Legal

Privacy notice

Last updated 14 October 2026. GOLDEO is provided by GOLDEO LTD, a company registered in England and Wales (company number 17512448), whose registered office is at Speedwell House, 365A South Street, Romford. We are the "controller" of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). Contact: help@goldeo.co.uk.

In short: we collect your identity details to confirm you're a real adult living in the UK and to run your account. They're encrypted, never sold, and seen only by us and the services we name below.

What we collect

• Account: username, email address, password and EA password (stored only as one-way scrambled hashes), two-step login settings, referral code and who referred you.
• Identity: legal first and last name, date of birth, UK home address, phone number (if you give it), and confirmation that you live in the UK.
• Identity check: the result, the date, the type and issuing country of the document you used, and the name and date of birth printed on it. The photos of your document and your selfie are captured and held by our verification service, not on our server. We only keep the result and a reference to it.
• Trading data reported by GOLDEO for each MT5 account it runs on: account number, broker and server, currency, balance, equity, leverage, deposits and withdrawals, GOLDEO's closed trades, software version, and the IP address it connects from.
• Billing: statements, payments, and references you quote.
• Security records: sign-in attempts, IP addresses, and a log of when our staff view your personal details.
• Visit statistics (no cookies): which pages of this website you open, roughly how long you stay, the site that sent you here, your type of device and browser, and a shortened network address (for example 81.2.69.x). We recognise a returning visitor using a one-way scrambled code made from their network address and browser, and if you're signed in we link your visits to your account. Nothing is stored on your device for this. If your browser sends "Do Not Track" or "Global Privacy Control", we don't record your visits at all.

Why we use it, and our legal basis

• To provide GOLDEO and bill the profit share (your account, licence, statements, support). Basis: our contract with you.
• To check you're 18+, live in the UK, and are who you say you are before you pay. Basis: our contract with you, and our legitimate interests in preventing fraud, licence sharing and sales to people we can't serve. The check uses facial comparison: the verification service compares your selfie with your document photo. Where that involves biometric data, the basis is your explicit consent, which you give when you start the check. If you'd rather not, ask us about a manual check instead.
• To recover money you owe us, including letters before claim, court claims and enforcement of judgments. Basis: our legitimate interests in being paid, and establishing, exercising or defending legal claims.
• To keep the service secure, for example by blocking repeated wrong passwords. Basis: legitimate interests.
• To keep accounting records. Basis: legal obligation.
• To understand how the website is used (how many people visit, which pages help them, how long they stay) so we can improve it. Basis: legitimate interests. These statistics are only for us; we don't share them or use them for advertising.

We don't use your data for marketing to other companies, and we don't make automated decisions that have legal effects on you without a person being able to review them. An identity check the service can't approve is reviewed by us.

Who we share it with

• Didit (identity verification), which processes your document and selfie for us. Its data is stored in the European Union, which UK law recognises as giving adequate protection.
• IONOS, which hosts our server.
• Tide, our bank, for payments you make to us.
• Stripe, if you pay by card. Stripe processes your card payment and uses the data under its own privacy policy, including for fraud prevention. We never see or store your full card number. Stripe also asks for your billing address, as card issuers require it. We receive confirmation of the payment, its amount, your email and that billing address.
• If you don't pay: our solicitors, a debt collection agency, the courts and court enforcement agents, only as needed to recover the debt.
• If the law requires it: for example to HMRC, the police or a regulator.

We never sell your data.

How we protect it

Your identity details are encrypted in our database, and only the first name we greet you with is stored in readable form. The website only works over an encrypted connection. Every time our staff open your personal details or print a statement of account, it's recorded in our security log.

How long we keep it

• Identity and billing records: 6 years after our contract with you ends, or until any debt is settled and the time to bring a claim has passed. Six years is the legal time limit for contract claims in England and Wales.
• Verification images held by Didit: for the retention period we set with them (up to 6 years), then deleted.
• Security logs: up to 2 years.
• Visit statistics: 180 days.

Your rights

You can:

• get a copy of your data: use Download my data under "Your details" in your client area, or ask us;
• correct it: update your address and phone yourself, or ask us to change your name or date of birth;
• ask us to delete it. We'll delete what we can, but we must keep identity and billing records for as long as described above;
• object to how we use it, or withdraw consent for biometric checks (this won't affect checks already done).

Email help@goldeo.co.uk. We'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

GOLDEO LTD · Registered in England and Wales, company no. 17512448 · Registered office: Speedwell House, 365A South Street, Romford