Your identity data stays in the EU. Only trading data sits near the exchanges.
How Algotoria Limited collects, uses, stores and protects personal data — and the rights you have over it. This page is the summary; the full notice is available on request.
1.Where your data is held
We deliberately separate identity data from trading data and store each where it belongs. That is not a compliance detail — it is a design decision that lets us give you EU-grade handling of your identity and Asia-latency execution on your capital, instead of compromising one for the other.
| What | Where | Why there |
|---|---|---|
| Identity, onboarding and contractual records | Germany (EU) — Algotoria's own servers, Tier III, ISO/IEC 27001 | EU-grade protection, segregated from the trading platform, never in a public cloud |
| Account identifiers, encrypted API credentials, trading records | Japan — Google Cloud, Tokyo | Must sit within milliseconds of the exchange matching engines; extra latency widens slippage |
| The same trading data, mirrored | Qatar — Google Cloud, Doha | A standby copy so service can be restored if the Tokyo region is lost |
| Backups of critical data | Netherlands (EU) — Google Cloud Storage | Geographic separation of backup copies |
2.What we collect and why
To verify who you are we collect identity documents, proof of address, tax declarations and evidence of source of funds and wealth — held in Germany. To trade your account we hold an anonymised account identifier, your exchange API credentials in encrypted form, and the record of trades. Because our Telegram bot is the client interface, we also store your Telegram account identifier and display name; that is the only personal data of yours in the cloud trading platform.
We do not sell, rent or trade personal data. We do not build advertising profiles, and we do not make automated decisions about you — our algorithms act on market data and your account settings, not on you as a person.
3.How we protect it
Your API credentials carry trade-only permissions: no part of our system can withdraw, transfer or pledge your assets, and we programmatically reject any key that has withdrawal rights. Credentials are encrypted before they reach the database, and the key that unlocks them is held in a separate system, so database access alone yields nothing usable. Trading credentials are additionally locked to the fixed address of our execution server.
4.Who we share it with
Sumsub and AMLBot for identity and sanctions screening; Google Cloud and Hetzner for hosting; Telegram as the messaging channel; your own exchange; and our auditors, advisers and — where legally compelled — regulators and courts. Each acts under a written agreement.
5.How long we keep it
Identity, AML, contractual and financial records: seven years after the relationship ends, as BVI law requires. Exchange API credentials: deleted on termination or on request. Enquiries that do not become a relationship: twelve months.
6.Your rights
You may ask for access to your data, correction, portability, restriction, or erasure; you may object to processing based on legitimate interests, and withdraw consent at any time. Write to [email protected] and we respond within 30 days.
7.How to reach us
Algotoria Limited, BVI Reg. No. 2161048, Quijano Chambers, P.O. Box 3159, Road Town, Tortola, British Virgin Islands. Data protection enquiries: [email protected]. Security matters: [email protected]. You may also complain to the Office of the Information Commissioner in the BVI, or to your national data-protection authority if you are in the UK or EEA.