1.1. Data processing means collection, recording, arrangement, storage, alteration, disclosing, consultation, extraction, use, transmission, cross-use, transferring or granting access to third parties, interconnecting, closure, deletion or destruction of data, or several of the aforementioned operations, regardless of the manner in which they are performed or the means used.

1.2. The FX brokerage Firm shall compile a list and documentation of means used in data processing and shall keep records of data processing. The list of means used in data processing shall include the name, type and number of the equipment and the name of the manufacturer of the equipment; the name and number of the licence of the software used and the name of the software manufacturer; the location of the documentation of the software used.

1.3. Persons engaged in the processing of data shall process data only for authorised purposes under the established conditions and according to the instructions and orders received, and they shall maintain the confidentiality of data which has become known to them in the course of performance of their duties and which are not intended for public use. Such confidentiality requirement continues after termination of the employment or service relationship with the FX Firm.

1.4. Unauthorised processing of data (including recording, alteration, deletion, reading, copying, (transmission), unauthorised transportation of records and any other unauthorised use of data (not prescribed by official duties) shall be prohibited.

1.5. Adequate security measures, including encryption of data if necessary, shall be implemented upon transmission of data by means of data communication equipment or in the transport of records.

1.6. Every user of database shall be issued personal means of authentication, enabling them to use the database. The access password for electronic databases shall be changed at least once a quarter. The use of any means of automatic entry of passwords shall be prohibited. A user of the data processing system shall not have access to data, which are not required for authorised data processing and the performance of duties of that particular user.

1.7. The FX brokerage Firm shall implement adequate and sufficient measures to ensure that every data processing operation leaves a trace, which would afterwards enable identification of the person who performed the operation, the nature and time of the operation and any other relevant facts, including when, by whom and which data were recorded, altered or deleted, or when, by whom and which data in the data processing system were accessed, as well as information on any transmissions of data. A possibility for restoring the content of data before modifications shall be available when any modifications are made in data or documents.

1.8. The manager or employee of the FX brokerage Firm shall rely on justified expectations that data submitted are correct. The manager or employee of the Investment Firm shall, from time to time, verify the accuracy of data in the database(s) by requesting the person submitting data to check the data and, if necessary, make corrections or confirm the accuracy of data.

1.9. Any incomplete or incorrect data known to the manager or an employee of the Investment Firm shall be closed and any necessary measures shall be taken promptly to supplement and correct the data in question. Upon a request of a data subject, the manager or an employee of the Investment Firm shall correct any incorrect data on the data subject in the database if the data subject notifies the manager or employee of the Investment Firm of the inaccuracy of the data on the data subject and submits correct data; the incorrect data shall be stored with the correct data and with a note indicating in which period the incorrect data were used.

1.10. If the accuracy of data is in dispute, the data in questions shall be closed until confirmation of accuracy of the data or determination of correct data. Third persons who provided or received the data shall be promptly notified of any corrections made in data if it is technically feasible and does not lead to disproportionate expenses.

1.11. Automatic decisions of the data processing system, without participation of the data subject, shall be permitted only on the conditions and pursuant to procedures specified by law.