Privacy Policy

Last updated: 1 March 2026

1. Introduction

Golden Trade Challenge 2026 ("we", "us", "the Organiser") is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, and how we handle it when you use the Golden Trade Challenge platform at challenge.talupa.com.

2. Data We Collect

We collect the following personal data when you register and use our platform:

• Account information — email address and hashed password. Your password is stored using bcrypt and is never readable by us.
• Profile information — display name and country (both optional).
• Transaction data — entry records, trade selections, and payment references (we do not store card numbers or CVV).
• Technical data — IP address, browser type, and session cookies required for authentication.

3. How We Use Your Data

Your data is used exclusively for the following purposes:

• Operating the competition — creating entries, recording trades, calculating scores, and determining winners.
• Payment processing — facilitating payments via Stripe. Card details are handled entirely by Stripe and never touch our servers.
• Communication — sending transactional emails such as entry confirmations, winner notifications, and password resets.
• Fraud prevention — detecting duplicate accounts and preventing abuse of the entry system.

4. Payment Processing

All payments are processed by Stripe, a PCI DSS Level 1 certified payment processor. We receive only a payment reference and confirmation status — we never see, store, or process your full card details. Stripe's privacy policy governs how they handle your payment data.

5. Data Sharing

We do not sell or rent your personal data. We share data only in these limited circumstances:

• Stripe — payment data necessary to process entry fees.
• Legal requirements — if required by law, regulation, or valid legal process.

6. Data Retention

Your account data is retained for the duration of the competition and for up to 12 months after the final settlement date, after which it is deleted. Transaction records may be retained longer if required for tax or legal compliance purposes.

7. Your Rights

Under UK GDPR and EU GDPR, you have the following rights regarding your personal data:

• Access & portability — request a copy of all personal data we hold about you.
• Rectification & erasure — request correction of inaccurate data or deletion of your account and associated data.
• Objection — object to processing of your data. Note that deleting essential data may prevent your participation in the competition.

8. Cookies

We use only essential session cookies required for authentication and security. We do not use tracking cookies, analytics cookies, or advertising cookies. No consent banner is required as we only use strictly necessary cookies.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email to registered participants. The "last updated" date at the top of this page will be revised accordingly.

10. Contact

For privacy-related enquiries, data access requests, or to exercise your rights, contact us at [email protected].