Privacy Policy
Effective and last updated: July 22, 2026
Nordfunded provides simulated trading evaluation services. A challenge fee is payment for an evaluation service. It is not a deposit, investment or customer trading capital.
This Privacy Policy explains how SIA NordF, trading as Nordfunded, collects and uses personal data when you visit nordfunded.com, create or use an account at trader.nordfunded.com, purchase a simulated challenge, complete verification, interact with simulated trading tools, request a contractual payout, contact support or otherwise use our services.
This policy should be read together with our Terms of Use and Cookie Policy.
1. Data controller
The data controller is SIA NordF, trading as Nordfunded, registration number 50203736551, registered address Vesetas iela 24-45, Riga, LV-1013, Latvia.
Privacy requests and questions can be sent to [email protected]. General support is available at [email protected].
2. Our service and why trading data is processed
Nordfunded provides account registration, purchase and administration of simulated trading challenges, monitoring of simulated performance and rule compliance, eligibility assessment for contractual funded stages and payouts, customer support, security and fraud prevention.
During a challenge, orders, positions and performance are simulated. We analyse this information because the service requires us to calculate balances, profit and loss, profit targets, daily loss, maximum drawdown and compliance with published rules. Any later funded arrangement is governed by the applicable trader agreement and information provided at that stage.
3. Personal data we collect
Account and identity data
- Name, email address, country, date of birth and profile information.
- Authentication records, account identifier, password reset and email verification status.
- Profile image where you choose to upload one.
Purchase and challenge data
- Challenge type, account size, purchase date, price, promotion and account identifier.
- Affiliate or referral code, attribution and related conversion information.
- Payment status, invoice or order reference and provider transaction reference. Nordfunded does not receive your private crypto keys.
Simulated trading and rule data
- Simulated orders, pending orders, positions, instruments, direction, leverage or margin information, entry and exit prices and timestamps.
- Balance, equity, realised and unrealised profit and loss, daily statistics, profit percentage and performance history.
- Profit target, daily loss, maximum drawdown, rule breach, challenge status and retry or eligibility records.
- Signals of potentially prohibited strategies, unusual behaviour, shared access, duplicate accounts or other platform abuse.
Verification data
Where identity verification is required for account or payout protection, we may collect your full name, date of birth, country, front and back images of an identity document, a selfie, submission date, verification status and rejection reason. We do not state that every identity check is required by anti-money laundering law. The legal basis depends on the reason for the specific check.
Payout and wallet data
- Payout amount, profit share, request date, status and decision history.
- Selected blockchain network, public wallet address and blockchain transaction identifier.
- Information used to confirm wallet formatting, payout delivery and possible fraud or account compromise.
Device, security and usage data
- IP address, browser, operating system, device information, language, login time and trusted-device status.
- Security logs, failed login or verification attempts, session records and technical error information.
- Website pages, clicks, referral source, cookie choices and analytics data where permitted.
Communications
We collect support messages, complaints, appeals, evidence you submit, email preferences and records of administrative or marketing messages sent to you.
4. Where the data comes from
Personal data may come from:
- You, when you register, purchase, trade in the simulated environment, complete verification, save a wallet or contact us.
- The Nordfunded platform, which generates challenge, trading, rule, payout and security records.
- Payment and crypto payment providers, which provide transaction status and references.
- Affiliate partners or referral links.
- Authentication, hosting, email, analytics, security and communication providers.
- Public blockchain records relating to a payment or payout wallet and transaction.
5. Purposes and legal bases
We do not use one legal basis for every activity. The principal purposes and legal bases are listed below.
| Purpose | Main data | Legal basis |
|---|---|---|
| Create and secure an account | Identity, contact, authentication, device and login data | Performance of a contract; legitimate interests in account security |
| Provide simulated challenge services | Challenge selection, simulated orders, positions, profit and loss, balances, risk metrics and rule compliance | Performance of a contract |
| Process challenge payments | Order, amount, payment status, transaction reference and limited account identifiers | Performance of a contract; legal obligations for accounting and tax records |
| Administer payouts | Eligibility records, payout amount, network, wallet address, transaction identifier and status | Performance of a contract; legitimate interests in payout security; legal obligations where applicable |
| Identity and payout verification | Name, date of birth, country, identity document images, selfie and verification outcome | Performance of a contract and legitimate interests in preventing fraud and protecting payouts. We rely on a legal obligation only where a specific law actually applies |
| Detect fraud, duplicate accounts and platform abuse | Account links, device and IP data, trading patterns, rule flags and security events | Legitimate interests in protecting users, the platform and contractual rules |
| Provide support and resolve appeals | Messages, evidence, account history, challenge logs and decision records | Performance of a contract; legitimate interests in resolving disputes and improving support |
| Send service and security messages | Name, email, account and event information | Performance of a contract; legitimate interests in service security |
| Send marketing | Email address, preferences and campaign engagement | Consent, or another lawful direct marketing basis where specifically permitted |
| Measure website use | Cookie identifiers, pages, clicks, device and session information | Consent for nonessential analytics cookies |
| Comply with law and defend claims | Relevant account, payment, trading, verification and communication records | Legal obligation; legitimate interests in establishing, exercising or defending legal claims |
Where we rely on legitimate interests, we consider the necessity of the processing, the impact on users and available safeguards. You may object to this processing as explained below.
6. Automated challenge and payout decisions
The platform automatically calculates simulated balance, equity, profit and loss, profit targets, daily loss and maximum drawdown. It may automatically close simulated positions, mark a challenge as passed or failed, issue a retry status, or flag payout eligibility when the published numerical conditions are met.
The main logic is a comparison between recorded account activity and the rules shown for the selected challenge. For example, a challenge can be marked failed when recorded daily loss or maximum drawdown exceeds the applicable limit. Security systems may also flag linked devices, duplicate accounts, unusual trading or payout activity for review.
These decisions may affect challenge access, funded-stage eligibility or the timing of a payout. You may request human review, provide additional information and challenge an incorrect decision by emailing [email protected]. We will review relevant rules, account records and system logs and communicate the outcome.
7. Crypto wallets and public blockchains
A wallet address and blockchain transaction can be personal data when linked to your Nordfunded account. We use wallet information to administer crypto payments or payouts, verify delivery, maintain records and investigate suspected fraud or account compromise.
- Public blockchain transactions may be visible worldwide and may not be altered or deleted.
- Nordfunded does not place your name, email address, identity document or other direct identifier on a public blockchain.
- Deleting your Nordfunded account may remove or separate our internal account link where legally possible, but it cannot erase a transaction already recorded on a public blockchain.
- Payment or payout providers may process wallet and transaction information under their own privacy terms.
8. Recipients and service providers
We do not sell personal data. We disclose only the information reasonably required for the service, security, legal compliance or a user-requested transaction. Material providers currently include:
Supabase
Account authentication, database services and secure file storage, including profile and identity verification files.
Vercel
Website and application hosting, content delivery, security and server logs.
Resend
Transactional emails, account notices, security codes and permitted marketing communications.
NOWPayments
Crypto challenge payments, payment status and transaction administration.
Google Analytics
Website analytics where the required cookie consent has been recorded.
Microsoft Clarity
Website interaction analytics, heatmaps and session replay where the required cookie consent has been recorded.
Trustpilot
Displaying reviews and enabling users to access Trustpilot services.
Telegram
Limited internal operational notifications to authorised Nordfunded administrators, such as registration, challenge, verification, purchase and payout events.
We may also disclose relevant data to accountants, auditors, lawyers, security specialists, insurers, courts, tax authorities, regulators and law enforcement where lawfully required. In a merger, financing, restructuring or sale, relevant data may be disclosed under confidentiality and data protection safeguards.
Some providers act as processors under our instructions. Others, including certain payment, analytics, review or communication services, may act as independent controllers for their own legal, security or service purposes. Their privacy notices explain that processing.
9. International transfers
Some providers may process data outside Latvia or the European Economic Area, including in the United States and other locations described in their privacy notices. Where GDPR transfer restrictions apply, we use an adequacy decision, approved Standard Contractual Clauses or another lawful transfer mechanism. We also consider supplementary measures such as encryption, access limits and data minimisation.
You may request information about the safeguards relevant to your data by contacting [email protected]. Commercially sensitive or third-party information may be redacted from copies of contractual safeguards.
10. Retention
We retain data only for a defined business, contractual, security or legal purpose. The periods below are our general schedule. A shorter period may apply where data is no longer needed, and a longer period may apply for an active legal claim, investigation, legal hold or mandatory recordkeeping duty.
| Record category | General retention period |
|---|---|
| Account and profile data | While the account is active and generally up to 5 years after account closure or the last transaction. |
| Challenge and simulated trading records | Generally 5 years after the challenge closes, or longer where a dispute or legal claim remains active. |
| Payment, payout, invoice and accounting records | At least 5 years. Certain accounting registers or supporting records may be kept for up to 10 years where Latvian law requires it. |
| Identity verification records | For the verification and payout process and generally up to 5 years after the last payout or account closure. Raw images may be removed earlier when no longer needed for verification, fraud prevention or legal claims. |
| Wallet addresses and Nordfunded payout links | Generally 5 years with the related payout record. Public blockchain transactions may remain visible permanently. |
| Routine security and access logs | Generally up to 12 months. |
| Confirmed fraud, abuse and duplicate account records | Generally up to 3 years after the relevant incident or account closure, and longer if required for an active dispute. |
| Support messages and appeals | Generally 3 years after the matter is closed. |
| Marketing preferences | Until consent is withdrawn or the user unsubscribes. A minimal suppression record may be retained for up to 3 years to respect the opt-out. |
| Affiliate and referral records | Generally 5 years where needed for attribution, commission administration, accounting or dispute handling. |
| Backups | Deleted data may remain in protected backups for up to 90 days before routine overwrite, unless legal preservation is required. |
11. Data you must provide
An email address and account credentials are required to create an account. Purchase and transaction information is required to activate a paid challenge. Simulated trading records are required to assess performance and rule compliance. A wallet address is required for a crypto payout. Identity information and documents may be required before a payout or where reasonably necessary to protect the account or service.
If required information is not provided, we may be unable to create or secure an account, activate a challenge, verify eligibility, process a payment or payout, investigate an appeal or provide another requested service.
12. Your GDPR rights
Subject to the conditions and exceptions in applicable law, you may:
- Request access to your personal data and information about its processing.
- Request correction of inaccurate or incomplete data.
- Request deletion where there is no continuing lawful reason to retain the data.
- Request restriction of processing in qualifying circumstances.
- Receive certain data in a structured, commonly used and machine-readable format.
- Object to processing based on legitimate interests and object at any time to direct marketing.
- Withdraw consent at any time without affecting processing that was lawful before withdrawal.
- Request human intervention, express your view and contest a qualifying automated decision.
- Lodge a complaint with a supervisory authority or seek a judicial remedy.
To exercise a right, email [email protected]. We may request proportionate information to verify your identity and protect the account. We normally respond within one month, subject to lawful extensions for complex or numerous requests.
The Latvian supervisory authority is the Data State Inspectorate, Datu valsts inspekcija. You can visit dvi.gov.lv or email [email protected].
13. Account deletion
You may request account deletion through the available account controls or by contacting [email protected]. We will delete or anonymise data that is no longer required. We may retain limited information for accounting, fraud prevention, dispute resolution, legal claims, security or another lawful obligation. Public blockchain transactions cannot be deleted by Nordfunded.
14. Cookies and analytics
The public website uses necessary technologies and may use optional analytics technologies. Our legal basis for nonessential analytics cookies is consent where required. The Cookie Policy identifies cookie categories, providers, purposes and durations and explains how to change your preferences.
An affiliate referral code may be stored in the nf_ref cookie for up to 30 days so a referral can be attributed if you later register or purchase. This information is used for attribution and affiliate administration.
15. Security
We use proportionate technical and organisational safeguards, including access controls, authentication, encrypted transport, restricted administrative access, logging, monitoring and provider security controls. No online system can guarantee absolute security. Keep account credentials and trusted devices secure and contact support promptly if you suspect unauthorised access.
16. Adults only
The services are intended only for people aged 18 or older. We do not knowingly provide accounts to children. Contact us if you believe a person under 18 has submitted personal data.
17. Changes to this policy
We may update this policy when our services, providers, data practices or legal obligations change. The current version and revision date will remain available on this page. Where a change materially affects users, we may also provide an account notice or email before or when the change takes effect.
18. Contact
SIA NordF, trading as Nordfunded
Registration number: 50203736551
Registered address: Vesetas iela 24-45, Riga, LV-1013, Latvia
Privacy: [email protected]
Support: [email protected]