Privacy Policy

The Thunder Trader

Last updated: [25 May 2026]

Table of Contents

1. Introduction and Data Controller
2. Scope of application
3. Definitions
4. Categories of personal data processed
5. Purposes of processing and legal bases
6. Processing of biometric data (special category under GDPR Art. 9)
7. KYC and AML compliance
8. Recipients of the data and data processors
9. Transfer of data outside the European Economic Area
10. Retention periods
11. Data Subject rights
12. Users residing in the United Kingdom
13. Users residing in the United States of America
14. Security measures
15. Minors
16. Changes to this Privacy Policy
17. Contacts
18. Applicable law and jurisdiction

1. Introduction and Data Controller

This Privacy Policy describes how The Thunder Trader collects, uses, retains and protects the personal data of users who visit the website thethundertrader.com and access the platform for participation in Performance Arena Event.

The Data Controller (hereinafter “Controller”) is:

LN17 ShapeFuture Limited Flat D, 20/F, Eton Building, 288 Des Voeux Road Central, Sheung Wan, Hong Kong Company Number (CR No.): 80441068 Business Registration Number (BR No.): 80441068-000-05-26-A Contact email: legal@thethundertrader.com

Data Protection Officer (DPO): currently being appointed. Once nominated, the contact details will be published in this Privacy Policy. Until then, any communication regarding the processing of personal data may be addressed to the Controller’s email indicated above.

The Controller processes personal data in compliance with Regulation (EU) 2016/679 (“GDPR”), the UK GDPR for users residing in the United Kingdom, applicable local regulations on anti-money laundering (AML) and know your customer (KYC), as well as any other regulation applicable based on the user’s place of residence.

2. Scope of application

This Privacy Policy applies to the processing of personal data carried out through:

• the public website thethundertrader.com
• the participation platform accessible via the subdomains dashboard.thethundertrader.com, trading.thethundertrader.com, historical.thethundertrader.com and checkout.thethundertrader.com
• email communications sent by the Controller (newsletter, transactional emails, service communications)
• the customer support email channels support@thethundertrader.com and legal@thethundertrader.com

Territorial restrictions. The service is not available to residents, domiciled persons or citizens of Hong Kong (HKSAR) in consideration of specific local regulations on contests, skill-based competitions and consumer protection. For residents of the United States of America, a specific opt-out procedure applies, detailed in the Terms and Conditions (art. 25.6) and described in Section 13 of this Privacy Policy.

Minimum age. Use of the platform is reserved exclusively to natural persons of legal age who have completed their 18th year of age. The Controller does not knowingly collect personal data of subjects under 18 years of age. Should the Controller become aware of any processing of data relating to a minor, it will promptly delete such data and close the corresponding account.

3. Definitions

For the purposes of this Privacy Policy, the following terms shall mean:

• Personal data: any information relating to an identified or identifiable natural person, pursuant to Art. 4 GDPR.
• Processing: any operation applied to personal data, such as collection, recording, organisation, storage, consultation, modification, disclosure and deletion.
• Data Controller: the entity that determines the purposes and means of processing. In this case, LN17 ShapeFuture Limited.
• Data Processor: the entity that processes personal data on behalf of the Controller.
• Data Subject: the natural person to whom the personal data refer, namely the user.
• Participant: the registered user who accesses Performance Arena Event by purchasing Platform Credits.
• Performance Reward: the discretionary economic recognition granted by the Controller to those Participants who reach the highest positions in the final ranking of a Performance Arena Event.
• Available Balance: balance derived from the purchase of Platform Credits, usable to access Performance Arena Event and refundable within 14 days if unused.
• Fee Credits Balance: promotional bonus credit usable exclusively to reduce the access fee of an event; not refundable nor convertible into money.
• Performance Arena Event: skill-based competitive event on simulated trading organised by the platform.

4. Categories of personal data processed

The Controller processes various categories of personal data, collected progressively based on the level of user interaction with the service. Not all data indicated below are collected for every user: processing is proportionate to the type of actual platform use.

4.1 Browsing data

Automatically collected when visiting the website or accessing the platform:

• IP address and approximate geolocation data derived from the IP
• browser type and version
• device operating system
• pages visited, time spent, navigation paths
• referrer (originating website)
• session technical identifiers

4.2 Account registration data

Collected at the time of creating a user account (Light KYC):

• email address
• phone number (verified via OTP)
• password (stored in encrypted form using hashing algorithms)
• username (public handle)
• language and communication preferences

4.3 Participation data (Performance Arena Event)

Collected during the Participant’s involvement in events:

• registration and participation parameters
• simulated trading data (positions opened and closed on the demo account, entry and exit prices, position sizes, simulated profit/loss, session duration)
• placement in the final ranking
• Performance Reward amount potentially accrued

4.4 Payment data (Platform Credits purchase)

Collected at the time of purchasing Platform Credits:

• amount, currency, date and time of the transaction
• last four digits of the payment card (for card transactions only)
• transaction reference at the payment service provider
• cryptocurrency wallet address used (limited to cryptocurrency transactions)

The Controller does not directly collect or store full payment card data or banking credentials of users. Such data is processed exclusively by the payment service providers indicated in Section 8.

4.5 KYC data (Full Know Your Customer)

Collected exclusively at the moment of the first request for disbursement of a Performance Reward, not at the time of deposit:

• first name, last name, date of birth
• nationality
• number and type of identity document (passport, ID card, driving licence)
• image of the identity document (front/back)
• proof of residence (utility bill, bank statement or equivalent document)
• country of residence

4.6 Biometric data (special category of personal data)

Collected together with the Full KYC procedure:

• facial image (selfie) acquired through the liveness check procedure of the provider Sumsub
• facial biometric parameters derived and used for comparison with the identity document and for detecting fraud attempts (deep fake, masks, static photographs, emulators)

The processing of biometric data is specifically governed in Section 6 of this Privacy Policy.

4.7 Communication and support data

Collected in the context of direct communications with the Controller:

• content of emails sent to support@ or legal@
• support requests and tickets
• correspondence relating to requests for the exercise of GDPR rights

4.8 Marketing data (consent-based)

Collected upon the user’s express consent:

• newsletter subscription
• thematic preferences and segmentation
• email engagement data (opens, clicks)

5. Purposes of processing and legal bases

The Controller processes personal data for the purposes indicated below, each with its own legal basis under Art. 6 GDPR.

The provision of data for purposes 5.1, 5.2, 5.3 and 5.4 is necessary to use the service: refusal to provide them makes it impossible to register, participate in events or receive a Performance Reward. The provision for purposes 5.9 and 5.11 is optional and any refusal does not prejudice the use of the service.

6. Processing of biometric data (special category of personal data, Art. 9 GDPR)

The Controller processes biometric data exclusively within the Full KYC procedure, activated upon the first request for disbursement of a Performance Reward.

What is processed. A facial scan of the user, acquired in real time through the liveness check procedure, and the biometric parameters derived from it. Such parameters are compared with the photograph on the identity document to verify the authenticity of the user’s identity and to detect any fraud attempts (use of static photographs, deep fakes, masks, emulators).

By whom. The acquisition and analysis are performed by the specialised provider Sumsub (Sum and Substance Limited), acting as Data Processor under a data processing agreement pursuant to Art. 28 GDPR.

Legal bases. The processing is based on two cumulative legal bases:

1. Explicit consent of the Data Subject, given freely, in an informed and specific manner pursuant to Art. 9.2.a GDPR, collected before the start of the liveness check procedure
2. Legal obligation of the Controller relating to compliance with applicable anti-money laundering (AML) and counter-terrorism financing (CFT) regulations, pursuant to Art. 9.2.g GDPR

Consequences of refusal. Refusal to grant consent to the processing of biometric data results in the impossibility of completing the Full KYC procedure and, consequently, the impossibility of receiving the disbursement of the Performance Reward. Participation in Performance Arena Event remains permitted; the Participant may also use their Available Balance to access subsequent events without having to complete the Full KYC procedure, until they request the disbursement of a Performance Reward.

Right of withdrawal. Consent to the processing of biometric data may be withdrawn at any time by writing to legal@thethundertrader.com. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal itself, but will result in the impossibility of disbursing further Performance Rewards until a possible new KYC procedure is completed.

Storage. Biometric data is retained for the time strictly necessary to perform the verification and subsequently for the period required by applicable AML obligations (typically 5-7 years from the termination of the relationship with the user). Once such term has elapsed, biometric data is deleted or irreversibly anonymised.

7. KYC and AML compliance

The Controller is subject to customer due diligence obligations and to the prevention of money laundering and terrorism financing. Such obligations require the Controller to:

• collect and verify the identity of Participants before the disbursement of Performance Reward
• retain identification documentation for the period prescribed by applicable regulations
• report suspicious transactions to competent authorities
• block the disbursement of Performance Reward in the presence of identification anomalies, multi-accounting or discrepancies between documented and declared identity

Processing of data for AML purposes constitutes a legal obligation for the Controller and prevails, within the limits provided by applicable law, over Data Subject rights of erasure or restriction for the duration of the mandatory retention period.

8. Recipients of the data and data processors

Personal data may be processed, for the purposes indicated above, by the following entities, acting as data processors under Art. 28 GDPR. The relevant appointment agreement is available with the Controller for each of them.

In addition to the entities indicated above, data may be disclosed to:

• professional advisors of the Controller (legal, accounting, audit) for compliance and legal defence purposes only, bound by confidentiality obligations
• competent judicial and administrative authorities, in case of legitimate request under applicable regulations
• entities involved in any corporate reorganisation, merger, demerger or transfer of business of the Controller, subject to adequate guarantee of data protection

The updated list of data processors is available upon request by writing to legal@thethundertrader.com. The Controller reserves the right to add or replace providers, providing information through an update to this Privacy Policy.

9. Transfer of data outside the European Economic Area

Some processing operations involve the transfer of personal data outside the European Economic Area (EEA). Destinations and applied safeguards are as follows:

9.1 Transfer to Hong Kong (Data Controller)

The Controller LN17 ShapeFuture Limited is based in Hong Kong. Hong Kong is not the subject of an adequacy decision of the European Commission under Art. 45 GDPR. Therefore, the transfer of personal data from the European Union to the Controller is carried out on the basis of the Standard Contractual Clauses (SCC) approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, supplemented by additional technical, contractual and organisational measures identified following a Transfer Impact Assessment (TIA) conducted by the Controller.

The supplementary measures include, among others: encryption of data in transit and at rest, restricted access controls, logical segregation of data, response procedures for access requests from public authorities according to principles of necessity and proportionality.

A copy of the SCC applied and a summary of the TIA may be requested by writing to legal@thethundertrader.com.

9.2 Transfer to the United Kingdom

For providers based in the United Kingdom (Sumsub, FXCM), the transfer of personal data takes place on the basis of the adequacy decision adopted by the European Commission on 28 June 2021, currently in force.

9.3 Transfer to the United States of America

For providers based in the United States (Twilio/SendGrid), the transfer is made to entities adhering to the EU-U.S. Data Privacy Framework (DPF), certified under the European Commission’s adequacy decision of 10 July 2023. For transfers not covered by the DPF, the Standard Contractual Clauses apply.

9.4 Transfer to other third countries

For any transfers to other third countries not covered by an adequacy decision, the Controller adopts one of the following safeguards:

• Standard Contractual Clauses approved by the European Commission
• Binding Corporate Rules
• Other safeguards provided for under Chapter V of the GDPR

The user has the right to obtain a copy of the applied safeguards by writing to the Controller’s email.

10. Retention periods

Personal data is retained for the time strictly necessary to achieve the purposes for which it was collected, according to the criteria indicated below:

Once the terms indicated above have elapsed, personal data is deleted or irreversibly anonymised, unless specific legal obligations require longer retention or there are documented legitimate interests of the Controller.

11. Data Subject rights

The user, as a Data Subject, may exercise at any time the rights provided for in Articles 15-22 of the GDPR:

1. Right of access (Art. 15): obtain confirmation of the existence of processing of their personal data and access such data.
2. Right to rectification (Art. 16): obtain the correction of inaccurate data or the integration of incomplete data.
3. Right to erasure – “right to be forgotten” (Art. 17): obtain the deletion of their data, save for cases in which the Controller is required to retain them by law (in particular for AML compliance described in Section 7).
4. Right to restriction of processing (Art. 18): obtain the restriction of processing in cases provided for by law.
5. Right to data portability (Art. 20): receive their data in a structured, commonly used and machine-readable format, and transmit them to another controller.
6. Right to object (Art. 21): object to processing for direct marketing purposes at any time, without need for motivation, and to processing based on legitimate interest, providing a reason related to their particular situation.
7. Right not to be subject to automated decisions (Art. 22): not to be subject to a decision based solely on automated processing that produces legal effects. The Controller specifies that, although it uses automated procedures for fraud detection and multi-accounting, any decision that significantly affects the user (for example account suspension or blocking of a Performance Reward) is always reviewed by a human operator before being definitively applied.
8. Right to withdraw consent (Art. 7.3): withdraw consent given at any time, without prejudice to the lawfulness of processing carried out previously.
9. Right to lodge a complaint with the supervisory authority (Art. 77): lodge a complaint with the competent Authority. For users residing in Italy, the authority is the Italian Data Protection Authority – Garante per la protezione dei dati personali (www.garanteprivacy.it). For users residing in other EU Member States, the authority of the Member State of residence has jurisdiction.

How to exercise the rights. Rights may be exercised by writing to legal@thethundertrader.com. The Controller responds to requests without undue delay and in any case within one month from receipt, extendable for an additional two months in cases of particular complexity, with prior communication to the Data Subject. The exercise of rights is free of charge; the Controller reserves the right to require a reasonable contribution or to refuse the request only in cases provided for by Art. 12.5 GDPR (manifestly unfounded or excessive requests).

Before acting on the request, the Controller may require additional information necessary to confirm the identity of the requester.

12. Users residing in the United Kingdom

For users residing in the United Kingdom, the rights listed above apply under the UK GDPR and the Data Protection Act 2018. The competent supervisory authority is the Information Commissioner’s Office (ICO) (www.ico.org.uk).

The Controller, being established outside the United Kingdom, is not required to appoint a UK representative under Art. 27 UK GDPR unless specific conditions apply, which are assessed on a case-by-case basis.

13. Users residing in the United States of America

As indicated in the Terms and Conditions of the platform (art. 25.6), the service is not actively offered to residents of the United States of America. Users declaring U.S. residence at the time of registration are subject to a specific opt-out procedure and dedicated contractual clauses.

Should a U.S. resident nevertheless access the platform, the following provisions apply:

• for residents of California, under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the user has the right to: (i) know which categories of personal data are collected and for what purposes; (ii) request the deletion of their data; (iii) opt out of the sale or sharing of their data (the Controller does not sell personal data); (iv) not be subject to discrimination for having exercised such rights
• for residents of other States with applicable privacy regulations (Virginia, Colorado, Connecticut, Utah, and others), the rights provided for by the respective regulations apply

Requests may be addressed to legal@thethundertrader.com.

14. Security measures

The Controller adopts technical and organisational measures appropriate to the risk to protect personal data from unauthorised access, accidental loss, destruction, alteration and disclosure, in compliance with Art. 32 GDPR. Such measures include, on a non-exhaustive basis:

• encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256)
• logical segregation of data by category and purpose
• access controls based on the principle of least privilege
• mandatory two-factor authentication (2FA) for the Controller’s administrative accounts and for users before the first Performance Reward request
• activity logs and anomaly detection procedures
• periodic backups and disaster recovery procedures
• staff training on data protection and breach management
• Data Processing Agreements (DPA) with all Data Processors

In the event of a personal data breach presenting a risk to the rights and freedoms of users, the Controller notifies the breach to the competent supervisory authority within 72 hours of discovery, and informs the affected users without undue delay in cases where the breach presents a high risk.

15. Minors

As indicated in Section 2, the service is reserved to natural persons of legal age, not under 18 years of age. The Controller does not knowingly collect personal data of minors under 18 years of age.

Should a parent or legal guardian believe that a minor has provided personal data to the Controller without authorisation, they are invited to contact legal@thethundertrader.com immediately to request the deletion of the data and the closure of any account.

16. Changes to this Privacy Policy

The Controller reserves the right to modify this Privacy Policy at any time to adapt it to:

• regulatory developments
• organisational changes
• changes to the service and technical stack
• recommendations from supervisory authorities

In case of substantial modifications affecting the purposes or legal bases of processing, the Controller will inform registered users in advance via email to the address associated with the account and, where necessary, will collect new consent.

The date of the last update is indicated at the beginning of this Privacy Policy. Users are invited to consult the page periodically to check for any modifications.

17. Contacts

Data Controller LN17 ShapeFuture Limited Flat D, 20/F, Eton Building 288 Des Voeux Road Central Sheung Wan, Hong Kong

Email for legal and privacy matters legal@thethundertrader.com

Email for general support support@thethundertrader.com

Data Protection Officer (DPO) Currently being appointed. Contact details will be published in this Privacy Policy once nominated.

Italian Supervisory Authority Garante per la protezione dei dati personali Piazza Venezia 11, 00187 Rome, Italy www.garanteprivacy.it

18. Applicable law and jurisdiction

This Privacy Policy is governed, in coordination with the Terms and Conditions of the service, by the provisions contained therein regarding applicable law and jurisdiction.

For users qualifying as consumers and residing in the European Union, the mandatory provisions for consumer protection provided by the legal system of the country of residence remain unaffected, including the jurisdiction of the place of residence for disputes relating to their rights.

For any matter relating to the processing of personal data, users residing in the European Union may also lodge a complaint with the supervisory authority of the Member State of residence, as provided for by Art. 77 GDPR.

Document drafted in compliance with Regulation (EU) 2016/679 (GDPR), the UK GDPR for users of the United Kingdom, applicable local sector regulations and the guidelines of the European Data Protection Board (EDPB).