Privacy Policy

1. Definitions

In this policy, "personal data" is any information that identifies a person; "processing", any operation on that data (collecting, using, storing, sharing); "data subject", the person the data belongs to (you); "controller", whoever decides the processing (Groman Pro); "processor", whoever processes data on the controller's behalf (for example, a technology provider); and "third party", any other person or organization.

2. Personal data we collect

We collect: full name; email address; phone number; password (always encrypted, never in readable text); contact-form details, including the content of your request; and, when you complete identity verification, a copy of your official ID, proof of address and a liveness check (a short selfie or video). We do not collect sensitive data (health, religion, political affiliation) or data from minors: the service is exclusively for people over 18.

3. Site usage data

When you visit the site we record technical data: pages viewed, time of access, device and browser type, language and IP address. This data serves security, aggregate statistics and site operation. We do not use it to build our own advertising profiles and we do not sell it.

4. Cookies and similar technologies

We use strictly necessary cookies and local storage: keeping you signed in, remembering language preferences and security measures (fraud and abuse protection). When site analytics is enabled, analytics cookies count visits in aggregate. You may block or delete cookies in your browser; the site will keep working, though some session features may require signing in again. We do not use third-party advertising cookies.

5. Controller and processors

The data controller is Groman Pro, with offices at 100 King Street West, Suite 4600, Toronto, ON M5X 1A9, Canada and Av. Presidente Masaryk 111, Polanco, Miguel Hidalgo, 11560 Mexico City, Mexico, and an official privacy channel at [email protected]. Processors include the providers that host the platform, process payments, deliver the identity verification service and deliver email, all under confidentiality contracts with defined instructions on data use.

6. Collection and use of information

We use your data to: create and administer your account; verify your identity; provide the automated trading service; communicate with you for operational and support reasons; send you commercial communications with your consent; meet legal and regulatory obligations; protect the platform and its users against fraud and abuse; and improve the service with aggregate statistics. Each use is limited to these purposes; we do not use data for anything else without telling you.

7. Legal bases for processing

We process data on these bases: contract performance (everything necessary to operate your account); compliance with legal obligations (identity verification, record keeping, responses to authorities); legitimate interest (platform security, fraud prevention); and your consent, for commercial communications and for the liveness check in verification, which you may withdraw at any time without affecting the rest of the service, unless the law requires keeping the data.

8. Data retention

Account data is kept while the account is active and, after closure, for the applicable legal retention periods (including operation and identification records required by each market's anti-money-laundering rules). Usage data is kept in aggregate form for up to 24 months. Verification documents are kept encrypted for the corresponding legal period and securely destroyed when it expires. When deletion is requested, we delete any data whose erasure is not required by law.

9. Transfers to third parties

We share strictly necessary information with: identity verification providers; payment processors; technology providers (hosting, email); affiliates involved in providing the service; and authorities or regulators where applicable law requires it. Every transfer is documented and limited to the minimum necessary. We do not sell or rent personal data.

10. Disclosure of data

We may disclose data under a legal order from a competent authority, to protect the rights or security of the platform and its users, or in merger or corporate reorganization processes, in which case we notify you where the law allows. Outside these cases, your data is not disclosed to third parties unrelated to the service.

11. Security of processing

We apply encryption in transit and at rest, role-based access control with strengthened authentication, access audit logs, continuous monitoring and periodic reviews. No system is infallible: if a breach affecting your data occurred, we would notify you without undue delay together with corrective measures, in line with applicable regulations. Operational details are on the security page.

12. Your rights as a data subject

You may exercise your rights at any time: access (know what data we hold), rectification (correct inaccurate data), erasure (delete data where no legal obligation requires keeping it), objection (stop processing based on legitimate interest) and portability (receive your data in a structured format). You may also withdraw consent for commercial communications. Exercise your rights by writing to [email protected] with the subject "Personal data": we respond within a maximum of twenty business days after verifying your identity.

13. Service providers

Key processors are: the hosting and content delivery provider; the registration form processor; the identity verification provider; the payment processor (transfers, cards and digital wallet); and the transactional email service. All operate under contract, with access limited to what their function requires and no right to use the data for their own purposes.

14. Analytics

When site analytics is enabled, we use an analytics tool to count visits and navigation paths in aggregate. The IP address may be anonymized or truncated depending on configuration. Analytics is not used to identify you personally or to share data with advertising networks.

15. Advertising and retargeting

We do not retarget using your account data and we do not share identifiers with advertising platforms. If such a feature were ever added, it would be only with your express consent and after updating this policy.

16. Links to third-party sites

The site links to external sites, such as exchanges or payment gateways, which have independent privacy policies. We recommend reading them before providing data there: this policy applies only to the Groman Pro site and services.

17. Children's privacy

Groman Pro services are not directed at people under 18 and we do not knowingly collect data from minors. If we detect that a minor created an account, we close it and delete the data as required by law. If you are a guardian and believe a minor provided data on the site, write to us at [email protected].

18. Changes to this policy

This policy may be updated to reflect legal, technical or service changes. We publish the current version on this page at least fifteen calendar days before it takes effect, and material changes are additionally notified by email. The date of the current version can be requested in writing at any time.

19. Contact

Official channel for privacy matters: [email protected], available Monday to Friday 9:00–20:00 Eastern Time. Addresses for notifications: 100 King Street West, Suite 4600, Toronto, ON M5X 1A9, Canada (Canada) and Av. Presidente Masaryk 111, Polanco, Miguel Hidalgo, 11560 Mexico City, Mexico (Mexico). If you believe a rights request was not handled correctly, you may turn to the competent data protection authority in your jurisdiction under the applicable procedure.