your billing name and address at Stripe. We take them only to issue the invoice through Keez; in our own database we keep the country, for VAT.
• Acceptances: your request for the service to start immediately (right of withdrawal), your acceptance of the terms and of the rewards account contract, each with the version of the text, the date and time, your IP address and your browser.

Why: to take payment, work out VAT, issue payment documents and be able to show what you accepted and when.

Trading accounts

The trading platform is our own, so the data of your simulated accounts is created and stays with us: account identifiers, trades, positions and orders, balance and equity, including the readings at the start of each trading day.

Based on this data, the system applies the rules and keeps its decisions (breach, pass, expiry) together with their evidence.

We also check whether an account uses practices the Terms forbid, for example by comparing its trades with those of other accounts. After a review, staff may note the reason in your file and, where needed, send you a written warning, which you see in your account. The note and the warning change nothing on your accounts by themselves. Why: to prevent fraud and abuse.

The export from your account includes the warnings, but not staff's internal notes about you, such as marks after a review. You get them on request, by email or ticket; we only black out other people's data.

The market data provider sends us prices only. We don’t send it your personal data and we receive no data about you from it.

Why: to evaluate the account under the published rules, work out payouts and be able to answer an appeal.

Identity check

The identity check is done by Didit. The documents and images you send stay with it; we don't receive them.

We only keep the outcome (approved or rejected), the provider’s reference for the check, the reason for a rejection and the name confirmed by the provider.

Why: so that rewards reach the person who traded, and payouts go only to a bank account in your name.

Comparing your face in the selfie with the photo in your ID, and checking that you are a real person, means processing biometric data. We do this only with your explicit consent, given before you start. You can withdraw it at any time, and if you don't want biometric data used, you can ask through a ticket for a check without it. The details are in the “Identity check and biometric data” part.

Bank account and payouts

We keep your IBAN and the account holder name you give us, as well as bank accounts you used before: a changed bank account is replaced, not deleted.

For each payout we keep the amount and how it was worked out, the decision, who reviewed and who approved it, the reason for a rejection, the bank account it was paid to, the payment file and the confirmation from the bank statement.

Why: to pay rewards, prevent fraud and keep accounting records.

Support, appeals and emails

We keep the messages in support tickets and appeals, with their attachments (PNG, JPG or PDF).

To protect us from harmful files, our staff only see a rebuilt copy of each attachment; the original is kept isolated, in quarantine.

The emails we send you (address, subject and text) are kept in a sending queue so that none are lost.

Why: to answer you, decide appeals and send you messages about your account.

How you heard of us

After a payment we may ask you, once, how you heard of us. You don't have to answer. We add the answer straight away to a monthly total, without your name and with no link to the order; the order keeps only that the question was closed.

Why: so we know which channels bring us customers. Legal basis: our legitimate interest (Art. 6(1)(f)).

Audit log

Every action by our staff or our system on your data and accounts is recorded in an audit log: who, what, when, from which IP address and for what reason. We also record when a member of staff views your data, so that you can find out who has seen it.

The log cannot be changed or deleted. If you ask for erasure, your personal data is anonymised and the log entries remain.

Why: to be able to show what happened and to prevent abuse, including internal abuse.

Traffic analytics, only with your consent

We use Google Analytics 4 only after you click “Accept” in the cookie banner. Until then, or if you refuse, Google Analytics is not loaded and nothing reaches Google. Advertising storage always stays refused (Consent Mode).

You can withdraw your consent at any time through the “Cookie settings” link in the footer of every page. Details are in the cookie policy.

The launch list

If you join the launch list, we keep your email address, language, the version of the text you accepted, and the dates you joined, confirmed and left the list. We send you one confirmation email; without your confirmation we don't write again.

When you join and when you confirm, we also keep your IP address, the country and rough city Cloudflare derives from it, and where you came from: the labels in the link you arrived by (for example “instagram”) and the name of the site that sent you to us, if your browser passes it on. We use no cookies for this.

Why: to tell you about the launch and send you Aegis Traders offers. The basis is your consent, which you can withdraw at any time, from the leave link in any email from this list.

We use the IP address, the location and the source so that one person receives the launch gift only once, so we can prove when you gave your consent and when you withdrew it, and to see which channels bring sign-ups. The basis is our legitimate interest; you can object at any time by writing to the address above.

Only the team members who handle the list can see it, and every look at it stays in the audit log. Only confirmed addresses reach our email tool, without IP, location or source.

Backups

We make backups of our data. They are encrypted on our server before they leave it and are stored in Cloudflare R2, in the EU jurisdiction.

We make a copy every hour and keep 24 hourly, 7 daily, 4 weekly and 6 monthly copies, so information deleted from the database leaves the copies within about 6 months.

Legal bases

Traffic analytics and the launch list are based on your consent (Article 6(1)(a) GDPR), except the IP address, location and source of a launch list sign-up, which rest on our legitimate interest, below. The other processing has these bases:

• performance of the contract (Art. 6(1)(b)): the account, orders, trading accounts, payouts, checking the identity of the person we pay, support, appeals and emails about the service;
• a legal obligation (Art. 6(1)(c)): invoices, accounting and tax records, replies to authorities;
• our legitimate interest (Art. 6(1)(f)): account security, preventing fraud and abuse, measuring which channels bring us customers, the audit log and defending legal claims. You can object at any time;
• your explicit consent (Art. 9(2)(a)): the biometric data in the identity check.

Who we share your data with

We work with these suppliers:

• Stripe: payments, VAT and payment confirmations;
• Keez: invoices and their records, including your name, billing address and the amount;
• Didit: the identity check, including biometric data;
• HostKey: the server the platform runs on, in Finland;
• Cloudflare: protects and delivers the site, so it sees your IP address and traffic; it also keeps the encrypted backups (Cloudflare R2, in the EU);
• Brevo: sending emails;
• Google: Google Analytics 4, only if you accepted analytics cookies, and sign-in, only if you choose to sign in with Google;
• Telegram: the team's internal messages about orders and payouts, with the order number, the amount and the country, without a name or an email;
• the bank we pay payouts through, which receives the IBAN, the holder's name and the amount;
• the market data provider, which sends us prices and receives no personal data.

Keez, Didit, HostKey, Cloudflare, Brevo and Google work on our behalf, as processors, under contract. Stripe and the bank are independent controllers for their part of the payment: they meet their own legal obligations.

Our contract with Didit lets it use anonymised or pseudonymised data, as an independent controller, to improve its models, unless we object. We object to this use for our customers' data.

We also pass data to authorities, courts or our advisers only when the law requires it or when needed to defend a legal claim. We don't sell your data.

Transfers outside the European Economic Area

Our server is in Finland, and the backups stay in the EU. Some suppliers, such as Stripe, Cloudflare, Google and, where applicable, Didit, may process data outside the European Economic Area too, including in the US. In these cases we rely on a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or on the standard contractual clauses adopted by the Commission. You can ask us for a copy of these safeguards.

How long we keep your data

We keep data for as long as its purpose requires, then delete or anonymise it:

• the account: while you have it; on a deletion request we anonymise it, unless you have an active trading account or a payout in progress;
• invoices, orders, payments and payouts: 5 years from 1 July of the following year, the period in the Romanian Accounting Law no. 82/1991;
• trading accounts, trades, decisions and their evidence, appeals and tickets: 3 years after the account ends, the general limitation period;
• detailed equity readings: 90 days;
• the result of the identity check, the reference and the confirmed name: while you have an account and for 3 more years; at Didit, documents and images are kept for 30 days;
• the launch list: every entry, confirmed, unconfirmed or ended, 2 years from joining; after that, if you left the list, we keep only your email address and the dates you joined, confirmed and left, for as long as we use the list, so that we never write to you again; entries made before 4 November 2026 keep the rule of that time: until you leave the list, and 2 years from your confirmation at most, while an unconfirmed or ended entry is deleted after 30 days;
• replaced bank accounts: like their payouts, 5 years;
• login sessions: 30 days after they end; a session expires after 7 days at most;
• login attempts and sent emails: 90 days; the body of an email is emptied right after sending;
• the security history: 365 days;
• marks and warnings: 3 years from their date;
• the audit log: it isn't deleted, but on a deletion request its link to you is anonymised.

How we protect your data

• passwords are kept only as argon2id hashes;
• we keep only a hash of your session key, and the session cookie cannot be read by scripts on the page;
• the two-step verification secret is encrypted;
• staff have access according to their role, and any viewing of your data appears in the audit log;
• attachments are rebuilt before they reach staff;
• backups are encrypted before they leave the server.

Automated decisions

A breach of a loss limit is detected automatically by the system, under the product’s published rules, and leads to the account being stopped. You can appeal the decision, and the appeal is decided by a person.

The identity check is also an automated decision: Didit's system compares the images and gives a result. A rejection means you don't get the rewards account or the payment. Because it uses biometric data, it relies on your explicit consent (Art. 22(4) GDPR). You can ask for human intervention, give your view and contest the decision.

Phase passes, payouts and appeals are decided by people.

The decision on limits is necessary to perform the contract (Art. 22(2)(a) GDPR): the rules are published, and the result depends only on the account's figures. You have the right to ask for human intervention, to give your view and to contest the decision, through the appeal in your account.

Your rights

Under the GDPR (Articles 15–22), you have the right:

• to find out what data we hold about you and to get a copy (Article 15);
• to have incorrect data corrected (Article 16);
• to have your data erased (Article 17);
• to have processing restricted (Article 18);
• to receive your data in a structured format and pass it to another controller (Article 20);
• to object to processing based on legitimate interest (Article 21);
• not to be subject to a decision based solely on automated processing that significantly affects you, under the conditions of Article 22;
• to withdraw your consent at any time, without affecting the processing carried out before.

To exercise your rights, write to [email protected]. We reply within one month at most. In your account you can download your data yourself and delete your account.

Complaints to ANSPDCP

If you believe we process your data unlawfully, you can complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), www.dataprotection.ro, or to the data protection authority in the country where you live.

Minimum age

The service is intended for people aged 18 or over.

Changes

Any change to this policy is a new version, published on the site. Older versions stay available.

Why we check your identity

Rewards are paid only to the person who traded, into a bank account in their name. The check prevents fraud, multiple accounts and the use of someone else's identity.

The check is done once. An approved check is valid for all your orders.

How it works

You start the check from the order page and are taken to the secure page of our provider, Didit. There:

• you photograph a valid identity document;
• you take a selfie, used to check that you are a real person;
• the face in the selfie is compared automatically with the photo in the document.

The document and images reach only Didit. We receive only the result, the check's reference, the reason for a rejection and the confirmed name.

Biometric data and your consent

Checking that you are a real person and comparing your face processes biometric data, which is sensitive data under Art. 9 GDPR. We do this only with your explicit consent, which you tick before you start. We keep the version of the text, the date, the time and your IP address as proof.

You can withdraw your consent at any time, from your account page. This doesn't affect processing done before, an approved check included. After that we no longer start checks with biometric data for you.

If you don't want biometric data used

You don't have to accept. Write to us through a ticket before you start, and we will propose a check without biometric data, done by a person on our team. It may take longer.

The decision

The result comes automatically from the provider's system, and it decides whether the check is approved or rejected. If it is rejected, you get an email and the rewards account isn't created. You can ask a person to review it: you appeal from your account within 7 days, and a person decides the appeal.

How long it is kept

With us: the result, the reference and the confirmed name, while you have an account and for 3 more years. On a deletion request, the name and the link are erased.

At Didit: documents and images, for 30 days, then they are deleted.

What cookies are

Cookies are small files a site saves in your browser. Some are needed for the site to work. We only use analytics cookies with your consent.

Essential cookies

They are needed for the site to work, so they don’t require your consent:

• aegis_session: keeps you signed in to your account; up to 7 days; essential, HttpOnly (cannot be read by scripts on the page).
• aegis_lang: remembers the site language; 1 year; essential.
• aegis_google: remembers, encrypted, the step of signing in with Google; 10 minutes; essential, only if you choose Google.
• aegis_consent: remembers your cookie choice; 6 months; essential.
• __stripe_mid: set by Stripe on the payment page, for fraud prevention; 1 year; essential, Stripe’s.
• __stripe_sid: set by Stripe on the payment page, for fraud prevention; 30 minutes; essential, Stripe’s.

Analytics cookies, only after “Accept”

We only use them if you click “Accept” in the cookie banner. Until then, Google Analytics is not loaded at all.

• _ga: Google Analytics 4, tells visitors apart; 2 years; analytics, Google’s.
• _ga_<ID>: Google Analytics 4, keeps the state of your visit; 2 years; analytics, Google’s.

Also only after “Accept”, we remember in your browser for 30 days the code of the affiliate link that brought you to the site (aegis_referral), so we know who recommended you.

We don’t use advertising cookies: advertising storage always stays refused.

Your own choices on the site also stay in the browser, without reaching us: the theme (theme), your favorite symbols and the fact that you closed a notice. They stay until you change them or clear the browser's data.

How to change your choice

Use the “Cookie settings” link in the footer of every page. The banner opens again and you can choose “Accept” or “Refuse”.

If you withdraw your consent, we delete the Google Analytics cookies from your browser and reload the page without them.

Refusing changes nothing in how the site works.