Privacy Policy

Last updated: September 22, 2026

TBM Funded ("we", "us") is operated under Tbmfunded Ltd., an International Business Company incorporated in Saint Lucia (registration number 2026-00683, registered office Ground Floor, Rodney Court Building, Rodney Bay, Gros Islet, Saint Lucia), which is the data controller for personal data collected through tbmfunded.com. The platform itself is operated on Tbmfunded Ltd.'s behalf by TBM Capital L.L.C-FZ (Formation/Registration No. 2650044, Licence No. 2650044.01), which processes personal data as Tbmfunded Ltd.'s service provider under an intercompany services agreement — the controller/processor split follows the same contracting-entity/operator split as our Terms & Conditions. This Privacy Policy explains what data we collect, why, how it is used and stored, who it is shared with, and what rights you have over it.

This policy is designed to be broadly aligned with the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL) and the principles of the EU General Data Protection Regulation (GDPR) — the latter because we serve users from jurisdictions that require it.

1. Data We Collect

We collect the following categories of personal data:

Category	Specific data	How collected
Account data	Email address, password (hashed)	Provided at signup
Profile data	Display name (optional)	Provided during onboarding
Payment data	Payment/transaction reference IDs, and for crypto checkout, the wallet address used to pay. Card or bank details are not collected by us — handled by our payment processor(s).	Provided at checkout
Identity-verification data	Government-issued photo ID, proof of address (which also establishes country/residence), and a photo of you holding your ID	Collected once you pass Phase 2 of an evaluation — required before your Funded Account is issued, and well before any payout. See Section 5 of our Terms & Conditions.
Payout-destination data	Confirmation that the destination receiving a payout (e.g. a Rise account, or another method we make available) belongs to you, not a third party	Provided the first time you use a payout destination, and again only if it changes or our review flags a reason to re-verify
Usage data	Pages visited, features used, session timestamps, browser/device type, IP address	Automatically via platform analytics
Referral & marketing data	UTM parameters (source, medium, campaign), referral partner code, referral cookie	Automatically from URL parameters at landing
Communications	Support messages you send to us	Email / support contact form
Challenge & account data	Challenge tier purchased, trading performance metrics, funded account status, payout history	Generated by platform use

We do not collect government-issued ID, proof of address, or the ID photo above at checkout or during the evaluation phase — only once you pass Phase 2, as identity-verification data above, and before your Funded Account is issued. Payout-destination data is collected separately, only once you request a payout. See our Terms & Conditions for the full verification requirements.

2. How We Use Your Data

Account management: creating and maintaining your account, authentication, and password recovery.
Service delivery: processing challenge purchases, tracking evaluation progress, issuing funded accounts, processing payout requests.
Communications: sending transactional emails (account confirmation, password reset, payout confirmation). We may send marketing emails if you have opted in; you can opt out at any time.
Fraud prevention: detecting and preventing prohibited trading practices, account sharing, or abuse of the referral system.
Platform improvement: aggregated, anonymised analytics to understand how the platform is used and to improve it.
Legal and compliance: complying with applicable laws, responding to lawful requests, enforcing these Terms.
Marketing attribution: understanding which referral sources or campaigns bring users to TBM Funded so we can compensate partners appropriately and optimise marketing spend.

3. Legal Basis for Processing

Where GDPR or equivalent law applies, we rely on:

Contract performance — processing necessary to fulfil your challenge purchase and provide the funded account service.
Legitimate interests — fraud prevention, referral attribution, platform analytics, and security.
Legal obligation — retaining financial records as required by UAE commercial law.
Consent — marketing communications (you can withdraw consent at any time by unsubscribing).

4. Data Storage and Processing Partners

Your data is stored and processed with the help of third-party service providers acting on our behalf, including providers of database and authentication infrastructure, web hosting, payment processing, transactional email delivery, bot/fraud prevention, and product analytics. These providers may be located in the UAE, the United States, the EU, or other jurisdictions where our infrastructure operates. Each is bound by a data processing agreement or equivalent contractual protections, and none may use your data for their own independent purposes. We do not sell your personal data to third parties.

5. Cookies and Tracking

We use cookies and similar technologies for the following purposes:

Essential/session cookies — required for login and account security.
Bot/fraud-prevention tokens — set when you submit forms such as signup, login, or a partner application, to protect against automated abuse.
Referral tracking cookies — first-party cookies that credit the partner or campaign that referred you, so we can attribute signups correctly. Contain no personal data beyond a referral code.
Functional cookies — used to support features such as promotions or interactive elements on the site, and to prevent repeat participation within a set period.
Analytics cookies — used to measure product usage in aggregate. Only loaded if you accept analytics cookies in our cookie banner.

We do not use third-party advertising trackers (such as Facebook Pixel or Google Ads). Full detail on cookie categories and durations is in our Cookie Policy.

6. Data Retention

Account data: retained for the lifetime of your account and deleted within 30 days of a verified deletion request, subject to legal retention requirements.
Payment and transaction records: retained for a minimum of 7 years to comply with UAE commercial record-keeping requirements.
Challenge and performance data: retained for the duration of your account.
Support communications: retained for up to 2 years.
Analytics data: aggregated and anonymised; no personal retention limit.

7. Your Rights

Subject to applicable law, you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — request correction of inaccurate or incomplete data.
Erasure — request deletion of your personal data (subject to legal retention obligations).
Restriction — request that we restrict processing of your data in certain circumstances.
Portability — receive your account data in a machine-readable format.
Objection — object to processing based on legitimate interests.
Withdraw consent — withdraw consent to marketing communications at any time via the unsubscribe link in any email.
Not be subject to solely automated decisions — you have the right not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect on you (for example, an automated account restriction), except where necessary for our contract with you, permitted by law, or based on your explicit consent.
Lodge a complaint — if you believe we are processing your data unlawfully, you have the right to lodge a complaint with the applicable data protection authority in your jurisdiction, in addition to contacting us directly to resolve the issue.

To exercise any of these rights, email support@tbmfunded.com with the subject line "Data Request." We will respond within 30 days.

8. International Data Transfers

Because some of our infrastructure providers operate servers outside the UAE, your data may be transferred to and processed in other countries, including the United States and the EU. We ensure that such transfers are subject to appropriate safeguards — including standard contractual clauses or equivalent mechanisms — in line with applicable data protection law.

9. Security

We implement appropriate technical and organisational measures to protect your personal data: passwords are hashed and never stored in plain text, database access is protected by row-level security controls, API endpoints require authenticated sessions, and payment processing is handled entirely by our certified payment processor(s). No system is 100% secure. If you believe your account has been compromised, contact us immediately.

10. Children's Privacy

TBM Funded is not directed at individuals under 18. We do not knowingly collect personal data from minors. If we become aware that we have done so, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes are effective upon posting. We will notify registered users of material changes by email.

12. Contact and Data Requests

For privacy enquiries or to exercise your data rights, contact: support@tbmfunded.com

TBM Funded is operated under Tbmfunded Ltd. (Saint Lucia IBC No. 2026-00683) · platform operated by TBM Capital L.L.C-FZ · Formation/Registration No. 2650044 · Licence No. 2650044.01

Privacy Policy.