This was prepared in the English language and the English language version shall prevail in the event of any conflict, discrepancy or ambiguity between translations.

About this page: This page provides further details about the main data collection, use, sharing activities set out in our Privacy Notice. It will be periodically updated, but unlike the Privacy Notice, it is not intended to present a complete picture of all our data processing practices.

1. Data that is processed by us (i.e. HDR Global Trading Limited and its group companies), or on our behalf by other entities:

Purpose of collection, use and sharing or entrustment	Items of personal data to be collected/used/shared	Main entities receiving the data	Data location, data retention periods and contact details
To create and administer user accounts	Email address, password, country, name, account settings, customer support details, public and private messages, account notes, order details, IP, geolocation, API keys	HDR Group companies and third party contractors (who help us with customer support or database management services) can access the data periodically, via encrypted data transfers over the Internet.	Data is mainly collected and stored in Ireland (see below) when accounts are created or updated by you or by our staff, and can be accessed by HDR Group companies in other countries for so long as its retention and use is necessary in connection with providing services to you and resolving complaints. See our Privacy Notice.
		Amazon Web Services	Mainly stored in Ireland. See the AWS Privacy FAQ.
	ReCAPTCHA answers	Google ReCAPTCHA automatically collects your answers to CAPTCHA challenges (e.g. image selections) and some data about your device. This is collected directly from you by Google; we do not share personal data with Google’s ReCAPTCHA service.	See the Google Privacy Policy.
	Yubikey details	Your Yubikey details are shared with the YubiCloud service when you enable that form of 2-factor authentication.	See the Yubico Privacy Notice.
	Your photos of your face and ID documents	Users are directed to a service operated by Jumio Netverify, through which Jumio collects personal data from users directly; we do not share personal data with Jumio.	See the Jumio Corp. Privacy Policy for Online Services.
	Support queries, notes and replies	The data is collected directly by Freshdesk.	See the Freshdesk Privacy Notice.
To monitor, secure, debug and improve our services	Data about what features are used on or via our website, API and app.	HDR Group companies access the data periodically, via encrypted data transfers over the Internet, in order to generate system alerts, and to perform and share results of analyses.	See our Privacy Notice.
		Segment.io, Inc. and Google Analytics periodically receive data collected on our servers, via encrypted data transfers over the Internet, in order to generate visitor statistics.	See the Segment.io Privacy Notice and the Google Analytics Privacy Notice
		Functional Software, Inc. (Sentry.io), Pagerduty and Solarwinds (Papertrail) continuously receive log data via encrypted data transfers over the Internet, to help us monitor site/service issues.	See the Sentry/Functional Software Privacy Notice, the Pagerduty Privacy Policy and the Solarwinds Privacy Notice.
Communicating with you	Contact details	HDR Group companies access the data periodically, via encrypted data transfers over the Internet.	See our Privacy Notice.
	Email address, Data indicating you received/opened a newsletter or other email	The data is uploaded to SendGrid, Inc. and/or Intercom, Inc. and their affiliates when your account is created or your email address changes. When you read an email sent via SendGrid and/or Intercom, data may be automatically collected by them when you read that email (if you agreed to this when registering).	See our Privacy Notice, the SendGrid Services Privacy Policy and the Intercom Privacy Policy.
	Device or account identifiers	We deliver mobile push notifications to devices using services provided by Google Firebase and Amazon SNS.	See our Privacy Notice, the Google page on “Privacy and Security in Firebase”, and the AWS Privacy FAQ.
Administering our affiliate program	Unique reference code, trading details	We automatically collect the data when you successfully register through a referral link from an affiliate partner. HDR Group companies access the data each day, via encrypted data transfers over the Internet, in order to determine the commission payable to referring entities.	See our Privacy Notice.

2. Data that might be shared with third parties for their own purposes

Purpose of collection, use and sharing or entrustment	Items of personal data to be collected/used/shared	Main entities receiving the data	Data location, data retention periods and contact details
Participating in our affiliate program	Unique reference code, and information	The data is securely shared with the entity that provided the affiliate link you clicked in order to register with us. Any commission payable to that entity will be based on aggregate trading volumes for all users referred by that entity, but if you are the only user they referred, the data may relate specifically to your trading activity.	See https://www.bitmex.com/affiliate-terms to learn more; please check with the entity that provided you with the link for specific details about their data handling practices.