GDPR Compliance Policy

This policy applies to all users located in the European Union (EU) and European Economic Area (EEA) and governs how MagicTradeBot processes personal data in compliance with Regulation (EU) 2016/679 — the General Data Protection Regulation ("GDPR").

Because MagicTradeBot is a self-hosted binary, the personal data we control is limited to what is required to operate our website, manage accounts, and validate licenses. The division of data controller responsibilities is as follows:

Under GDPR Article 6, all personal data processing must have a lawful basis. The following table sets out our processing activities and their corresponding legal grounds:

As an EU/EEA data subject you have the following rights under GDPR. All requests are processed free of charge within 30 days of receipt of a complete request.

A. Right of access (Article 15)

You may request confirmation of whether we process your personal data and, if so, receive a copy of that data along with information about how it is processed.

B. Right to rectification (Article 16)

You have the right to correct inaccurate personal data or complete incomplete data we hold about you. For most account fields (name, email) this is available via self-service in your Account Dashboard. For other corrections, contact us directly.

C. Right to erasure — "Right to be forgotten" (Article 17)

You may request deletion of your personal data. We will fulfil erasure requests subject to the following:

D. Right to data portability (Article 20)

You may request a copy of your personal data in a structured, commonly used, machine-readable format (JSON or CSV) suitable for transfer to another service. Submit portability requests to sales@magictradebot.com with subject GDPR Portability Request.

E. Right to restrict processing (Article 18)

You may request that we temporarily halt processing of your personal data in the following circumstances:

• You contest the accuracy of data we hold — processing is paused during verification
• Processing is unlawful but you prefer restriction over deletion
• We no longer need the data but you require it for legal claims
• You have objected to processing under Article 21 — pending verification

F. Right to object (Article 21)

You have the right to object to processing based on legitimate interests or for direct marketing purposes:

• Marketing emails. Unsubscribe via the link in any marketing email, or email us with subject GDPR Marketing Opt-Out.
• Profiling or automated decision-making. Contact us to opt out of any automated processing that significantly affects you.

G. Right to withdraw consent (Article 7)

Where processing is based on your consent (e.g. marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Contact us or use the unsubscribe link in any marketing communication.

H. Right to lodge a complaint (Article 77)

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with your national data protection authority. You may do this without first raising the matter with us, though we encourage you to contact us first so we can attempt to resolve the issue directly.

MagicTradeBot is operated from Pakistan. If you are located in the EU/EEA, your personal data is transferred to and processed in a country outside the EEA. We ensure appropriate safeguards are in place for such transfers:

• Standard Contractual Clauses (SCCs). Where we use EU-approved SCCs with processors outside the EEA, including any cloud infrastructure or analytics providers.
• Adequacy decisions. Where transfers are made to countries covered by a European Commission adequacy decision.
• Processor agreements. All third-party processors who handle EU personal data are bound by data processing agreements requiring GDPR-equivalent protections.

We implement technical and organisational measures appropriate to the risk of processing personal data, consistent with GDPR Article 32:

• Encryption in transit. TLS 1.3 for all data transmitted between your browser and our servers.
• Encryption at rest. AES-256 for all stored sensitive data.
• Access controls. Role-based access (RBAC) and two-factor authentication required for all staff with access to personal data.
• Pseudonymisation. Where possible, personal identifiers are replaced with licence keys or anonymised tokens in internal processing.
• Breach notification. In the event of a personal data breach we will notify the relevant supervisory authority within 72 hours of becoming aware, and notify affected individuals without undue delay where there is high risk to their rights and freedoms (Article 33/34).

We use a limited number of third-party service providers who process personal data on our behalf. All are bound by data processing agreements (DPAs):

We do not sell or rent personal data to any third party. See our full Privacy Policy for complete details on data sharing.

To submit any GDPR data rights request, contact our privacy team:

Include with your request:

• Your account email address and license key
• The specific right you are exercising
• Proof of identity for sensitive requests (e.g. government-issued ID if requesting deletion of all data)

This GDPR Compliance Policy is reviewed annually and updated when changes to our processing activities, applicable law, or regulatory guidance require it. When material changes are made:

• The "Last Updated" date at the top of this page is updated
• Registered EU/EEA users are notified via email
• A notice is displayed on the platform dashboard for 30 days

Continued use of MagicTradeBot after changes are published constitutes acknowledgement of the updated policy.

For all GDPR-related questions, data rights requests, or compliance enquiries:

If you are not satisfied with our response, you have the right to lodge a complaint with your national supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu.