Privacy Policy

IST Markets LTD ("IST Markets", "we", "us") is responsible for the personal data described in this policy (the data controller). This policy applies to our websites, landing pages, lead forms, client portal and trading-related services.

We process personal data in accordance with the Data Protection Act 2017 of Mauritius and, where it applies to you, other data-protection laws such as the EU/UK General Data Protection Regulation (GDPR).

• Identity and contact data: name, email address, phone number, country of residence, preferred language.
• Verification (KYC) data: identity documents, proof of address, date of birth, nationality, and where required, selfie or liveness checks.
• Financial and suitability data: employment, income, source of funds and wealth, trading knowledge and experience.
• Account and transaction data: deposits, withdrawals, payment details, trading activity and account history.
• Technical data: IP address, device and browser information, pages visited and interactions with our sites.
• Marketing and attribution data: the campaign, advert or partner that referred you (for example UTM parameters and click identifiers) and your marketing preferences.
• Communications: messages, emails, chat and call recordings where permitted by law.

We collect personal data directly from you (for example when you complete a form, open an account or contact us), automatically when you use our websites and platforms (through cookies and similar technologies), and from third parties such as introducing brokers and affiliates, identity-verification and screening providers, payment providers and publicly available sources.

• To respond to your enquiry and open and operate your account (performance of a contract or steps taken at your request).
• To verify your identity, assess appropriateness, prevent fraud, money laundering and terrorist financing, and meet our regulatory reporting and record-keeping duties (legal obligation).
• To secure our services, measure and improve our websites, and understand which campaigns and partners bring us clients (legitimate interests).
• To send you marketing communications, where you have agreed or where the law otherwise allows (consent, which you can withdraw at any time).

We do not sell your personal data. We share it only where necessary with:

• our CRM and affiliate-attribution provider (Skale), which receives the details you submit in our lead and registration forms together with technical data such as your IP address, and acts as our data processor;
• hosting, security and bot-protection providers (such as Cloudflare Turnstile), identity-verification and screening providers, and payment service providers;
• analytics and advertising partners, where you have consented to the related cookies (see our Cookie Policy);
• introducing brokers or affiliates who referred you, to the extent needed to administer that relationship;
• our group companies, professional advisers and auditors; and
• regulators, tax authorities, law-enforcement agencies and courts where required by law.

Our processors may only use your data on our instructions and must protect it appropriately.

Some of our service providers are located outside Mauritius and outside your country. Where we transfer personal data internationally we take steps required by applicable law to ensure it remains protected, such as contractual safeguards.

• Client, verification and transaction records: for the period required by the anti-money-laundering and financial-services laws of Mauritius after the end of our business relationship (currently at least seven years).
• Enquiries and leads that do not become accounts: only for as long as needed to respond and follow up, after which they are deleted or anonymised.
• Marketing preferences: until you withdraw consent or object, plus a suppression record so we respect your choice.

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete data or restrict its use, where we are not legally required to keep it;
• object to processing based on legitimate interests and to direct marketing at any time;
• receive your data in a portable format; and
• withdraw consent at any time, without affecting processing already carried out.

To exercise your rights, contact us at the contact options on istmarkets.com. You may also complain to the Data Protection Office of Mauritius or to the data-protection authority in your country.

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls and staff confidentiality obligations. No system is completely secure, so please keep your passwords confidential and tell us immediately if you suspect unauthorised access to your account.

Information about the cookies and similar technologies we use is set out in our Cookie Policy. Our services are not intended for anyone under 18 and we do not knowingly collect their data.

We may update this policy from time to time. The 'Last updated' date at the top shows when it was last changed. Where changes are significant we will tell you by appropriate means.