Privacy Policy

24-FX Ltd, operating as 24-FX, is the controller for the activities described in this notice. Its company address is 25 San Stefano Str, 1000 Sofia, Bulgaria. Questions and rights requests may be sent to [email protected] or that postal address.

Our own processing covers officially identified website pages, access administration, affiliate verification, support, correspondence and operation of Telegram communities. It does not replace the independent notices of Breakline or Telegram.

We principally address Asia and Africa and do not actively solicit EU members. Eligible EU persons can request access where lawful. British nationality, UK residence and use from the UK are excluded by our Terms; privacy rights still apply to information already received, including an inquiry from an ineligible person.

For processing in the context of our Bulgarian establishment, the EU General Data Protection Regulation applies regardless of an audience’s location outside the EU. Additional compulsory rights under another applicable law are preserved.

The records relevant to an individual depend on the interaction. A visitor, an email correspondent and a Premium applicant need not have the same records. We use only information relevant to an identified purpose.

• Membership particulars: a name or display name, supplied email, access level, admission and closure dates, and minimum age, residence or nationality details necessary to apply the eligibility rules. These come from you or administration of your membership.
• Telegram details: user identifiers, usernames, profile details visible to administrators, access status and available join/leave events, messages and support requests. These arise through you, Telegram and any membership tool separately disclosed when used.
• Referral records: referral or campaign identifiers, account reference, partner identity, attribution and qualifying status and dates, and information necessary to reconcile an affiliate payment. These may come from a referral interaction, you or Breakline. A more detailed deposit or activity record is used only where necessary and lawfully supplied for an explained purpose. This notice does not assume access to every item Breakline collects for its own clients.
• Correspondence and disputes: requests, responses, relevant attachments, complaint evidence and necessary acceptance or compliance records, supplied by you or created in handling the matter.
• Operational website information: request time, IP address, browser or device details, requested pages, referral source and necessary security or error information that may arise through the hosting service.
• Optional measurement and communications: preferences, consent evidence and campaign or usage identifiers where a specifically disclosed and lawful optional activity is undertaken. Mentioning this category does not establish that an advertising pixel is active.

Routine access administration does not require broker passwords, full transaction histories, payment credentials or government identity copies. Do not send those items. If a particular legal or verification need requires more, we will explain the purpose, basis and suitable handling method first. Current membership is free; no payment processor or collection of card data is asserted for it. A paid offering would require an updated notice.

Where Breakline supplies data indirectly, we will identify the source, relevant categories and purposes before receipt where practicable, otherwise within the legal notice period. Under GDPR that ordinarily means within one month and sooner if the first communication or onward disclosure requires it, unless a lawful exception applies.

We distinguish information necessary for a requested service from optional processing. Contract is used only for processing objectively needed to fulfil membership or requested pre-contract steps, not every activity commercially convenient to us.

Admission, administration, access delivery and requested service communications use necessary contact, access and Telegram records on that contractual basis. A minimum qualifying-status check also uses contract where required to provide the conditional Premium access you request. More extensive affiliate accounting or attribution reconciliation relies on our assessed legitimate interest in correct commercial accounting and fraud prevention, subject to any separate consent requirements.

Service support ordinarily relies on contract. Other inquiries, complaint investigation and establishing or defending claims use legitimate interests in resolving matters and protecting legal rights; a specific compulsory complaint or record duty instead relies on legal obligation.

Necessary security, misuse prevention and diagnosis use our legitimate interests in protecting members and systems, following a necessity and balancing assessment. Statutory recordkeeping or a lawful authority request uses legal obligation where the relevant Bulgarian accounting, tax or other applicable rule requires that particular record. Ordinary correspondence is not automatically a statutory accounting record.

Optional promotional communications require consent where electronic-marketing law demands it; a lawful exception is used only if all its conditions apply. Service notices do not authorise unrelated advertising. Non-essential device storage or access for analytics, advertising or referral attribution requires prior consent where applicable. A basis for any subsequent processing must be assessed and explained separately.

The legitimate interests are those identified above, and do not automatically outweigh your rights. Request information about an assessment or object at [email protected]. Consent can be withdrawn through that email, an opt-out reply or the choice control supplied with the activity. Withdrawal stops future consent-based use without making earlier lawful processing unlawful. Unrelated marketing consent is not a condition of membership.

Fields genuinely needed for admission or a disclosed verification will be identified when requested. Without them we may be unable to provide the corresponding access. Declining optional analytics or marketing does not affect membership and leaves those consent-dependent activities disabled.

Refusing a necessary broker-status check can prevent confirmation of Premium qualification. We will explain the minimum information and offer another verification method where reasonably available. Detailed financial or transaction data is not demanded merely because the broker holds it.

Only information justified for a lawful stated purpose is shared, with safeguards appropriate to the recipient’s role. Authorised personnel and hosting, technical, email, database or access providers receive what they need to perform their function. A processor acts under contractual instructions; a provider can separately control information for its independent purposes.

Breakline Markets is our sole affiliate broker. Its public materials identify Breakline Markets Ltd, referred to as Breakline Markets Limited in its client agreement, with address 6th Floor, Tower 1, Nexteracom Building, Ebene, Republic of Mauritius. Its notice is at https://breakline.market/legal/Privacy%20Policy.pdf and its legal-document library at https://breakline.market/legal-documents. The broker independently controls its account-opening, identity-checking and trading data. Its public privacy notice describes contact, identity, financial and transaction information for those purposes; that does not establish that the same information is disclosed to 24-FX.

Following our referral may supply the broker with attribution and request information. An agreed lawful exchange can give us the minimum account reference and qualification information needed for admission, accounting, fraud prevention or a dispute. We will explain materially additional fields before use. Information viewed within a partner portal is still processed even without downloading it. If a particular activity entails joint control, we will provide the required explanation of responsibility and the essence of the arrangement.

Telegram controls its own platform processing under https://telegram.org/privacy. We separately control our administrator use of accessible membership information, messages and any disclosed tools; it is inaccurate to assume every Telegram operation is a processing service performed solely on our instructions.

Legal and accounting advisers can receive necessary material subject to confidentiality. Authorities or other lawful recipients receive information required by a valid legal process or otherwise necessary and lawful for rights protection or serious-misuse investigation. A genuine business transfer may involve proportionate due diligence and transfer of necessary records, with lawful safeguards and notice; a change of owner does not authorise incompatible reuse.

Email operation necessarily involves a mailbox provider. An address alone does not identify that provider, hosting locations or a membership database. The identity of relevant recipients for your records can be requested from [email protected]. Additional tools and materially changed processing must be described by supplementary notice when introduced. No particular website host, payment platform, database or bot is asserted without verification for this service.

Affiliate remuneration pays for a qualifying referral, not unrestricted access to membership lists or correspondence. A commercial referral can nevertheless entail a personal-data disclosure; it remains subject to lawful basis, transparency and any relevant tracking consent.

Channel broadcasts, discussion groups and private messages have different audiences. Profile settings and Telegram functionality can affect visibility. Group contributions may be seen, copied or forwarded by other members; a public-channel post can reach a wider audience. Check your settings and avoid posting sensitive account details.

Our inability to erase another person’s external copy does not excuse our obligations for records we control. External broker or other links lead to separately operated services, whose notices should be reviewed before supplying data.

Cookies, local storage, pixels and related software may store or access device information. Only legally qualifying necessary technologies can operate without consent where permitted. Optional analytics, advertising or attribution requiring consent must remain inactive until a valid choice is made.

Funding the Service through referrals does not make marketing tracking technically necessary. URL identifiers, server matching and pixels need their own assessment. Server-side implementation does not automatically avoid privacy rules.

Where a consent-dependent technology is introduced, the choice presented must identify its provider, purpose, data and duration and enable rejection and withdrawal. Optional categories must not be preselected and rejection must be as accessible as acceptance where required. This notice is not that consent control. Browser settings can restrict or remove cookies but cannot replace a pre-activation choice where the law requires one. Contact [email protected] to raise a tracking concern or withdraw consent.

A Breakline referral can convey the referral identifier and technical request details; the destination separately receives information you supply there. Its own privacy and cookie notices govern its site. Attribution does not grant us unrestricted access to your trading account.

The identified broker is in Mauritius. Platform and infrastructure providers may also process information internationally. A recipient’s general privacy notice does not prove that every 24-FX transfer has an implemented lawful mechanism.

Where GDPR restricts an EEA transfer, we must establish an applicable mechanism before the transfer, such as a relevant adequacy decision or properly implemented standard contractual clauses supported by the necessary assessment and supplementary safeguards. Any adequacy framework must actually cover the recipient and processing and remain valid. UK mechanisms apply where UK transfer law governs. This notice does not certify an unverified clause arrangement or adequacy participation.

Ask [email protected] for the recipient, relevant destination and safeguard information or a copy applicable to a specific transfer. Confidential parts may be redacted without obscuring the protection’s substance. An exceptional derogation must meet its own conditions; agreeing to this notice is not transfer consent and cannot support an ordinary routine transfer by itself.

Identifiable information is kept only while a justified purpose or legal requirement continues, then deleted or genuinely anonymised. Replacing a name with a code is not, by itself, anonymisation. The following criteria govern the different records:

• Membership information remains necessary during active access; after closure, only information needed for closure, opt-out compliance or an identifiable unresolved matter is retained.
• Referral checks remain while qualification, reconciliation, reversal questions or attribution disputes are unresolved. Minimum accounting evidence is kept further only for applicable statutory duties; availability of detailed broker reports is not a justification for indefinite retention.
• Ordinary inquiries remain while handling and reasonable follow-up continue. Evidence needed for a complaint or claim follows that matter’s separate criteria.
• Agreement versions, acceptance evidence and relevant complaints remain while proof is reasonably necessary for rights, an actual dispute and its applicable limitation period or legal hold.
• Technical records remain for their operational or security purpose. Specific incident evidence may continue until investigation, remediation and necessary proceedings finish.
• Optional tracking follows the duration disclosed when enabled. Consent evidence remains only as long as needed to demonstrate compliance; withdrawal stops future activity without automatically destroying proof of earlier lawful use.
• A marketing objection requires only the minimum suppression entry needed to honour it, not continued retention of an unnecessary profile.
• Deleted records may persist until a backup expires or is overwritten. They must not return to routine use, and restoration must reapply deletion or restriction. Independent provider retention follows that provider’s obligations.

Where a fixed period is not reasonably available, purpose, sensitivity, statutory duties, an actual dispute and relevant limitation periods determine retention. Holds affect only relevant material and require review. Hypothetical future litigation cannot justify keeping every record forever.

We have a duty to maintain technical and organisational safeguards suited to the information and risk of loss, disclosure or unauthorised access. Access must be limited to authorised persons with a relevant need. This notice does not certify an unverified security audit, encryption-at-rest product or other particular technical implementation.

Do not send credentials, card details or identity copies by ordinary email or public discussion. Where a sensitive verification is genuinely necessary, we will explain the reason and suitable method first.

Absolute security cannot be promised. A breach will be assessed and contained, with notification to competent authorities and affected individuals where the applicable law requires it and within its deadlines. This qualification neither reduces the safeguard duty nor exempts applicable liability.

Subject to applicable conditions and lawful exceptions, GDPR provides rights to:

• Obtain access to your information and an explanation of its use.
• Correct inaccuracies and complete incomplete particulars.
• Seek deletion or limitation of processing in the legally specified circumstances.
• Obtain the data you supplied in a structured, commonly used, machine-readable format and request transfer where portability applies to automated contract- or consent-based use.
• Object, because of your particular situation, to legitimate-interest processing; it must stop unless legally sufficient overriding grounds or a legal-claims basis applies.
• Object whenever you choose to direct marketing and associated profiling, which we must stop.
• Withdraw consent without undoing lawful prior processing.
• Receive the applicable protections for solely automated decisions with legal or similarly significant effects.

Write to [email protected]. Reasonable identity doubts may require proportionate verification, not routine unnecessary identity copies. Requests are normally free. A legally permitted charge or refusal for a manifestly unfounded or excessive request will be explained with complaint options.

We will respond without undue delay and normally within one month under GDPR. If complexity or the number of requests permits an extension of up to two additional months, reasons will be supplied within the initial month. A shorter or different compulsory local deadline prevails where applicable. Necessary legal obligations or claims may limit deletion or another request; we will explain any lawful limitation. Leaving a Telegram community alone does not request erasure of every separate record.

A qualification report may reflect statuses generated by the broker’s systems. Receiving one does not mean 24-FX makes the broker’s account-opening or trading decisions. If incorrect status information affects membership, ask [email protected] for correction and review by a person.

Where automated access checks are used, their inputs and a route to resolve errors must be explained. Before introducing automation needing further notice or safeguards, we will provide them. Solely automated decisions producing legal or similarly significant effects require disclosure of meaningful logic, significance and likely consequences, a lawful basis and the relevant safeguards, including human intervention and challenge rights where applicable. We do not assert that every independent broker decision is manual.

Our intended users are adults of at least 18 and any higher required local age. Children are not intentionally admitted. Report suspected child information to our contact address; we will investigate, restrict unsuitable access and erase as required, subject to justified legal retention.

You may contact us, but need not do so before approaching a competent authority. Under GDPR this can include the authority where you habitually live or work in the EEA or where the alleged infringement occurred.

In Bulgaria, the Commission for Personal Data Protection is at 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria. Contact and complaint instructions are at https://cpdp.bg/en/contacts/ and https://cpdp.bg/en/lodging-complaints-and-alerts/. Where UK GDPR applies, the Information Commissioner’s Office is available at https://ico.org.uk/. Other authorities competent under applicable law remain available. Exclusion from membership does not exclude a lawful complaint.

A revision will show an updated date. Material changes will be explained on official website pages and, where necessary for affected members, through Telegram or direct email. A new purpose requiring notice, compatibility assessment or fresh consent will not begin before those requirements are met.

Continued use is not consent to new processing. Updating a notice does not automatically permit a materially different use of previously collected information.