Privacy Policy

Dalvox Global Systems, S.L.U. ("Dalvox Capital", "we", "us", "our") is committed to protecting the privacy of the personal data it obtains from you, including the information collected during your navigation of this website and when purchasing or using our products and services.

Please read this Privacy Policy carefully before purchasing our products or using our services. By using the website or purchasing a product, you confirm that you have read and understood this Privacy Policy.

1. Data Controller

The controller responsible for processing your personal data is:

• Company name: Dalvox Global Systems, S.L.U.
• Tax/VAT ID (NIF): B93924678
• Registered address: Calle Francisco Silvela 110, Planta 2, 28002, Madrid, Spain
• Contact email: contact@dalvoxcapital.com
• Website: dalvoxcapital.com
• Registration details: company registered in the Commercial Registry (Registro Mercantil) of Madrid, Sheet M-894886, IRUS 1000478036885 (registered by electronic means through a personal folio, with no volume or paper folio).

Dalvox Capital acts as the data controller for the data collected through the website, the contact form, and the purchase of our products. This means it is the party that determines the purposes and means of processing your personal data.

Dalvox is not required to appoint a Data Protection Officer under Article 37 GDPR and Article 34 LOPDGDD, as it is not a public authority or body, its core activities do not consist of processing that requires regular and systematic monitoring of data subjects on a large scale, and it does not process special categories of data or data relating to criminal convictions and offences on a large scale. Nonetheless, for any matter relating to the processing of your personal data you may contact privacy@dalvoxcapital.com.

2. Commitment and Applicable Law

Dalvox Capital undertakes to process your personal data solely in accordance with this Privacy Policy and in compliance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").
• Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights ("LOPDGDD").

3. What Data We Collect

When you use the contact form or purchase a product, we may collect the following categories of personal data:

• Identification and contact data: full legal name, email address, and country of residence.
• Trading account number: when you activate a license, we store the trading account number you choose to bind to that license. This is necessary to enforce our "one trading account per license" rule. We do not collect your broker login credentials or passwords, or the balance or trade history of your account, except what you choose to send us for support (see the next item).
• Data you send us for support or for a claim: if you write to us about a problem with the Software or report a lack of conformity, we process what you choose to send us —for example, screenshots of your account details or of the symbol specification, MetaTrader 5 logs or your trade history— to handle your request, to establish whether the lack of conformity exists and what causes it, and to handle or defend any claims arising from it. We will never ask you for passwords or for access to your computer or your account.
• License-enforcement identifiers: when the software validates your license with our servers, it transmits your trading account number and technical identifiers of the device from which it runs; it does not transmit your files or their contents. The software reads these identifiers on your device without asking for your consent because doing so is strictly necessary to provide the service you have requested: checking your license each time the software connects to our servers. Some of these identifiers are stored pseudonymised, that is, replaced by a code calculated with a key, and remain personal data. We use these strictly to enforce the one-account license, to detect license sharing or transfer, and to prevent, investigate and act on fraud or abuse — including linking and blocking accounts or identities that share these identifiers. We also use the time of the software's last connection, together with the trading account number and the product, to alert you by email if it stops connecting while your subscription is active (see Section 4). We do not use your IP address or device fingerprint for this.
• Identifier history: we keep a dated log of the technical and account identifiers that have been associated with your customer record over time. We keep it so that changing one of them does not by itself break the link we need in order to enforce the one-account licence rule and to detect the use of multiple identities to circumvent it. This log is kept for every customer, not only for blocked ones. Some of these identifiers are stored pseudonymised and some as they are, according to what the purpose requires; the field-by-field detail is set out in our record of processing activities, available to the supervisory authority, and is not published here, because listing which identifiers allow a circumvention to be detected would precisely make it easier to circumvent them.
• Technical, usage and attribution data (collected automatically): your IP address, browser and device information (user-agent), the pages you visit and duration of visit, and marketing-attribution data such as the referring URL and campaign parameters (UTM source, medium, campaign, term, and content). This data is described further in the Cookies section.

IP address at the time of payment: when you start a purchase we automatically check which country you are connecting from, whether your connection comes from a VPN, the Tor network or a data centre, and what fraud risk it presents. Part of this check is performed by our own server without sending your address to anyone; for the rest, we send your IP address to a specialised external provider, which acts as a data processor (see Section 5) and returns that classification and a fraud risk score to us. We keep your IP address together with the result of the check for a maximum of 24 hours —solely so as not to repeat it if you reload the page— and, once that period has passed, it is deleted automatically. The external provider may retain the query in accordance with its own policy (a maximum of approximately one year). If the result prevents you from continuing, we tell you on screen together with how to contact us.

• Consent records: we keep a record of the declarations and consents you tick before paying, as proof of consent required by law.

Some of this data is mandatory in order to enter into the contract: without your name, your email address and your country we cannot process the purchase; and without the trading account number we cannot activate the license.

We use the technical and attribution data to operate and secure the website, to understand how buyers find us, and to keep a record of when a purchase or activation was made (which also helps us prevent fraud and abuse of our licensing system).

Note: We do not collect more data than is necessary for the purposes described in Section 4. We do not request or store your broker credentials or any banking or card details; payment is handled entirely through our payment provider (see Section 5).

Our products and the associated data processing are not directed at minors. We do not knowingly collect data from minors; if we detect that we have received information from a minor without the legally required authorization, we will delete it immediately.

4. Purposes and Legal Basis for Processing

Automated decisions in licence enforcement. Some licence-enforcement and security decisions are, however, taken automatically, with no human intervention at the moment they take effect, and others are proposed by the system and confirmed by a person. In plain terms:

• if a licence key is used from a trading account or device that is already blocked, that validation is rejected instantly and the software stops working on that account or device; the key itself is only blocked if a member of our team confirms it, except where a licence is activated for the first time on a trading account already blocked with the same broker: in that case its holder is blocked at that very moment, with all their licences;
• if a customer record is created or updated and it shares with a blocked one the trading account, the email address or a technical identifier of the device, blocking it is proposed, and a member of our team confirms it;
• if a single IP address requests many non-existent pages or addresses typical of cyberattacks within a short time, or accumulates failed access attempts with invalid passwords or licence keys, that IP address is temporarily blocked from this website. A website block of this kind never takes away software you have already paid for: licence validation is deliberately exempt from IP blocks.
• if the connection from which payment is attempted does not come from the European Union, or comes from the Tor network, a data centre or an active VPN, or its fraud risk score is 90 or more out of 100, payment is not enabled. This check is carried out before any contract exists and never affects software you have already purchased.
• if several payments from the same connection are declined within a short time, payment from that connection is paused for twenty-four (24) hours;
• if, despite all this, a purchase is completed with a billing address outside the European Union, it is voided and refunded, and no new purchases are accepted with that email address for thirty (30) days.

The possible consequence for you is the loss of access to the software and/or to this website. We do not use special categories of data (Art. 9 GDPR) for these decisions, and we do not disclose the specific technical parameters of our detection systems, because doing so would defeat their purpose.

Legal basis. For the automatic rejection of the validation described in the first case, and for the immediate block in its exception, we rely on Article 22(2)(a) GDPR: they are necessary to perform the licence contract. Licences are validated automatically, machine to machine, at a rate and speed that cannot in practice be reviewed case by case before the decision takes effect, and no less intrusive means would keep the one-account rule effective. The automatic IP block is different in kind: it protects a public website against scanning and abuse, it applies to visitors with whom we have no contract, and it never affects a product you have purchased. For that one we rely on our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR). The same approach applies to the connection check at the time of payment, to the pause after declined payments and to the block based on the billing address: it acts before any contract exists, it does not withdraw any product you have purchased, and it is resolved by writing to us. Here too we rely on our legitimate interest (Art. 6(1)(f) GDPR) in selling only where we are able to and in preventing payment fraud.

Your safeguards. Where an automated decision affects your licence, you have the right under Article 22(3) GDPR to obtain human intervention, to express your point of view, to receive the reasons for the decision, and to contest it. Write to support@dalvoxcapital.com. A member of our team — not an automated system — will look at your case and reply within fifteen (15) days, giving you the reasons for the decision, and we will lift the block if we conclude it was not justified. The same route is open to you if an IP block is stopping you from reaching this website, or if a connection check prevents you from completing a purchase.

5. Sharing of Data with Third Parties and International Transfers

In order to provide our services, we may share your data with the following third parties, acting as data processors or as independent controllers:

• Payment provider (Stripe): payment is made in Stripe's payment form, which appears on our payment page. The sale and the payment are handled, as merchant of record, by Sold through Link, LLC, a Stripe subsidiary that appears as “Link” in its emails and invoices. It processes, in accordance with its own privacy policy, the data you enter in that form (payment method, name, billing address and, where applicable, your company's tax details) and the technical data your browser sends it when loading the form. We send it your email address, the IP address from which you make the purchase, the plan chosen, a reference to your acceptance, and your language; afterwards, instructions concerning your subscription and payments (cancellation, resumption, or refund) and, if you dispute a charge, the evidence of your purchase. Once the payment is made, Stripe sends us your name, your email address, your billing address with its country, and the payment details (amount, taxes, and subscription reference), which we use to deliver your license, manage your account, and perform the contract. Our contract is with Stripe Payments Europe, Limited (Ireland). The data may be transferred to Stripe, LLC, in the United States; that transfer is based on the EU-U.S. Data Privacy Framework, under which Stripe, LLC is certified, and, failing that, on the European Commission's Standard Contractual Clauses incorporated into that contract.
• Web hosting provider (Hostinger): the site is hosted and form data is securely stored on infrastructure provided by Hostinger.
• Email provider (Hostinger): for sending transactional and, subject to consent, commercial communications.
• Website security and delivery provider (Cloudflare): all visits to the site pass through Cloudflare's network, which protects it against attacks and malicious traffic; to do so, it processes the IP address and the technical data of the connection. It acts as a data processor. It is a United States entity (Cloudflare, Inc.); the transfer relies on the EU-U.S. Data Privacy Framework, under which it is certified, and on the European Commission's Standard Contractual Clauses.
• Backup provider (Backblaze): so that we can recover our systems after an attack or a serious failure, we keep in Backblaze an encrypted copy of our database and of our files, in its European Union region (Amsterdam data centre, Netherlands). The copy is encrypted on our own server before it is sent, and only we hold the keys to decrypt it, so Backblaze cannot read its content. It acts as a data processor, with the contract required by Article 28 of the GDPR incorporated into its terms of service. It is a United States entity (Backblaze, Inc.); the transfer relies on the EU-U.S. Data Privacy Framework, under which it is certified, and on the European Commission's Standard Contractual Clauses incorporated into that contract.
• IP address verification provider (IPQualityScore): at the time of payment, and only where the local check has not already resolved the case, we send it the IP address of the connection so that it can tell us whether it corresponds to an active VPN or the Tor network and what fraud risk it presents. It acts as a data processor, with the contract required by Article 28 of the GDPR incorporated into its terms of service. Those terms also allow it to use the queries to improve its detection models; in that use it acts on its own account. It is a United States entity (IPQualityScore, LLC); the transfer relies on the European Commission's Standard Contractual Clauses. It retains the query in accordance with its policy (a maximum of approximately one year).
• Web analytics provider (Google): only if you accept analytics cookies, we use Google Analytics 4 to measure how the site is used. Google Ireland Limited acts as a data processor under the Google Ads Data Processing Terms and receives a browser identifier, the pages you visit, and technical data about your device and your connection. Google Analytics 4 does not record or store IP addresses. The data may be transferred to Google LLC, in the United States; that transfer relies on the EU-U.S. Data Privacy Framework, under which Google LLC is certified. You may withdraw your consent at any time from the cookie icon on every page; we will then stop measuring your visit and delete the analytics cookies.
• Public or judicial authorities, where there is a legal obligation to disclose the data.

International transfers: some of these providers are located in the United States. Each transfer is based on the safeguard indicated above for that provider: the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. You may request further information about these safeguards, or a copy of them, through our contact email.

We do not sell or transfer your personal data to third parties for their own commercial purposes.

6. How Long We Keep Your Data

We keep your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Customers (purchases and licenses): kept for the duration of the contractual relationship. Once it ends, the data stops being used and is blocked for the limitation period of actions that may arise from the contract — five (5) years, Article 1964.2 of the Civil Code — after which it is deleted. This period should not be confused with that for accounting documentation, explained in the next point, which responds to a different rule.
• Billing and payment records: the data supporting each transaction — billing country, payment references and amounts, taxes applied, and refund records including the reason for each refund — is kept for 6 years from the last accounting entry, as required by Article 30 of the Spanish Commercial Code; the four (4)-year tax limitation period of Article 66 of the General Tax Law falls within that term. Because this retention fulfills a legal obligation (Art. 6.1.c GDPR), it applies even if you request erasure of your other personal data; during the retention period this data is kept blocked and used solely to meet those legal obligations.
• Marketing consent: until you withdraw your consent.
• Identifier history: the dated log described in Section 3 is kept for as long as your customer record exists. When you exercise your right to erasure it is not destroyed immediately: it is blocked in accordance with Article 32 LOPDGDD, on the terms of the "Data blocking" point that closes this section.
• License validation log: each check the software makes against our servers is recorded together with the trading account number, the license used, technical identifiers of the device, the response given, and its date. This is a technical security and audit log, not a commercial history. The technical identifiers of the device are deleted automatically after ninety (90) days. The trading account number, the license, the response, and the date are kept for the limitation period of actions arising from the contract — five (5) years, Article 1964.2 of the Spanish Civil Code — after which they are deleted automatically. When your customer record is erased, this log is deleted along with it.
• Payment acceptance log: the IP address from which you accepted the Terms before paying is used only to pause payments from a connection that accumulates declined payments, and is deleted after twenty-five (25) hours; the rest of the log follows the period for customer data. If you do not complete the payment, the whole log is deleted after thirty (30) days.
• Messages and correspondence: if you have bought any of our products, the messages you send us through the contact form or by email are kept for six (6) years from the close of the financial year of your last accounting entry, in accordance with Article 30 of the Spanish Commercial Code, and are blocked from the end of your contract; if you have not made a purchase, for one (1) year from the last message in the conversation. The IP address from which you send the form is deleted after one (1) hour.
• Website security log: visits to non-existent pages that we record to detect scanning are deleted after fourteen (14) days. The IP address that we block automatically is deleted ninety (90) days after its block ends; no block of this kind lasts more than ninety (90) days.
• Fraud-prevention / blocking data: where an account or identity has been blocked for breach of our Terms, the minimum identifiers strictly necessary to keep that block effective are retained for as long as it remains necessary — even after deletion of the rest of your data — on the basis of our legitimate interest in preventing its circumvention. There is no fixed end date, because a block that expires on a calendar can simply be waited out; instead we review, at least every five (5) years, whether each block is still necessary, and delete the identifiers of any that is not. The detail of which identifiers are retained in each case is set out in our record of processing activities, available to the supervisory authority.
• Sanctions list screening: for this check we do not store your name; we obtain it from our payment provider at each charge and whenever the lists change. If your name matches that of a person on the lists, your purchase is put on hold and we will ask you for your date of birth, your nationality and, if necessary, a copy of your identity document in which only those details are visible; we will delete them when the check is complete. If it is established that it is not you, we keep for five (5) years an encrypted fingerprint of your name and your email address, which does not allow them to be read, so as not to put your purchases on hold again. If the match is confirmed, we keep the data for as long as the competent authorities require.
• Data blocking (Article 32 LOPDGDD): when we rectify or erase your data, whether at your request or on our own initiative, we do not destroy it immediately. Blocking means identifying and reserving your data, with technical and organizational measures that prevent any processing — including merely viewing it — except to make it available to judges and courts, the Public Prosecutor's Office, or the competent Public Administrations, in particular the data protection authorities, for the enforcement of any liabilities arising from the processing. The data remains blocked for the limitation period of those liabilities and, once it has elapsed, is deleted. This blocking applies to every customer, whether or not their account has been blocked, and does not enable any commercial or operational use of the data: only its availability to the aforementioned authorities.

7. Your Rights

Under applicable law, you may exercise the following rights:

• Access: find out what data we hold about you and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data when it is no longer necessary.
• Objection: object to certain processing activities.
• Restriction: request that we restrict processing in certain circumstances.
• Portability: receive your data in a structured, commonly used format, or request its transmission to another controller.
• Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out beforehand.
• Human intervention in automated decisions: where a block has been applied automatically (see Section 4), obtain human review of that decision, express your point of view, and contest it.

You may exercise these rights by writing to support@dalvoxcapital.com, indicating the right you wish to exercise. We may ask you to verify your identity.

Limit to the right of erasure: the right to erasure is not absolute, and exercising it does not mean your data is destroyed immediately. Under Article 32 LOPDGDD, when we erase data we are required to block it: blocking means identifying and reserving your data, with technical and organizational measures that prevent any processing — including merely viewing it — except to make it available to judges and courts, the Public Prosecutor's Office, or the competent Public Administrations, in particular the data protection authorities, for the enforcement of any liabilities arising from the processing. Once the limitation period of those liabilities has elapsed, the data is deleted. In addition, and by way of exception to the foregoing: (i) where we have blocked an account or identity for breach of our Terms of Use, we will keep active the minimum identifiers strictly necessary to keep that block effective, as described in Section 6, on the basis of our legitimate interest; and (ii) billing and payment records subject to the Article 30 Commercial Code period cannot be erased before that period expires, and they remain blocked and used solely to comply with tax and commercial obligations.

If you believe your rights have not been properly addressed, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), located at C/ Jorge Juan, 6, 28001 Madrid, or through its electronic headquarters at www.aepd.es, or with the data protection authority of the Member State of the European Union in which you have your habitual residence or place of work, or in which the alleged infringement took place.

8. Commercial Communications

The emails we send you today are strictly transactional —purchase confirmation, delivery of the product, and notices relating to your license— and do not require consent, as they are necessary to perform the contract. Should we send commercial communications by email in the future, we would do so only with your prior consent or, where the law permits, addressed to those who have already purchased a similar product, in accordance with Article 21 of Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE). In any case, every message will include a simple, free means to object, and you may withdraw your consent at any time by writing to support@dalvoxcapital.com.

9. Cookies and Local Storage

The use of cookies and local storage on this site is described in a separate document: our Cookie Policy, accessible from the page footer and from the cookie banner itself. There you will find what they are, which ones we use —first-party and third-party—, what each is for, how long they last, and how to accept, reject or delete them. That policy forms part of this Privacy Policy for all purposes.

10. Links to Third Parties

This site may contain links to other websites. This Privacy Policy does not apply to those sites. We recommend reading the privacy policies of any third-party site you visit. We accept no responsibility for the privacy practices of external sites.

11. Security and Data Breach Notification

We apply appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or alteration. These measures include encryption of data in transit, authentication mechanisms, and access restricted only to personnel who need it. In addition, we keep encrypted backups of your data and of the accounting supporting documents outside the hosting provider, so that we can recover them if we suffered an attack or a serious failure: a copy that is updated every minute if there are changes, kept in Backblaze (see Section 5). The backups are encrypted on our server before they leave it. Each backup that reaches Backblaze is locked for thirty (30) days: during that time no one can alter or delete it, not even us. Anything that is modified or erased in our systems remains in these backups for a maximum of thirty (30) days and then disappears from them; therefore, if you request erasure of your data, it may remain in the backups for up to thirty (30) days. If a backup had to be restored, the data of anyone who requested erasure is erased again before the backup is used. Separately, once a month we keep only the billing and payment records, for the period stated for them in Section 6.

Data breach notification. If, despite these measures, a personal data breach occurs (unauthorized access to, or loss, alteration, or disclosure of, personal data), we will act in accordance with Articles 33 and 34 GDPR:

• We will document the breach internally and assess the risk to those affected.
• Unless the breach is unlikely to result in a risk to your rights and freedoms, we will notify the Spanish Data Protection Agency (AEPD) without undue delay and, where feasible, within 72 hours of becoming aware of it.
• If the breach is likely to result in a high risk to your rights and freedoms, we will also inform you directly and without undue delay, by email to the address we hold on file, describing in clear language the nature of the breach, its likely consequences, the measures taken or proposed to address it, and a contact point for further information.
• Where the nature of the incident so warrants, in addition to notifying the Spanish Data Protection Agency (AEPD) where applicable, we will report the incident to INCIBE-CERT as the reference response team, recording that communication in our internal incident log.

12. Changes to This Policy

We may update this Privacy Policy when necessary. We will publish the updated version on this website, indicating the date of last update. We recommend reviewing it periodically.