Privacy Policy

1. About Us

Capital Corporation Pty Ltd ("Capitals.au", "we", "us", or "our") is the registered legal entity operating under the trading brand Capitals.au. We operate the website capitals.au and associated trading services.

2. Regulatory Framework

Capital Corporation Pty Ltd (trading as Capitals.au) is registered with the Australian Securities and Investments Commission (ASIC) under ABN 91 639 200 329. Our UK operations are conducted under FCA registration FRN 982642. We comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the UK General Data Protection Regulation (UK GDPR), and the EU General Data Protection Regulation (GDPR) where applicable.

3. Information We Collect

We collect the following categories of personal information:

• Identity Data: Full name, date of birth, nationality, government-issued ID (passport, driver's licence)
• Contact Data: Email address, phone number, residential and mailing address
• Financial Data: Bank account details, payment card information, transaction history, account balances
• KYC/AML Data: Source of funds documentation, proof of address, politically exposed person (PEP) status
• Technical Data: IP address, browser type, device identifiers, cookies, log data, and usage analytics
• Trading Data: Trade history, positions, preferences, and AI signal interactions
• Communications Data: Support tickets, chat logs, and email correspondence

4. How We Use Your Information

We process your personal data for the following purposes and legal bases:

5. Cookies and Tracking

We use cookies and similar tracking technologies on our website. Under GDPR and the Privacy and Electronic Communications Regulations (PECR), we obtain your explicit consent before placing non-essential cookies. You may manage your cookie preferences at any time via our Cookie Consent Banner or by contacting us at privacy@capitals.au.

We use the following cookie categories:

• Strictly Necessary: Required for the platform to function (no consent required)
• Analytics: Google Analytics — measures site usage (consent required)
• Functional: Remembers your preferences and settings (consent required)
• Marketing: Targeted advertising and remarketing (consent required)

6. Data Sharing and Third Parties

We may share your personal data with:

• Regulatory Authorities: ASIC, FCA, AUSTRAC, and other competent authorities as required by law
• Payment Processors: For processing deposits and withdrawals under strict data processing agreements
• KYC/AML Providers: Identity verification and sanctions screening services
• Technology Partners: Cloud hosting, analytics, and cybersecurity providers under GDPR-compliant data processing agreements
• Professional Advisers: Legal, accounting, and auditing firms under confidentiality obligations

We do not sell your personal data to third parties.

7. International Data Transfers

Your data may be transferred to and processed in countries outside Australia and the UK/EEA. Where we transfer data internationally, we ensure adequate protections are in place through Standard Contractual Clauses (SCCs), adequacy decisions, or other approved transfer mechanisms under GDPR and the Privacy Act 1988.

8. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, tax, and accounting requirements. Under AML/CTF obligations, transaction records and KYC documentation are retained for a minimum of 7 years from the date of the transaction or the end of the business relationship.

9. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal retention obligations)
• Right to Restriction: Restrict processing of your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing

To exercise any of these rights, contact us at privacy@capitals.au. We will respond within 30 days.

10. Security

We implement industry-standard technical and organisational security measures including TLS encryption, multi-factor authentication, access controls, regular penetration testing, and 24/7 security monitoring to protect your personal data against unauthorised access, disclosure, alteration, or destruction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our website at least 14 days before taking effect. Continued use of our services after the effective date constitutes acceptance of the updated policy.

12. Contact Us