1. Scope and how to read this policy
This Privacy Policy explains how Abutron (Pty) Ltd, trading as Abutron FX or AbutronFX ("Abutron", "we", "our" or "us") collects, uses, stores, discloses and protects personal information in connection with the Abutron FX website, customer and administrative portals, trading-software services, Kronos analytics, mobile and desktop applications where available, account linking, referrals, payments, licensing, customer support and associated communications.
It applies to visitors, applicants, registered customers, authorised account users, business contacts and people who contact us. Individual products may display a supplementary privacy notice if a particular workflow requires additional information or consent.
We seek to comply with South Africa's Protection of Personal Information Act 4 of 2013 (POPIA) and related applicable legislation. Where other privacy laws apply to an individual or service, we will address their requirements as applicable. This policy describes practices and does not replace the separate contractual terms, risk disclosures or privacy notices of independent brokers, banks or payment providers.
2. The responsible party
Responsible party: Abutron (Pty) Ltd, trading as Abutron FX.
Country: Republic of South Africa.
Website: https://abutronfx.online/
Privacy correspondence: billing@abutronfx.online (interim customer and privacy enquiries contact).
For the registered physical address, the name or contact details of our designated Information Officer, or formal service of POPIA or PAIA correspondence, please request the current company particulars via the email above. We will update this page with confirmed official details. We generally determine the purposes and means of processing information in our own customer services. A partner may act as an independent responsible party or, where contracted, as an operator on our behalf.
3. Categories of personal information we may collect
| Category | Examples and context |
|---|---|
| Identity and contact | First and last name, email, phone number, country, address, account identifier and customer profile information. |
| Registration and verification | Proof-of-identity or residence documents, date of birth, nationality, document numbers, verification results, screening flags, and, when required and configured, selfie images or biometric comparisons through a verification provider. |
| Broker connections | Broker name, platform type (for example MT5 or cTrader), connected account identifiers, authorised access tokens, link status, account equity and balance, order and position identifiers and trade history needed for enabled features. |
| Subscriptions and payments | Plan or licence, invoice details, payment references, settlement and refund status, billing contacts and records required for accounting and fraud controls. Payment providers may collect separate bank and payment credentials directly. |
| Technical and security | Device and browser type, approximate location derived from IP address, access timestamps, IP address, cookies, session data, diagnostic events, login history, error logs and fraud/security alerts. |
| Customer communications | Support tickets, chat, email, notification preferences and, when the feature is used, call or messaging metadata and relevant records of customer-service interactions. |
| Marketing and referrals | Referral source, broker partner attribution, preferences, campaign interactions and marketing permissions where applicable. |
| Business or legal records | Company representative information, contractual correspondence, dispute or compliance documentation where relevant. |
Not every customer provides every category. We aim to collect only data that is adequate, relevant and not excessive for the services and legal obligations involved. We do not require customers to submit bank passwords or full payment-card credentials to Abutron through an ordinary support message.
4. Where information comes from
We obtain personal information (a) directly from you when you register, complete forms, connect accounts, request support or communicate with us; (b) automatically when you use our sites or applications; and (c) from authorised third parties, such as identity-verification providers, payment processors, connected brokers and service providers, where permitted by law and our agreements.
Where a broker, payment provider or identity-verification service supplies information, we may receive status, account data or compliance results rather than all underlying documents or payment credentials.
5. Why and on what grounds we process information
Subject to POPIA and the circumstances, we process personal information where necessary to perform or prepare for a contract, comply with a legal obligation, protect your legitimate interests, pursue a lawful and appropriately balanced legitimate interest, or where you provide valid consent.
- Account management: register users, manage authentication, maintain profiles and administer subscriptions or licences.
- Trading technology: display portfolio and trading data, supply software analytics, confidence or risk indicators, execute customer-authorised integration workflows and support account operations.
- Identity and compliance: confirm identity, prevent misuse, conduct applicable know-your-customer (KYC), anti-fraud and anti-money-laundering checks when required for a service, transaction or partner relationship.
- Payments: generate invoices, facilitate checkout and refunds, reconcile transactions and maintain required accounting records.
- Service and reliability: troubleshoot, investigate outages, maintain audit logs, protect infrastructure and detect unauthorised access or fraudulent transactions.
- Communications: deliver transactional notices, security messages, critical service alerts and respond to enquiries; send promotional communications where permitted and respecting opt-out requests.
- Legal obligations: respond to lawful requests, administer legal claims, manage disputes and comply with tax, records, regulatory and other legal duties.
We will not reuse personal information for a materially incompatible purpose without another lawful basis and any required notification or consent.
6. What information is compulsory or optional?
Basic registration and contact information is ordinarily necessary to open an Abutron customer account. Broker account information and access permissions are necessary only if you choose to enable supported broker connectivity. Verification documents or additional information may be required to activate particular features, meet risk controls or satisfy applicable law or provider requirements. Billing data is needed for paid services. Marketing consent is generally optional.
If you decline compulsory data, we may be unable to register you, verify identity, process payments or provide the selected functionality. If you withdraw a consent, that withdrawal does not invalidate processing lawfully carried out before it, and may limit features that depend on the consent.
7. Identity verification, KYC and biometric information
Abutron may use Sumsub for customer or business identity verification, document checks, sanctions or politically exposed person screening, liveness checks and fraud prevention, depending on the configured workflow and legal or partner requirements. A verification session may request identification documents, an image or video of your face, proof of address, date of birth and other information relevant to verification.
When a biometric or facial comparison is enabled, the provider may derive biometric measurements or similar sensitive information to confirm identity or detect fraud. Such processing will be limited to configured purposes and an applicable legal ground, with specific prior notices and consent where required. Do not submit identity or biometric documents unless the flow requests them and explains their use.
Roles: for verification services, Sumsub may act as an operator/processor following our instructions and may separately act as a responsible party/controller for its own limited purposes as described in its notice. We may receive a result, risk flag, audit reference or selected details. The precise records accessible to Abutron depend on our configuration.
Read before verification: Sumsub Privacy Notice (Service Delivery) and Sumsub Data Controller Notice. We will present the required provider disclosures and capture applicable consents before starting verification checks; integration method determines how this happens.
8. Payments, billing and financial information
Abutron uses or may enable Stitch payment services for online checkout, payment confirmation, refunds and, for qualifying services, disbursements. Stitch or participating financial institutions may independently request bank or payment details in their controlled flow, under their own terms and notices. Abutron generally requires payment status, amount, currency, transaction reference and related invoice identifiers to administer your purchase.
We use billing and transaction records to confirm entitlements, prevent duplicate charging, investigate suspected fraud, reconcile settlements and meet accounting duties. We do not promise that payment credentials entered directly into a third-party checkout are stored by Abutron. Please check the payment screen and provider notices before authorising payment. Payment refunds or transfers may also require identity or account checks under applicable rules.
9. Connected brokers, market information and trading activity
When you connect an eligible IC Markets, FP Markets or other expressly supported brokerage account through MT5, cTrader or an authorised integration, Abutron may access permitted account details, balance, equity, positions, orders, execution reports and trading history. We use that information for the functionality you request, account displays, risk controls, security, technical diagnostics and, where applicable, authorised trading automation.
We may hold short-lived access credentials or tokens needed to maintain an authorised connection. We will not intentionally publish such secrets in public pages. You should use the relevant broker's revocation methods and notify us if access must be disconnected. Disconnection does not automatically erase historic financial, audit or compliance records we must lawfully retain.
Each broker is an independent service provider and has its own terms, policies and regulatory responsibilities. Your trade execution, deposits, withdrawals and brokerage account decisions are subject to the broker's arrangements. Abutron FX is a trading-technology platform; use of our software does not imply that Abutron itself holds customer broker funds.
10. Cookies, analytics, messaging and direct marketing
Our services may use strictly necessary cookies and browser storage for sessions, security, settings and navigation. Where enabled, PostHog or other analytics and observability tools may process technical, event and diagnostic information to help us improve reliability, measure usage and investigate errors. We should not place passwords, identity documents or account access tokens into analytics events.
Communications providers may handle your email address, phone number, message delivery status and the contents you send or receive for requested notifications or support. Depending on the enabled service, these providers may include email, SMS, WhatsApp, Telegram or voice communications processors. Recordings or transcripts, if any, require appropriate notice and applicable lawful grounds.
Marketing messages are distinct from essential billing, login and security notices. Where consent is needed, we will request it. You may unsubscribe from optional electronic marketing through an available unsubscribe mechanism or by emailing us. Referral or partner links may use attribution parameters and provider-side cookies, and the linked broker's privacy practices apply once you leave Abutron.
You can change browser cookie settings, but disabling essential storage may prevent authentication or other site functionality. Any optional tracking that requires consent should not operate before that consent is obtained.
12. Transfers and storage outside South Africa
Some technology, identity verification, cloud, messaging, broker and payment services may store or access personal information outside South Africa. Where information is transferred internationally, we assess POPIA section 72 and other applicable requirements, including contractual safeguards, recipient protection, consent or other lawful transfer grounds where relevant.
The locations and protections can vary by vendor and service. Request details about a specific processing activity through the contact address below. A cross-border transfer may be required to complete the feature you choose.
13. How long we keep information
We retain personal information only for as long as justified by its purpose, lawful instructions, contractual obligations, security requirements and applicable legal or regulatory retention periods. There is no single universal retention period for all categories. Our retention decisions consider the following:
| Records | Retention approach |
|---|---|
| Account profile and service records | While the customer relationship remains active and then for an appropriate limited period to handle closure, disputes and legal obligations. |
| Invoices, payments and tax records | For the period required by applicable tax, accounting and financial-records laws and any related dispute hold. |
| Verification records and biometrics | According to the lawful verification purpose, provider configuration, applicable legal requirements and consent terms. Different document, result and biometric records may have different schedules. |
| Broker connection tokens | Only while needed for active authorised connectivity, subject to revocation, security needs and controlled technical backups. |
| Security logs and support cases | For a proportionate investigation, support, fraud-detection or legal-evidence period based on the type and sensitivity of the record. |
| Optional marketing preferences | Until changed or withdrawn, with minimal records retained where needed to honour an opt-out. |
When retention is no longer justified, data is deleted, destroyed, de-identified or placed beyond routine use as appropriate. Records subject to legal holds, fraud investigations or mandatory retention cannot always be immediately erased. Backup deletion may follow a controlled rotation cycle.
14. Security and data incidents
We seek to apply appropriate technical and organisational safeguards proportionate to the risks, such as access restrictions, authentication controls, encryption in transit where supported, audit and monitoring, segmented production services, credential management, patching, backup controls and supplier due diligence. No electronic system is entirely risk-free, so we cannot guarantee absolute security.
Customers must protect passwords, use secure devices, avoid sending account credentials or identity documents through untrusted channels and notify us promptly of suspected compromise. If a security compromise affects personal information, we will investigate and notify the Information Regulator and affected data subjects where POPIA requires it, subject to applicable exceptions and lawful directions.
15. Your privacy rights under POPIA
Subject to lawful exceptions and prescribed procedures, you may:
- Be informed when your personal information is collected and where a relevant security compromise occurs.
- Ask whether we hold your personal information and request access to records or descriptions of that information.
- Request correction of inaccurate or misleading information and deletion or destruction of information we are no longer authorised to keep.
- Object to certain processing on reasonable grounds and withdraw consent where processing relies on consent.
- Opt out of applicable direct marketing and raise a complaint with the Information Regulator.
- Challenge qualifying decisions based solely on automated processing, where the protections in POPIA apply.
To make a request, email billing@abutronfx.online with the subject POPIA Data Subject Request, describe what you need, and include enough information for us to locate your account. We may require appropriate identity verification before disclosing or changing sensitive records. Do not send a copy of your identity document unless we request it through a secure channel.
We aim to respond within applicable legal timeframes. Access to personal information may be subject to PAIA procedures and prescribed fees where allowed. We will explain if a lawful exception or retention duty prevents full compliance with a request.
16. Automated checks, scoring and decisions
Abutron software may produce automated market analytics, confidence indicators, trade-related risk decisions, technical abuse flags and account eligibility results. Sumsub or other providers may produce automated identity matches and fraud-risk indicators. Such processing can affect access to a feature, the need for manual review or the outcome of an authorised technical workflow.
Where POPIA restrictions apply to decisions based solely on automated processing that have legal or substantial effects, we will honour applicable safeguards and requests for review or representations. Market analytics are not a guarantee of returns, and decisions by independent brokers remain governed by their systems and agreements.
17. Children, third-party websites and linked services
Abutron trading-related services are intended for adults and permitted business customers. We do not knowingly solicit registrations from children under 18. If we discover that a child's information was collected without an appropriate lawful basis or required authorisation, we will take appropriate steps.
Our website may link to broker websites, verification screens, application stores, banking or checkout pages. Those independent services control their own notices, security and personal-data handling. Check their privacy policies before supplying information directly to them.
18. Updates to this Privacy Policy
We may update this policy as our services, providers, laws or data practices change. The current version will be displayed at https://abutronfx.online/privacy-policy/ with its effective date. Where a change materially affects processing or requires additional consent, we will give a separate notice or obtain that consent as applicable. Previous versions may be requested from our privacy contact.
19. Privacy contact and regulator complaints
South Africa
Website: abutronfx.online
Privacy, Information Officer and PAIA enquiries: billing@abutronfx.online
A dedicated privacy address, named Information Officer and verified registered physical address should be added once confirmed.
Please contact us first to allow us to investigate or correct an issue. You also have the right to complain to South Africa's Information Regulator if you believe your personal information is being handled unlawfully.
Information Regulator (South Africa)
Website: inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Phone: +27 10 023 5200
This notice is provided to explain Abutron's data practices. It should be periodically reviewed by our designated Information Officer and legal adviser against actual service configurations, supplier contracts, processing registers and retention schedules.