Controller and scope
TVK LABS & TECHNOLOGIES LTD determines the purposes of this product’s account, subscription, operational and security processing. Contact legal@tvk.group. This notice covers EnteleQUANT; external exchanges, wallets and linked ecosystem websites provide their own notices.
Account creation does not subscribe you to marketing. No identity-document, biometric, Sumsub or facial-recognition collection is currently implemented in EnteleQUANT. If a future workflow requires it, the operator must publish the relevant provider and product disclosures, establish the applicable lawful basis and capture any necessary separate consent before transfer.
Data and sources
You provide your email, authentication data, authenticator enrolment, chosen API credentials, named connections, trading parameters, invoice wallet address and payment evidence. Exchanges supply balances, instrument details, positions, orders, fills and fees. The application records account identifiers, session hashes, role metadata, subscription expiry, consent versions and operational events.
Hosting and network providers may process IP addresses, request metadata and error/security logs. EnteleQUANT rate buckets use keyed fingerprints rather than storing raw IP addresses in those bucket records. Wallet addresses and on-chain transfers are public blockchain information and can still be personal data.
Purposes and legal bases
Where GDPR applies, requested account operation, API connection, portfolio execution and subscription administration rely on contractual necessity where appropriate. Infrastructure security, abuse prevention and defending claims may rely on legitimate interests following the required assessment. Specific tax, disclosure, retention or reporting duties rely on legal obligation only where a duty actually applies.
Optional tracking or marketing requiring consent must use a separate choice. Acknowledging this notice is not blanket consent for unrelated data processing. Refusing account or payment information needed for a requested function can prevent that function; browsing the public pages does not require an exchange connection.
Recipients and cross-border processing
Current technical dependencies include Vercel hosting, Supabase authentication/database services, the configured transactional email provider, connected exchanges and the configured Base RPC provider. A public blockchain independently retains payment transactions. Authorised staff, advisers or competent authorities may receive necessary records where justified.
API secrets are encrypted on the server and supplied only to the exchange client needed for your authorised operation. They are not sent to other ecosystem projects or browser page scripts. Browser wallet extensions handle their own key material. Independent third parties remain responsible for their systems.
Supplier regions, contracts and actual transfer routes must be reviewed by the operator. Where a restricted international transfer applies, the operator must establish an appropriate adequacy or contractual mechanism, supplementary safeguards where needed, and make relevant information available. We do not claim that every supplier configuration has already completed that assessment.
Automated trading and review
User-selected momentum or price-limit rules inspect fresh market data and can submit eligible orders under the configured budget and safety gates. They do not establish suitability, predict returns or provide a guarantee. You can request a stop, review recorded decisions and contact the operator for reconciliation. An unresolved order is paused rather than automatically repeated.
Where law gives rights concerning significant automated decisions, you may request information, human intervention and a way to challenge the outcome. Explainability and assistance do not mean a filled market transaction can be reversed. Contact legal@tvk.group for a privacy or automated-decision request.
Retention and deletion
Browser access cookies last at most one hour; refresh cookies last at most seven days. Server sessions also expire after three minutes without recorded user activity and after twelve hours overall. Refresh and dashboard polling do not extend inactivity or overall lifetime. The configured worker removes expired session records older than one day and rate buckets older than two days; if the worker is absent, those database cleanup tasks are pending.
Connection ciphertext is erased when you revoke a connection after its sessions stop. API permissions must also be revoked at the exchange if required. Order, consent, subscription and invoice records are retained for operational reconciliation, claims and applicable accounting/legal obligations; the operator must document applicable periods and legal holds rather than delete active financial evidence blindly. Backups and provider records follow their separately configured cycles.
Request account closure or deletion at legal@tvk.group. Active positions, unresolved orders, fraud investigations and binding retention duties can limit immediate deletion. We will explain the scope and applicable reason. There is no automatic whole-account deletion or refund transaction in this release.
Your rights and complaints
Depending on applicable law, rights include access, correction, erasure, restriction, portability, objection, withdrawal of qualifying consent, and safeguards for significant automated decisions. Request a signed recent-record export from the dashboard or send a written request to legal@tvk.group; an export is not necessarily complete lifetime history. We verify identity proportionately before releasing private records.
UK and EEA privacy requests normally have a one-month response period, subject to applicable extensions. You may complain to the UK Information Commissioner or the competent authority in your jurisdiction. Other local rights apply where their laws actually cover the processing; selecting a country or language does not by itself determine legal applicability.
We assess data incidents and applicable notification requirements. Material changes are versioned and new consent is requested when required. Children’s accounts are not offered; the contractual minimum age is eighteen or any higher applicable age.
Contacts and reference information
Third-party software notices · Project MIT licence · Service support · Legal & privacy · Corporate identity · UK privacy rights · UK distance selling information