Privacy Policy

1. Controller

The controller responsible for data processing within the meaning of the GDPR is:

PLACEHOLDER_COMPANY_NAME GmbH PLACEHOLDER_STREET PLACEHOLDER_PLZ_CITY Deutschland Email: info@wheeltrading.io

2. Purposes and Legal Bases of Processing

2.1 Account and contract handling

• Purpose: Registration, authentication, provision of platform

features, billing, customer support.

• Legal basis: Art. 6 (1) (b) GDPR (contract performance).

2.2 Payment and fraud prevention

• Purpose: Handling of recurring payments, refunds, abuse detection

(including trial abuse via device fingerprint).

• Legal basis: Art. 6 (1) (b) and (f) GDPR.

2.3 IBKR connection

• Purpose: The User voluntarily connects their own Interactive

Brokers account via the official Client Portal Gateway. WheelTrading.io reads only position, order and account balance data.

• Legal basis: Art. 6 (1) (b) GDPR (contract performance).

2.4 Notifications and emails

• Purpose: Critical account emails (password reset, trial expiry,

invoices), security notifications. Marketing emails only with express consent.

• Legal basis: Art. 6 (1) (b) GDPR (account emails); Art. 6 (1) (a)

GDPR (marketing, revocable at any time).

2.5 Security logs

• Purpose: Detection and defence against attacks, abuse attempts,

server errors. IP addresses are anonymised after 30 days.

• Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in IT

security).

2.6 Bookkeeping and statutory retention

• Purpose: Creation, delivery and retention of invoices, payment

records and bookkeeping data. Processing takes place in an internal bookkeeping system that we operate ourselves and that is available under the subdomain finance.wheeltrading.io. This system is separated from the trading system at database and network level and is exclusively accessible to the operator and to users explicitly authorised by the operator (e.g. the tax advisor with read-only access).

• Transferred data: debtor number, name, invoice address, email,

VAT identification number (where applicable), contract and invoice history, payment status and the customer reference token of our payment service provider. No trading, login, 2FA, password or payment card data is transferred to the bookkeeping system.

• Legal basis: Art. 6 (1) (b) GDPR (contract performance,

invoicing) and Art. 6 (1) (c) GDPR in conjunction with § 14 German VAT Act (UStG), § 147 German Fiscal Code (AO) and § 257 German Commercial Code (HGB) (statutory retention obligation).

• Recipient: The controller identified in section 1 itself (no

external third party). An external tax advisor commissioned by us may be granted read-only access within the scope of their mandate; a data processing agreement pursuant to Art. 28 GDPR is in place for this purpose.

2.7 Cancellation feedback (churn analysis)

• Purpose: When you cancel a paid subscription, you may voluntarily

provide a cancellation reason (from a predefined list) and an optional free-text comment. We use this information solely internally to understand cancellation reasons, improve our product and, where appropriate, make you a win-back offer. Providing it is not a precondition for cancellation, which remains effective at any time without any such information.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analysing

cancellation reasons and improving the product); the free-text entry is voluntary.

• Processing and data minimisation: The reason is stored as a coded

value; the immutable security audit log contains only this code and whether a comment was provided — not the free text. The operator's internal evaluation shows reasons in aggregate without personal identifiers; the list of voluntary comments is shown only to authorised administrators and without name, username or email. If you cancel via our payment provider's portal, any reason/comment provided there is stored in the same way.

• Deletion: When your account is deleted, the subscription record

including the free-text comment is removed in full. Within your right of access and data portability (Art. 15, 20 GDPR), your own cancellation feedback is included in the data export.

3. Categories of personal data

• Master data: email, username, encrypted password.
• Contract data: chosen plan, payment status, invoice history.
• Payment data: not stored by us — processed exclusively at the

PCI-DSS-certified provider Stripe. We only receive a token reference and metadata (card brand, last 4 digits).

• Usage data: login timestamps, audit log for security-relevant actions

(2FA, password change, account deletion).

• Broker data: positions, orders, account balance from IBKR (mirrored to

our database at the user's request to enable offline analysis).

4. Recipients and processors

We use the following processors (Art. 28 GDPR):

4a. Affiliate links (Lynx / financeAds)

Our website uses partner links to the broker Lynx B.V. Germany Branch, brokered via financeAds International GmbH, Rosenheimer Straße 141 h, 81671 Munich, Germany. Every placement is marked with an asterisk (*) and an advertising disclosure.

• Data processed: When a visitor clicks such a link, they leave

our site and are redirected directly to the Lynx or financeAds landing page. Any personal data collected there (IP address, click ID, cookies if any) is the responsibility of the partner and governed by their privacy policy.

• Legal basis for linking: Art. 6 (1) (f) GDPR (legitimate

interest in refinancing the platform through referral commission). You may object at any time under Art. 21 GDPR; the practical alternative is not to use the link and to open the broker account directly with the provider.

• No cookies on our site: WheelTrading itself does not set any

cookies or pixels in the context of affiliate linking. Tracking is performed server-side by financeAds after the redirect and is independent of your visit to our site.

• Purpose: Attribution of referrals for commission settlement

between WheelTrading and financeAds.

5. Storage period

• Account master data: up to 30 days after account deletion.
• Contract and invoice data: 10 years (§ 147 AO / § 257 HGB).
• Access logs: 30 days, then anonymised.
• Withdrawal declarations: 10 years (§ 147 AO).
• Cancellation feedback (reason/comment): stored with the subscription

record and removed at the latest upon account deletion.

• IBKR position data: until actively deleted by the user.

6. Data subject rights

You have the following rights (Art. 15–21 GDPR):

• Access (Art. 15) to data stored about you.
• Rectification (Art. 16) of inaccurate data.
• Erasure (Art. 17), unless a statutory retention obligation

applies.

• Restriction of processing (Art. 18).
• Data portability (Art. 20) — CSV/JSON export of account data is

available directly in the account management.

• Objection (Art. 21) to processing based on Art. 6 (1) (f) GDPR.

An email to info@wheeltrading.io is sufficient to exercise these rights.

6.1 Restriction during pending legal proceedings ("Legal Hold")

As long as pending legal proceedings concern your account (collection or civil suit, insolvency, criminally relevant transaction, open refund dispute or similar), your account is suspended until the proceedings are concluded. In that state, account deletion, plan changes, subscription cancellation and new sign-ups are not possible (Art. 18 (1) (b) GDPR; Art. 17 (3) (e) GDPR: "establishment, exercise or defence of legal claims").

The suspension is documented with a case reference or justification and is lifted without delay once the proceedings are concluded. Data processing during the suspension is limited to meeting statutory obligations and defending or asserting the affected claims.

Questions regarding the proceedings status: info@wheeltrading.io.

7. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority is the data protection supervisory authority of the federal state in which the Provider has its registered office.

8. Cookies and tracking

We use only technically necessary cookies (session cookie, CSRF token). No third-party tracking takes place (no Google Analytics, Facebook Pixel etc.).

9. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, our website uses SSL/TLS encryption. You can recognise the encrypted connection by the "https://" in the address bar of your browser.

10. Automated decision-making

There is no automated decision-making with legal effect within the meaning of Art. 22 GDPR. The Platform only provides algorithmically generated candidate selections for the user's own review; every investment decision is made by the user.

Version: 2026-08-15