Privacy Policy

1. Introduction

Financial Trust Oversight Union ("FTO-Union", "we", "us", or "our") is committed to protecting your privacy and handling personal information responsibly. This Privacy Policy explains what information we collect when you visit our website, use our broker lookup and audit tools, submit a complaint, contact us, or otherwise interact with our services, and how we use, store, and share that information.

This policy should be read together with our Terms of Service and Cookie Policy. By using our website or submitting information to us, you acknowledge that you have read this Privacy Policy.

Important: This Privacy Policy is provided for transparency and compliance purposes. It does not constitute legal advice. If you need advice about your privacy rights in a specific jurisdiction, you should consult a qualified professional.

2. Who we are

FTO-Union operates as an independent legal and investor-protection organisation focused on investigating investment fraud, supporting recovery efforts, and publishing regulatory and broker oversight information.

Data controller: Financial Trust Oversight Union (FTO-Union)

Website: www.fto-union.com

Privacy enquiries: privacy@fto-union.com

General contact: contact@fto-union.com

Registered offices:

• 25 Old Broad Street, EC2N 1HQ, London, United Kingdom
• 1 Martin Place, NSW 2000, Sydney, Australia
• 40 Wall Street, NY 10005, New York, United States

3. Scope

This Privacy Policy applies to personal information we process in connection with:

• visiting and browsing our public website pages;
• using our broker lookup tool, audit database, regulation guides, and news pages;
• submitting a complaint through our complaints form, including uploaded evidence;
• contacting us through our contact form, email, or telephone;
• corresponding with us about an existing or potential case; and
• any other FTO-Union online services that link to this policy.

This policy does not apply to third-party websites, brokers, regulators, or service providers that may be linked from our site or mentioned in our publications. Those parties are responsible for their own privacy practices.

4. Information we collect

Depending on how you interact with us, we may collect the following categories of information.

4.1 Information you provide directly

Complaint submissions. When you file a complaint, we may collect:

• identity and contact details (full name, email address, phone number, country of residence);
• details about the alleged fraudulent firm (name, website, jurisdiction, claimed regulator);
• financial and case information (amount lost, currency, fraud type, investment dates, narrative description);
• uploaded documents and evidence (screenshots, deposit receipts, statements, contracts, and other supporting files); and
• consents and confirmations you provide when submitting the form.

Contact and consultation requests. When you use our contact form or email us, we may collect your name, email address, phone number, country, subject, message content, and any other information you choose to include.

Correspondence. If you communicate with us by phone, email, or post, we may keep a record of that communication and any information you provide.

4.2 Information collected automatically

When you visit our website, we or our service providers may automatically collect limited technical information, such as:

• IP address and approximate geographic location derived from it;
• browser type, device type, operating system, and screen resolution;
• referring URL, pages viewed, date and time of access, and time spent on pages;
• error logs and security-related events; and
• cookie and similar technology data as described in our Cookie Policy.

Our broker lookup tool processes search queries locally in your browser against our published audit database. We do not require you to create an account to perform a broker search, and routine broker name searches are not stored as identifiable personal data unless you separately submit a form or otherwise contact us.

4.3 Sensitive information

Complaint submissions may include sensitive information, such as financial loss details, identity documents, or information relating to alleged criminal activity. We ask that you do not submit passwords, PINs, private keys, or full payment card numbers. We process sensitive information only where necessary to assess your complaint, pursue investigation or recovery, comply with law, or with your consent.

5. How we use your information

We use personal information for the following purposes:

• Case assessment and legal services: to review complaints, evaluate potential recovery options, communicate with you about your matter, and provide services you request.
• Investigation and recovery: to analyse evidence, identify involved parties, coordinate with legal, regulatory, forensic, or banking partners where appropriate, and pursue lawful recovery or enforcement actions.
• Customer support: to respond to inquiries, provide consultation updates, and manage references linked to your submission.
• Website operation and security: to maintain, secure, and improve our website, prevent fraud and abuse, and troubleshoot technical issues.
• Analytics and performance: to understand how visitors use our site and tools so we can improve content, navigation, and accessibility.
• Compliance and legal obligations: to comply with applicable laws, respond to lawful requests from courts or authorities, enforce our terms, and protect our rights and the rights of others.
• Public interest and oversight activities: where permitted by law and appropriate safeguards are in place, to maintain broker audit records, publish regulatory summaries, and support investor-protection initiatives. We do not publish identifiable complainant details without consent unless required by law.

We do not sell your personal information.

6. Legal bases for processing

We process personal information on one or more of the following bases, depending on your location and the nature of the processing:

• Consent: where you tick a consent box, upload documents, or otherwise agree to our processing—for example, when submitting a complaint or contact form.
• Contract and pre-contractual steps: where processing is necessary to respond to your request, assess your case, or provide services you have asked us to consider.
• Legitimate interests: where processing is necessary for our legitimate interests in operating a secure website, preventing misuse, improving our services, and protecting investors, provided those interests are not overridden by your rights.
• Legal obligation: where we must retain or disclose information to comply with applicable law, regulation, court order, or regulatory request.
• Vital interests or public interest: in rare cases where processing is necessary to protect life, prevent serious harm, or support lawful fraud prevention and law-enforcement cooperation.

Australia

If you are in Australia, we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You may lodge a complaint with us first; if unresolved, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

United Kingdom and European Economic Area

If you are in the UK or EEA, we process personal data in accordance with the UK GDPR and/or EU GDPR, as applicable. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

United States and other regions

Where state or national privacy laws grant additional rights—for example, rights to know, delete, or opt out of certain processing—we will honour those rights as required by applicable law.

7. Sharing and disclosure

We may share personal information with:

• Internal teams: authorised case officers, legal advisors, compliance staff, and technical administrators who need access to perform their duties.
• Professional advisers: lawyers, forensic accountants, investigators, translators, and expert witnesses engaged in connection with your matter.
• Service providers: hosting providers, email delivery services, document storage vendors, security providers, and analytics providers that process data on our behalf under contractual confidentiality and security obligations.
• Regulators and law enforcement: where necessary to report suspected fraud, respond to lawful requests, or cooperate with investigations by bodies such as ASIC, FCA, SEC, or police agencies.
• Financial institutions and counterparties: where relevant to trace funds, freeze assets, or pursue recovery, subject to appropriate legal process and confidentiality safeguards.
• Successors: in connection with a merger, reorganisation, or transfer of assets, provided the recipient agrees to protect personal information consistently with this policy.

We may also disclose aggregated or de-identified information that cannot reasonably be used to identify you.

8. International transfers

FTO-Union operates globally with offices in the United Kingdom, Australia, and the United States. Personal information may be stored or processed in any of these locations or in countries where our service providers operate.

Where we transfer personal information across borders, we implement appropriate safeguards such as contractual data-protection clauses, access controls, and encryption in transit. If you are located in the UK or EEA and your data is transferred outside those regions, we will take steps required under applicable data-protection law.

9. Data retention

We retain personal information only for as long as necessary for the purposes described in this policy, including:

• Complaint and case records: typically for up to seven (7) years after closure of the matter, or longer where required for legal claims, regulatory obligations, or ongoing recovery actions.
• Contact enquiries: typically for up to three (3) years from last meaningful contact, unless a case develops from the enquiry.
• Website logs and security records: typically for up to twelve (12) months, unless needed for incident investigation.
• Marketing or optional communications: until you opt out or we no longer need the information.

When information is no longer required, we securely delete or de-identify it in accordance with our retention schedule and applicable law.

10. Security

We implement administrative, technical, and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure. These measures include encrypted transmission (TLS/HTTPS), access restrictions, secure handling of uploaded documents, and staff confidentiality obligations.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. You are responsible for keeping your own devices secure and for not submitting passwords, private keys, or other credentials through our forms.

If we become aware of a data breach likely to affect your rights, we will notify you and relevant authorities as required by applicable law.

11. Your privacy rights

Depending on where you live, you may have some or all of the following rights:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion or anonymisation, subject to legal retention requirements;
• object to or restrict certain processing, including direct marketing;
• withdraw consent where processing is consent-based;
• request portability of information you provided in a structured, commonly used format, where applicable; and
• lodge a complaint with a supervisory authority or regulator.

To exercise your rights, email privacy@fto-union.com with sufficient detail to verify your identity and describe your request. We aim to respond within thirty (30) days, or within the timeframe required by applicable law. We may need to retain certain information where we have a legal obligation or legitimate need to do so.

12. Children

Our services are not directed at individuals under 18 years of age, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

13. Third-party links and services

Our website may contain links to third-party websites, broker platforms, regulator sites, news sources, and embedded content such as fonts loaded from Google Fonts. Those third parties may collect information about you under their own privacy policies. We encourage you to review their policies before providing personal information to them.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, provide additional notice on our website. Your continued use of the site after changes take effect constitutes acceptance of the updated policy, except where further consent is required by law.

15. Contact us

If you have questions about this Privacy Policy or how we handle your personal information, contact us at:

• Email: privacy@fto-union.com
• General enquiries: contact@fto-union.com
• Case submissions: cases@fto-union.com
• Web form: Contact FTO-Union