RebelsFunding Legal & Compliance
Data Protection and Privacy Policy
This policy explains how RIFM, s.r.o. processes personal data in connection with the RebelsFunding website, Client Zone, RF-Trader, Evaluation and Competition services, orders, payments, customer support, KYC and RCF onboarding, marketing, affiliate activities and related services. It is intended to provide information required by Regulation (EU) 2016/679 (GDPR), Act No. 18/2018 Coll. on Personal Data Protection, as amended, and other applicable law. It should be read together with the service-specific documents linked at the end of this policy.
1. Controller and scope
1.1
The controller is RIFM, s.r.o., with its registered office at Landererova 8, Bratislava - Staré Mesto 811 09, Slovak Republic, Company ID 48 116 700, registered in the Commercial Register, Section Sro, Insert No. 166242/B.
1.2
You may contact RIFM regarding privacy questions or the exercise of your rights using the contact details stated at the end of this policy or through the contact page.
1.3
This policy applies to customers, registered users, traders, prospective RCF contractors, company representatives, affiliates, competition participants, website visitors, support contacts and other individuals whose personal data are processed in connection with RebelsFunding services.
1.4
Some services have additional privacy terms. In particular, separate documents may apply to Coach Rebel, Discord applications, payment providers, electronic-signature providers, identity-verification providers, affiliate services, social networks and other third-party services.
1.5
The services are intended only for persons aged 18 or older. RIFM does not knowingly offer the services to children.
2. Personal data we process
2.1
Identification and contact data: name, surname, date of birth, postal address, country of residence, email address, telephone number, username, account identifiers, preferred language and other profile information.
2.2
Order, billing and payment data: selected program and account size, price, currency, invoice data, company and tax information, transaction identifiers, payment status, partial payment-method information, refunds, chargebacks, discounts, Credits, Achievements and related records. Full payment-card details are normally processed directly by the relevant payment provider and are not stored by RIFM.
2.3
Service and simulated-trading data: RF-Trader and Client Zone accounts, instruments, orders, positions, volume, opening and closing times, holding period, profit or loss, equity, balance, drawdown, risk, consistency, account progression, rule checks, account-review results, Competition results and other data generated when using the services.
2.4
Technical, security and antifraud data: IP address, device type, operating system, browser, language, time zone, screen and technical parameters, network and internet-service information, login sessions, cookies, local-storage identifiers, device and browser identifiers, device or browser fingerprints, event logs, server records, account links, payment links, risk indicators and fraud scores.
2.5
Communication and support data: emails, live-chat messages, support tickets, social-media communications, attachments, complaints, requests, recordings or transcripts where used, and internal notes necessary to resolve the matter.
2.6
KYC, residency and RCF-onboarding data: identity-document data, verification-session results, Veriff report, technical verification data, sanctions, PEP, watchlist or adverse-media results where included in the configured process, Proof of Address, residential address, tax and invoicing information, signed contracts, signature status, audit trail and onboarding decisions.
2.7
Company and authorised-person data: company name, registration and tax numbers, registered office, public-register information, ownership and management details, relationship of the designated trader to the company, authority to act, beneficial-owner information where required and supporting company documents.
2.8
Marketing, affiliate and cookie data: marketing preferences, consent records, unsubscribe records, referral and affiliate identifiers, campaign source, advertising identifiers, website events, conversion data, interaction with emails and advertisements, and information collected through cookies and similar technologies.
2.9
Special-category data: RIFM does not generally request special-category data. Where the configured Veriff process uses biometric data for identity verification, Veriff may process facial images, liveness information or biometric measurements under the notice and legal basis presented in the verification flow and in accordance with applicable law.
3. Sources of personal data
3.1
We obtain data directly from you when you register, place an order, use the Client Zone or RF-Trader, communicate with support, participate in a Competition, complete KYC, provide documents, sign a contract, subscribe to marketing or otherwise interact with us.
3.2
We generate or collect data automatically when you use our website, accounts, platform, emails, advertising, security systems and related services.
3.3
We may receive data from payment and payout providers, Veriff, Xodo Sign by Apryse, Affilbox, CookieYes, email, analytics, advertising, hosting, cloud, support, trading-technology and other providers used for the relevant service.
3.4
For company, sanctions, fraud and compliance checks, we may use public commercial registers, official databases, sanctions and watchlist sources, publicly available websites and other reliable sources.
3.5
Where you register for a jointly organised event, campaign or service, we may receive data from or share data with the co-organiser or partner identified in the relevant form or notice.
4. Purposes and legal bases
1
Registration, account administration and service deliveryWe process data to create and manage your profile, provide the Client Zone, RF-Trader, Evaluation, Competition and related services, and administer the contractual relationship. The main legal basis is performance of a contract or steps taken at your request before entering into a contract.
2
Orders, payments, refunds, invoicing and taxesWe process data to accept and review orders, process payments, issue invoices, administer refunds, Credits and chargebacks, and meet accounting and tax obligations. The legal bases are contract performance, legal obligations and our legitimate interest in protecting payment claims.
3
Evaluation, rule enforcement and account reviewWe process simulated-trading and technical data to calculate results, monitor drawdown and program rules, investigate prohibited conduct, review progression and protect the integrity of the service. The legal bases are contract performance and our legitimate interests.
4
Customer support, complaints and communicationWe process communication and account data to answer questions, investigate technical issues, handle complaints and maintain service quality. The legal bases are contract performance and our legitimate interest in providing effective support.
5
Security, fraud prevention and unique-user recognitionWe use technical identifiers, fingerprints, account links, payment records, activity patterns and risk indicators to protect accounts, identify duplicate or connected profiles, detect account sharing, payment fraud, chargeback abuse, identity misuse, promotion circumvention and other misuse. The legal bases are contract performance and our legitimate interests in security, fraud prevention and enforcement of the rules.
6
KYC, residency, company verification and RCF onboardingWe process verification and contract data to assess identity, eligibility, residence, company authority and suitability for RCF cooperation. The legal bases are steps before entering into the RCF Account Contract, performance of that contract, legitimate interests and legal obligations where they apply. Biometric data, where used by Veriff, are processed under the additional condition presented in the verification flow and permitted by applicable law.
7
Coach Rebel and AI-assisted analyticsWe process selected simulated-trading data to provide requested educational feedback, operate the feature, protect it and improve the service. The legal bases are contract performance and, where applicable, our legitimate interests.
8
Analytics, testing and improvementWe use service data, aggregated statistics and technical information to understand usage, test changes, troubleshoot and improve performance. Essential operational analytics may rely on legitimate interests. Non-essential website analytics and advertising technologies rely on consent where required.
9
Marketing and affiliate administrationWe process contact, referral, conversion and preference data to administer affiliates, measure campaigns and send relevant communications. The legal basis is consent, contract performance or a permitted existing-customer marketing exception, depending on the context.
10
Legal claims, compliance and business protectionWe process and retain relevant records to comply with law, respond to authorities, establish facts, resolve disputes and establish, exercise or defend legal claims. The legal bases are legal obligations and legitimate interests.
Where processing is necessary for a contract or a required onboarding step, failure to provide the requested data may mean that we cannot create an account, accept an order, provide a service, complete KYC, activate an RCF account or pay a reward.
5. Service-specific processing
5.1 Client Zone, RF-Trader, Evaluation and Competition
RIFM processes account, simulated-trading, technical and performance data to operate the Client Zone and RF-Trader, calculate program metrics, display progress, provide Achievements and Credits, administer competitions, review compliance with the rules and resolve account-related disputes.
Platform, server, order, tick, price, equity, drawdown, audit and security records may be used to verify the course of trading, investigate technical incidents and assess whether a program condition or prohibited-practice rule was breached.
5.2 Identity verification through Veriff
RIFM uses Veriff as an external identity-verification provider. Depending on the configured workflow, Veriff may process data from an identity document, photographs of the document, selfie or video, liveness data, facial or biometric measurements, IP address, device and network data, technical session information, verification results and, where enabled, sanctions, PEP, watchlist or adverse-media data.
RIFM normally does not download or separately store the raw identity-document photographs, selfie or video captured during the Veriff session. Veriff processes and retains the session data under the contracted service configuration and its applicable privacy and retention terms. RIFM stores the verification result, generated PDF report and records required to document and review the onboarding decision.
A Veriff result may lead to approval, resubmission, a request for additional documents, manual review or rejection. The final decision on RCF activation, delay or refusal is made by RIFM and is not based solely on an automated Veriff output.
5.3 Xodo Sign, Proof of Address and contracts
After the required Veriff step, the RCF Account Contract package is provided through Xodo Sign by Apryse. The process may include contract data, electronic signatures, timestamps, IP address, signature status, audit trail, completion records and the Proof of Address uploaded with the contract.
RIFM manually reviews the Proof of Address, residence, contract data and, where applicable, company information. Xodo Sign provides the signature and document workflow but does not decide whether KYC is passed or an RCF account is activated.
Where RCF cooperation is approved, the signed contract and only the personal data necessary to conclude and administer that three-party contractual relationship may be made available to FRCSM, s.r.o., which is a party to the RCF Account Contract. FRCSM does not conduct the KYC process and does not receive raw Veriff session media as part of that process.
5.4 Company verification
For a company order, RIFM verifies the designated trader and may verify the company, management, ownership, beneficial ownership and the trader's authority using public registers, official sources and additional company documents. If reliable online verification is unavailable or insufficient, further registration, ownership or authorisation documents may be required.
5.5 Coach Rebel and external AI providers
When you use Coach Rebel or another AI-assisted analytical feature, RIFM may process selected simulated-trading data, such as an internal account identifier, instruments, trade times, position size, holding time, profit or loss, risk, drawdown, consistency and aggregated performance statistics.
Before data are sent to an external AI provider, including OpenAI or Anthropic where used, RIFM limits them to what is reasonably necessary and pseudonymises or de-identifies them to the extent reasonably possible. RIFM does not intentionally send your name, email address, postal address, payment data, identity documents, passwords or login credentials for this purpose.
Because RIFM may still be able to associate the analysed statistics with your account, the data are treated as personal data and not as fully anonymous data. AI output is not used as the sole basis for a legally binding decision concerning KYC, payout, eligibility, suspension or the contractual relationship.
5.6 Affiliate, campaign and conversion data
RIFM may use Affilbox and other affiliate, analytics and advertising systems to identify referral sources, attribute purchases, calculate commissions, prevent affiliate abuse and measure campaign performance. Depending on the service, these systems may use cookies, referral parameters, account or order identifiers, conversion events and technical data.
6. Device and browser fingerprints, unique-user recognition and fraud prevention
6.1
RIFM may create, receive and use device or browser fingerprints and other technical identifiers derived from device, browser, network, session and interaction characteristics.
6.2
These identifiers may be used to recognise the same or connected user, distinguish genuine users from duplicate or coordinated profiles and link relevant accounts, devices, orders, payments, promotions, affiliate activity and simulated-trading activity.
6.3
The purposes include account security, detection of account sharing, identity misuse, promotion and Free Trial circumvention, payment fraud, chargeback abuse, suspicious company relationships, coordinated prohibited trading and other conduct contrary to the contractual rules.
6.4
RIFM may combine these data with internal risk indicators, fraud scores and records from providers. The legal basis is performance of the contractual relationship and RIFM's legitimate interests in security, fraud prevention and protection of the service. Where a non-essential fingerprint or identifier is created for analytics or advertising through a technology requiring consent, it is used only after the required consent.
6.5
A fingerprint or risk score may trigger a warning, additional review, temporary restriction or request for documents. A final decision with significant contractual consequences is not made solely from a fingerprint without an appropriate review of the available circumstances.
7. Recipients, processors and other providers
RIFM uses external providers to operate and protect the services. The technologies and suppliers change over time, so the following list states the main providers and categories and is not exhaustive.
7.1
Payment, banking, crypto and payout services: Stripe, Solidgate, CoinGate, Coinbase, Kora, banks, card schemes, regional payment providers, crypto-payment providers, reward or contractor-payment providers and related fraud-prevention services.
7.2
Trading, hosting, infrastructure and security: FDCtech, Cloudflare, Websupport, Hostinger, OVH, HostAfrica and other platform, hosting, cloud, CDN, database, monitoring, backup, connectivity and cybersecurity providers.
7.3
Invoicing, email and communications: FAPI Business, SmartSelling or SmartEmailing, Mailgun, Discord and other invoicing, email-delivery, support, live-chat, community and communication providers.
7.4
Identity, documents and electronic signatures: Veriff, Xodo Sign by Apryse and other document, verification, signature and secure-file-workflow providers.
7.5
Affiliate, consent, analytics and advertising: Affilbox, CookieYes, Google services, Stape, server-side measurement providers, social-media platforms, advertising networks, conversion-measurement systems, marketing agencies and other analytics or campaign providers.
7.6
Artificial intelligence and analytical technologies: OpenAI, Anthropic and other providers identified in the applicable service-specific documentation.
7.7
Professional and legal recipients: IT administrators, accountants, auditors, lawyers, tax advisers, insurers, debt-collection providers, courts, law-enforcement bodies, regulators and other public authorities where access or disclosure is permitted or required.
7.8
Partners and co-organisers: identified event, campaign or business partners where you register for a jointly organised activity or where sharing is otherwise necessary and properly disclosed.
Depending on the service and legal context, a provider may act as RIFM's processor, subprocessor, recipient or independent controller. Independent controllers process data under their own privacy terms.
8. Cookies and similar technologies
8.1
RIFM uses cookies, local storage, pixels, tags, APIs, device identifiers, server-side measurement and similar technologies for website operation, authentication, security, preferences, analytics, affiliate attribution, conversion measurement and advertising.
8.2
CookieYes is used to display and record cookie choices. Strictly necessary technologies may operate without consent where permitted by law. Non-essential analytical, personalisation and advertising technologies are activated only after the required consent.
8.3
You may change or withdraw your cookie choices at any time. Detailed information is available in the Cookie Policy.
9. International transfers
9.1
Personal data may be processed in the European Economic Area and in other countries where RIFM's providers, their affiliates or subprocessors operate.
9.2
Where personal data are transferred outside the European Economic Area, RIFM or the relevant provider uses an applicable transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, another legally recognised safeguard or a permitted exception.
9.3
Additional contractual, technical and organisational safeguards may be used according to the nature of the service and destination. You may contact RIFM for further information about the safeguards relevant to your data.
10. Retention periods
RIFM does not use one identical retention period for every category of data. Records are kept only for as long as reasonably necessary for the relevant purpose, contractual administration, legal obligations, security, fraud prevention and legal claims.
10.1
Customer, order, payment, accounting and contractual records may be retained for up to 10 years after the relevant transaction, termination of the relationship or the end of the period required for accounting, tax, contractual or legal-claim purposes.
10.2
KYC reports, Proofs of Address, company documents, signed RCF contracts, signature audit trails, RCF decisions and related review records may be retained for up to 10 years where necessary to document the relationship, prevent fraud, resolve disputes and establish, exercise or defend legal claims.
10.3
Trading, account-review, platform, server and security records are retained for the period necessary to operate the service, investigate incidents, enforce the rules and protect legal claims. Records connected with a fraud investigation, chargeback, dispute or account breach may be retained for up to 10 years.
10.4
Raw Veriff session data are retained by Veriff under the contracted service configuration and Veriff's applicable retention terms. RIFM normally does not separately store the raw document, selfie or video media.
10.5
Cookie, analytics and advertising identifiers are retained according to the settings and lifespan stated in the CookieYes consent interface or by the relevant provider. These periods are generally shorter than contractual record retention.
10.6
Consent, objection and unsubscribe records may be retained for as long as necessary to demonstrate your choices, respect future suppression and comply with applicable law.
10.7
If a legal dispute, investigation, statutory hold or authority request is pending, relevant data may be kept until the matter is finally resolved, even if an ordinary period would otherwise expire.
11. Security and confidentiality
11.1
RIFM applies reasonable technical and organisational measures appropriate to the nature of the data and risk, including access restrictions, role-based permissions, secure transfer and storage where appropriate, logging, backups, confidentiality obligations and incident-response procedures.
11.2
Access to KYC reports, Proofs of Address, contracts and other sensitive onboarding records is limited to persons who need the data for their work, compliance, legal or support responsibilities.
11.3
RIFM selects and reviews providers according to the service and available contractual, privacy and security information. Providers may use approved subprocessors where permitted by their contracts.
11.4
No internet transmission, online platform or storage system can be guaranteed to be completely secure. You are responsible for protecting your login credentials, devices and communication channels and for notifying support promptly if you suspect unauthorised access.
12. Automated processing and human review
12.1
RIFM and its providers may use automated rules, risk indicators, fraud scores, device links, payment decisions, platform controls and verification results to detect risk, protect services and prioritise cases for review.
12.2
Automated systems may temporarily block a payment, restrict an action, flag an account or request additional verification. Where a decision has significant contractual consequences, RIFM reviews the available circumstances and does not rely solely on Coach Rebel, a fingerprint or an automated Veriff result as the final basis for RCF approval or refusal.
12.3
Where applicable law gives you rights concerning a decision based solely on automated processing, you may request information, human intervention, express your position and contest the decision using the contact details at the end of this policy.
13. Your rights
Subject to the conditions and exceptions in applicable law, you may have the following rights:
- the right to obtain information and access to your personal data;
- the right to correct inaccurate or incomplete data;
- the right to erasure where the legal conditions are met;
- the right to restriction of processing;
- the right to data portability for eligible processing;
- the right to object to processing based on legitimate interests;
- the unconditional right to object to direct marketing;
- the right to withdraw consent at any time, without affecting processing carried out before withdrawal;
- rights relating to qualifying automated decisions, including human intervention where applicable; and
- the right to lodge a complaint with a supervisory authority.
13.1
You may submit a request through the contact details at the end of this policy. To protect your data, RIFM may request reasonable information to verify your identity and locate the relevant records.
13.2
RIFM will respond without undue delay and generally within one month of receiving a valid request. The period may be extended where permitted by law, particularly for complex or multiple requests, and you will be informed where required.
13.3
Some rights are not absolute. RIFM may retain or continue processing data where necessary for a legal obligation, fraud prevention, freedom of expression, public interest, the establishment, exercise or defence of legal claims or another lawful exception.
13.4
If you believe your data are processed unlawfully, you may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic, or with another competent supervisory authority.
14. Marketing communications
14.1
RIFM may send service messages necessary for your account, order, security, support, contract or operational updates. These are not optional marketing communications.
14.2
Marketing messages are sent on the basis of consent or another basis permitted by law, such as a limited existing-customer exception for similar services where applicable.
14.3
You may unsubscribe or object to direct marketing at any time using the unsubscribe method in the message or the contact details at the end of this policy. RIFM may retain a limited suppression record to ensure that your objection continues to be respected.
15. Children
15.1
RebelsFunding services are not intended for persons under 18. If RIFM learns that a child has provided personal data or created an account contrary to the rules, it may restrict the account and delete or retain the data as required to resolve the matter and comply with law.
16. Changes and related documents
16.1
RIFM may update this policy to reflect changes in services, providers, technology, security practices, legal requirements or business operations. The current published version applies from the effective date stated above.
16.2
Where mandatory law requires individual notice or renewed consent for a specific change, RIFM will provide it to the required extent.
RIFM, s.r.o. / RebelsFunding
Landererova 8
Bratislava - Staré Mesto 811 09
Slovak Republic
Company ID: 48 116 700
Email: [email protected]
Landererova 8
Bratislava - Staré Mesto 811 09
Slovak Republic
Company ID: 48 116 700
Email: [email protected]
