Privacy policy
This policy explains what personal data Gruviona collects, why we collect it, the legal bases we rely on, how long we keep it, who we share it with and the rights you have over it. It is written to be read, not skimmed past a cookie banner.
Definitions
"Gruviona", "we" and "us" mean the Gruviona technology platform operated for users in the United Kingdom. "Personal data" means information relating to an identified or identifiable living individual. "Processing" means anything done with that information, from collecting and storing to reading, matching and deleting it. "You" means a visitor to the website or a registered client of the platform.
Personal data we collect
When you register we collect your first name, last name, email address and telephone number, and, if you proceed to verification, your date of birth, address and identity-document details. When you contact support we keep the content of your request and our replies. When you use the platform we keep the records any account generates: deposits, withdrawals, transactions, strategy settings and audit-log entries. Nothing on this list is optional decoration; each item is either required to operate your account, required by law or necessary to answer you.
Usage data
Like every website we receive technical data your browser sends: IP address, browser type and version, device type, referring page, and the pages and times of your visit. This data is used to keep the service secure, to diagnose faults and to understand, in aggregate, how the site is used. IP addresses are also used by the geolocation service that decides which currency to display prices and calculations in.
Cookies
We use a small number of strictly necessary cookies: session cookies that keep you logged in and security cookies that protect forms against automated abuse. These are placed on the basis of necessity, because the site cannot function without them. Where analytics or marketing cookies are ever introduced, they will be subject to consent given through a banner before they are set, and you will be able to withdraw that consent at any time. We do not sell cookie-derived profiles to anyone.
Who is responsible for your data
Gruviona is the controller for the personal data described in this policy: we decide what is collected and why. Where verification providers, hosting providers or payment processors handle data on our behalf they act as processors under written contracts, which means they may only act on our documented instructions. Contact details for exercising your rights are at the end of this page, and the supervisory authority for data protection in the United Kingdom is the Information Commissioner's Office.
Collection and use of information
We use your data to create and operate your account, to verify your identity, to process deposits and withdrawals, to provide the trading and analysis services you registered for, to communicate with you about your account, to meet legal obligations including anti-money-laundering and tax requirements, to keep the platform secure and to improve the service. We do not use your data for automated decision-making that produces legal effects about you, and we do not build advertising profiles from your account records.
Legal bases (UK GDPR)
Processing rests on these bases. Performance of a contract: operating your account, executing your instructions and providing the services you signed up for. Legal obligation: identity verification, transaction monitoring, record-keeping and disclosures required by applicable UK anti-money-laundering and tax law. Legitimate interests: keeping the platform secure, preventing fraud, diagnosing faults and improving the service, assessed against your expectations and rights. Consent: where you ask us to send marketing messages, or where non-essential cookies are used, and withdrawable at any time. Where we rely on consent, withdrawal stops future processing but does not undo processing that already happened lawfully.
How long we keep data
Account and transaction records are kept for the duration of the relationship and for the statutory retention period afterwards, because anti-money-laundering law requires records to survive the end of the relationship. Identity-verification records follow the same statutory period. Support correspondence is kept for a shorter administrative period after the matter is closed. Usage data kept for security and diagnostics is aggregated or deleted on a rolling basis. When a retention period ends, data is deleted or anonymised so it no longer relates to you.
Transferring data
Your data is processed in the United Kingdom and, where a provider we rely on operates elsewhere, only under safeguards: adequacy regulations where they apply, or standard contractual clauses with additional measures where they do not. Identity documents, for example, may be checked by a specialist verification provider, and payment data by card schemes and banks, each within their own regulated environment. Whatever route the data takes, the purposes do not change and this policy continues to apply.
Disclosure of data
We disclose personal data only to the categories described above, to professional advisers where needed, and to regulators, competent authorities or law-enforcement bodies where the law requires it. We do not sell personal data, we do not trade it for services, and we do not disclose it in response to informal queries from anyone. A request from someone claiming to be you, arriving through a channel we have not verified, is treated as a security event, not a disclosure trigger.
Security
Data is encrypted in transit and at rest, access to production systems is limited to the roles that need it and every access is logged. The security page describes the full set of measures: two-factor authentication, login alerts, session control and the audit history you can read yourself. No system is perfect, which is why the incident-response process exists and why we tell affected clients and the Information Commissioner's Office about reportable breaches within the statutory deadlines.
Your rights
Under UK data-protection law you have the right to access the personal data we hold about you, to have inaccuracies corrected, to have data erased where no longer necessary (subject to statutory retention), to restrict processing while a dispute is resolved, to object to processing based on legitimate interests, to receive your data in a portable format, and to withdraw consent where consent is the basis. To exercise any right, write to the address below. We respond within the statutory deadline and may ask one verifying question first, because rights requests are also a favourite avenue of account thieves. You also have the right to complain to the Information Commissioner's Office if you believe our handling of your data was wrong.
Service providers
The platform runs on providers bound by contract to process data only on our instructions: hosting and infrastructure, identity verification, email delivery, payment processing and geolocation for currency display. Each provider receives only the data its function requires, keeps it only as long as the function needs, and is assessed before onboarding and periodically afterwards.
Analytics
We use aggregate, non-identifying statistics about page usage to understand what works on the website. Where an analytics tool is deployed it operates under this policy. Google Analytics is pre-wired in the site configuration with an empty identifier; if the operator activates it, its processing is disclosed here and governed by consent where required, and the data it collects is used to improve the service, not to profile individuals for sale.
Advertising and retargeting
We do not run retargeting pixels or advertising identifiers of our own. If advertising partners are ever used to inform people about the platform, their cookies are set only after consent through the banner, and your consent choices are honoured across visits. Your investment activity, balances and transaction history are never used for advertising targeting in any circumstance.
Links to other sites
Our pages link to services we do not operate, for example the Google Maps embed showing our office location on the contact page. Once you follow such a link or an embedded element loads, the receiving service's own privacy policy governs what it collects. We choose embedded services deliberately and keep the count low, but we cannot take responsibility for the policies of third-party services.
Children
The platform is intended for adults. Accounts are not offered to anyone under eighteen, and identity verification exists in part to enforce exactly that. If we learn that an account was opened by a minor, it is closed and the data is deleted except where the law requires retention. If you believe a minor has registered, tell us at the address below and we will act immediately.
Changes to this policy
This policy may be updated to reflect changes in the service, providers or the law. The current version is always the one published on this page, and it applies from publication. Material changes are announced in the platform dashboard, and continuing to use the service after a change means the updated policy governs your data.
Contact us
Privacy questions, data-subject requests and complaints all go to [email protected], marked for the attention of the Client Support & Compliance team, or by post to One Canada Square, Canary Wharf, London E14 5AB, United Kingdom. Support operates Monday to Friday, 9:00–17:30 GMT/BST (excluding public holidays), and a first reply comes usually under one business hour.