Privacy Policy

1. DOCUMENT INFORMATION

This Privacy Policy is issued by The Circuit Ltd, a company incorporated in the Federal Republic of Nigeria, and The Circuit Tech Ltd, a company incorporated in Canada ("The Circuit", "we", "us", or "our"). The entity you contract with under our Terms of Service is the data controller responsible for your personal data. Residents of Nigeria are covered by The Circuit Ltd and residents of Canada by The Circuit Tech Ltd. Schedule B lists the privacy law, regulator, and contact for each country. Everything else in this policy applies in the same way to every user.

2. INTRODUCTION AND SCOPE

2.1 The Circuit is a skill-based trading competition platform. In operating the Platform, we collect and process personal data about our users. We are committed to handling that data responsibly, transparently, and in compliance with applicable privacy laws.

2.2 This Privacy Policy applies to:

• (a) all users who visit, register on, or use the Platform;
• (b) all personal data collected through the Platform, our website, and any associated mobile applications; and
• (c) all processing activities carried out by The Circuit and its authorised data processors.

2.3 This Privacy Policy should be read together with our Terms of Service, Refund and Cancellation Policy, and Competition Rules, which are available at tradethecircuit.com.

2.4 We do not knowingly collect personal data from anyone under the age of 18, or under the age of majority where they live if that is higher. The Platform is not directed at minors. If we become aware that we have collected personal data from a minor, we will delete that data and close the associated account.

2.5 By creating an account or using the Platform, you confirm that you have read and understood this Privacy Policy.

3. HOW WE APPROACH PRIVACY

Our approach to personal data is built on four principles:

Transparency

We tell you clearly what data we collect, why we collect it, and what we do with it. We do not collect data that we do not need.

Control

Where law permits, you have rights over your data, including the right to access it, correct it, and in certain circumstances, request its deletion. We make it straightforward to exercise those rights.

Security

We apply commercially reasonable technical and organisational measures to protect your data against unauthorised access, loss, misuse, and disclosure.

Compliance

We comply with the privacy law that applies to the entity you contract with, as listed in Schedule B: the Nigeria Data Protection Act 2023 for users in Nigeria, and the Personal Information Protection and Electronic Documents Act (PIPEDA) and any provincial privacy law that applies for users in Canada. Where other laws impose additional obligations, we honour them.

4. PERSONAL DATA WE COLLECT

4.1 We collect personal data in the following categories:

4.1.1 Account Information

When you register an account, we collect:

• (a) full name;
• (b) email address;
• (c) phone number;
• (d) date of birth;
• (e) country of residence;
• (f) username; and
• (g) password (stored in hashed, non-reversible form; we never store your password in plain text).

4.1.2 Identity Verification (KYC) Data

To comply with our legal obligations and to verify your identity before you participate in Competitions, we collect:

• (a) government-issued photographic identification (such as a passport, national identity card, or driver's licence);
• (b) proof of residential address (such as a utility bill or bank statement dated within 90 days);
• (c) a selfie or live video image for biometric matching purposes; and
• (d) date of birth as confirmed by your identity documents.

This data is processed by our authorised third-party KYC verification providers. Matching your selfie to your ID uses biometric data, which is treated as sensitive personal data. We ask for your explicit consent before this check, and we do not keep raw biometric data longer than the verification needs.

4.1.3 Competition and Trading Activity Data

When you participate in Competitions, we collect:

• (a) competition registration records;
• (b) competition results and final rankings;
• (c) leaderboard position data;
• (d) simulated trading activity within your Simulated Account, including trade records, positions, performance metrics, and the rule events recorded against the Rule Card (such as order rejections, daily pauses, score deductions, and integrity flags); and
• (e) competition history across all competitions you have entered.

This data is used to operate Competitions, determine Winners, detect Prohibited Conduct, and improve Platform services. It does not reflect real financial market activity.

4.1.4 Payment Data

When you pay an Entry Fee or receive a Prize, we collect:

• (a) payment transaction records, including date, amount, currency, and status;
• (b) payment method type (for example, bank transfer or card); and
• (c) payout destination details provided by you for Prize disbursement, and your Circuit wallet balance and history where you use the wallet.

We do not store full payment card numbers, CVV codes, or equivalent sensitive payment credentials. Payment card data is handled exclusively by our authorised payment processors, who are subject to applicable payment security standards.

4.1.5 Technical and Device Data

When you access the Platform, we automatically collect:

• (a) IP address;
• (b) browser type and version;
• (c) device type, operating system, and device identifiers;
• (d) login activity and session data; and
• (e) account activity logs.

We also use device fingerprinting and IP-based geolocation for fraud prevention, geo-blocking enforcement, and platform security purposes.

4.1.6 Communications Data

If you contact us for support or submit a complaint, we collect the content of your communications and any information you provide in those communications.

4.1.7 Referral and Public Ranking Data

If you join through a Creator Partner's link or code, we record which partner referred you so we can pay that partner. When you enter a Competition, your username, rank, and score appear on the public Official Rankings.

4.1.8 Website Analytics Data (Planned)

In future phases of Platform development, we intend to collect website usage data through cookies and analytics tools, including page views, session duration, referral sources, and conversion data. We will update this Privacy Policy and provide appropriate notices before deploying analytics tracking.

4.2 We collect personal data directly from you, automatically when you use the Platform, and from our authorised third-party service providers (such as KYC verification providers and payment processors).

4.3 We do not purchase personal data from data brokers or third-party data aggregators.

5. WHY WE COLLECT YOUR DATA AND OUR LEGAL BASIS

5.1 We collect and process personal data only where we have a lawful basis to do so. The following table summarises our processing activities, their purposes, and the legal basis we rely on:

5.2 Where we rely on legitimate interests as our legal basis, we have assessed that our interests in operating a secure, compliant, and fraud-resistant competition platform are not outweighed by your interests or fundamental rights.

5.3 Where we rely on your consent (for example, for optional analytics cookies in future), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5.4 We do not use your personal data for automated decision-making that produces legal or similarly significant effects, except as part of our fraud detection processes. Where automated fraud detection flags an account, human review occurs before any material action is taken.

5.5 For users in Canada, we rely on your consent, which you give when you create an account and when you agree to specific steps such as the biometric check, together with the exceptions that PIPEDA allows, such as complying with the law and preventing fraud.

5.6 We send marketing messages only with your consent, and every message includes an unsubscribe link. Service messages about your account, entries, refunds, and Prizes are not marketing and will still be sent.

6. HOW WE SHARE YOUR DATA

6.1 We do not sell your personal data. We do not share your personal data with third parties for their own marketing purposes.

6.2 We share personal data with third parties only in the following circumstances:

6.2.1 Authorized Service Providers (Data Processors)

We share personal data with third-party service providers who process data on our behalf and under our instruction, including:

• (a) Identity verification providers, to verify your identity and comply with our KYC obligations;
• (b) Payment processors to process Entry Fee payments, refunds, and Prize disbursements;
• (c) Cloud infrastructure providers, to securely host and operate the Platform;
• (d) Customer communications and support platforms, to deliver email notifications and manage support requests; and
• (e) Market data and trading technology providers, to supply the market data and simulated accounts used in Competitions.

All service providers are contractually required to process personal data only as instructed, to maintain appropriate security standards, and to comply with applicable privacy laws.

6.2.2 Regulatory and Law Enforcement Authorities

We share personal data with financial intelligence units, regulatory bodies, and law enforcement agencies where required by law, including:

• (a) the financial intelligence unit listed in our Terms of Service, Schedule B, for the entity you contract with (the Nigerian Financial Intelligence Unit or FINTRAC);
• (c) any other competent authority that lawfully requires disclosure.

We are prohibited from notifying you of certain disclosures, including where disclosure relates to a suspicious activity report.

6.2.3 Sanctions Screening

We share relevant personal data with sanctions screening services to check compliance with sanctions programmes maintained by the United Nations, OFAC, OFSI, and the Nigerian and Canadian authorities listed in our Terms of Service.

6.2.4 Business Transfers

If The Circuit undergoes a merger, acquisition, corporate restructuring, or sale of all or part of its assets, personal data may be transferred to the acquiring entity as part of that transaction. We will notify affected users of any such transfer where required by law.

6.2.5 With Your Consent

We may share your personal data with third parties in other circumstances where you have provided your explicit consent.

6.2.6 Public Rankings and Creator Partners

Your username, rank, and score are shown publicly on the Official Rankings. Creator Partners receive counts of referred entries and their own earnings. They do not receive your name, contact details, KYC data, or payment details.

6.3 Where personal data is transferred to third parties outside your jurisdiction of residence, we take steps to ensure that equivalent levels of data protection apply, including through contractual safeguards, data transfer agreements, or reliance on applicable transfer mechanisms.

7. INTERNATIONAL DATA TRANSFERS

7.1 The Circuit operates in Nigeria and Canada. Your personal data may be transferred to, stored in, and processed in countries other than your country of residence, including Nigeria, Canada, and the countries where our service providers operate.

7.2 Where we transfer personal data internationally, we ensure that appropriate safeguards are in place, which may include:

• (a) transfers that meet the cross-border rules of the Nigeria Data Protection Act 2023, such as transfers to countries with adequate protection or under approved safeguards;
• (b) data processing agreements that require our service providers to protect your data to a standard comparable to the law that applies to us; and
• (c) transfers between The Circuit Ltd and The Circuit Tech Ltd under a written data sharing agreement.

7.3 By using the Platform, you acknowledge that your personal data may be transferred internationally in the circumstances described in this Section.

7.4 If you have questions about how your data is transferred, please contact us at [email protected].

8. HOW LONG WE KEEP YOUR DATA

8.1 We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal obligations. The following retention schedule applies:

8.2 We may retain personal data for longer than the periods specified above where:

• (a) required by applicable law or regulatory obligation;
• (b) necessary for the establishment, exercise, or defence of legal claims;
• (c) reasonably required for fraud prevention or platform security purposes; or
• (d) you have given consent for longer retention.

8.3 When personal data is no longer required, we delete or anonymise it in a manner that prevents reconstruction.

9. YOUR PRIVACY RIGHTS

9.1 Depending on your jurisdiction of residence, you may have some or all of the following rights in relation to your personal data:

9.2 To exercise any of your rights, please email [email protected]. We will respond within the timeframe required by applicable law and in any event within thirty (30) days of receipt.

9.3 We may need to verify your identity before processing certain requests. We will not charge a fee for exercising your rights unless your request is manifestly unfounded, repetitive, or excessive.

9.4 Certain rights are subject to limitations and exceptions under applicable law. For example, we cannot delete data that we are legally required to retain, and we cannot provide data that would disclose confidential information about other individuals.

9.5 Exercising your privacy rights will not affect your right to use the Platform, except where those rights relate to data that is strictly necessary for us to fulfil our contract with you.

9.6 Where to Complain: If you are not satisfied with our response, you can complain to the privacy regulator listed for your country in Schedule B.

10. COOKIES AND SIMILAR TECHNOLOGIES

10.1 We use cookies and similar technologies on our website and Platform. A cookie is a small text file placed on your device when you visit a website. Cookies allow us to recognise your device, remember your preferences, and understand how you use the Platform.

10.2 We use the following categories of cookies:

10.3 You can control non-essential cookies through your browser settings. Disabling essential cookies will affect the functionality of the Platform.

10.4 Before we deploy analytics or advertising cookies, we will implement a cookie consent mechanism that complies with applicable law and allows you to provide or withdraw consent.

10.5 We will publish a standalone Cookie Policy when our analytics and marketing infrastructure is deployed.

11. HOW WE PROTECT YOUR DATA

11.1 We implement commercially reasonable technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• (a) encryption of data in transit using industry-standard protocols (TLS);
• (b) encryption of sensitive data at rest;
• (c) secure, hashed storage of passwords; we never store passwords in readable form;
• (d) access controls and role-based permissions limiting access to personal data to authorised personnel only;
• (e) network security controls including firewalls and intrusion detection systems;
• (f) regular security assessments and penetration testing;
• (g) vendor security assessments for all third-party data processors; and
• (h) staff training on data protection and information security obligations.

11.2 No method of electronic transmission or storage is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

11.3 Where we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by applicable law.

11.4 You are responsible for maintaining the security of your account credentials. You must notify us immediately at [email protected] if you suspect unauthorised access to your account.

12. AML, SANCTIONS, AND REGULATORY DISCLOSURES

12.1 We are required by law to operate an anti-money laundering and counter-terrorist financing (AML/CTF) compliance programme. This requires us to collect and retain identity verification data, screen users against international sanctions lists, monitor transaction activity, and report suspicious activity to relevant financial intelligence units.

12.2 Legal obligations in this area take precedence over your general privacy rights. We are not able to delete data that we are legally required to retain under AML/CTF regulations, and we are not able to notify you of certain disclosures required by law.

12.3 We screen all users against sanctions lists published by the United Nations, OFAC, OFSI, and the Nigerian and Canadian authorities listed in our Terms of Service. Screening is conducted at registration and on an ongoing basis.

12.4 We retain AML-related records for at least five (5) years after our business relationship with you ends, or longer where the law listed in Schedule B requires.

13. CHILDREN'S DATA

13.1 The Platform is not intended for anyone under the age of 18, or under the age of majority where they live if that is higher, and we do not knowingly collect their personal data.

13.2 If we become aware that we have collected personal data from a minor, we will promptly delete that data and close the associated account.

13.3 If you are a parent or guardian and believe that your child has provided personal data to us, please contact us at [email protected].

14. THIRD-PARTY WEBSITES AND SERVICES

14.1 The Platform may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third-party websites or services.

14.2 We are not responsible for the privacy practices of third-party websites or services. We encourage you to review the privacy policies of any third-party website or service before providing your personal data.

15. AUTOMATED DECISION-MAKING AND PROFILING

15.1 We use automated systems as part of our fraud detection and competition integrity monitoring programme. These systems analyse account activity, trading patterns, device data, and IP information to identify potentially fraudulent or collusive behaviour.

15.2 Some actions are applied automatically under the published Rule Card, such as rejecting an order above the leverage limit, pausing an entry at the daily loss limit, ending an entry at the total loss limit, and applying fixed score deductions. These apply the same published rules to every Participant. Where a system flags an account for possible Prohibited Conduct, a member of our compliance team reviews the flag before any significant action is taken, such as disqualification, account suspension, Prize withholding, or account termination.

15.3 If you believe an automated action on your account was wrong, you may ask for a human review by contacting us at [email protected].

15.4 We do not use profiling for personalised advertising at this time.

16. DATA BREACH NOTIFICATION

16.1 In the event of a personal data breach, we will act in accordance with our legal obligations under applicable law, including:

• (a) notifying the privacy regulator listed in Schedule B within the timeframe that law requires (within 72 hours under the Nigeria Data Protection Act 2023, and as soon as feasible under PIPEDA where there is a real risk of significant harm); and
• (b) notifying affected individuals where the breach is likely to result in a high risk to their rights and freedoms, or a real risk of significant harm.

16.2 Our breach notification will describe, to the extent possible: the nature of the breach; the categories and approximate number of individuals affected; the likely consequences of the breach; and the measures we have taken or propose to take to address the breach.

16.3 We maintain an internal data breach response procedure. This procedure is not published in this Privacy Policy but is available to our staff and relevant compliance consultants.

17. COUNTRY-SPECIFIC DETAILS

17.1 Where the Platform Is Available

The Platform is available to residents of Nigeria and Canada, as set out in our Terms of Service. Schedule B to this policy lists, for each country, the data controller, the privacy law, the regulator, the privacy contact, and the breach notice rules.

17.2 Visitors From Other Countries

If you visit our website from another country, we collect only the technical data described in Section 4.1.5, and we use it for security and to apply our geographic restrictions. You may have further rights under your local law, which we will honour where it applies to us.

18. AMENDMENTS TO THIS PRIVACY POLICY

18.1 We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or Platform features.

18.2 Material changes to this Privacy Policy will be communicated to registered users by email to their registered address or by prominent notice on the Platform not less than fourteen (14) days before the change takes effect.

18.3 Minor changes that do not materially affect your rights or our processing activities may be made at any time. The effective date at the top of this document reflects the date of the most recent update.

18.4 Continued use of the Platform after the effective date of an updated Privacy Policy constitutes acceptance of the updated terms.

19. CONTACT US

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or want to report a data protection concern, please contact us using the details below:

If you are not satisfied with our response to a privacy complaint, you can escalate it to the privacy regulator listed for your country in Schedule B.

SCHEDULE A: DATA PROCESSING SUMMARY

This Schedule summarises our main data processing activities.

SCHEDULE B: PRIVACY DETAILS BY COUNTRY

This Schedule sets out the details that differ by country. It matches Schedule B of our Terms of Service and is updated when we open in a new country.

END OF PRIVACY POLICY

© 2026 The Circuit Ltd and The Circuit Tech Ltd. All rights reserved.