Data Processing Agreement (GDPR)

Effective Date: 13 September 2025

This Data Processing Agreement ("DPA") reflects the requirements of the European General Data Protection Regulation ("GDPR") and applies to the processing of personal data by Aeromir Corporation ("Aeromir") in connection with futures.aeromir.com educational services.

1. Definitions

"Controller" means the entity that determines the purposes and means of processing personal data.

"Personal Data" means any information relating to an identified or identifiable natural person.

"Processing" means any operation performed on personal data, including collection, storage, use, or disclosure.

"Processor" means an entity that processes personal data on behalf of the Controller.

"Data Subject" means the individual to whom personal data relates.

2. Nature and Purpose of Processing

2.1 Controller Role: You (the user) are the Controller of your personal data when using our educational services.

2.2 Processor Role: Aeromir acts as a Processor when handling your personal data for:

  • Providing futures trading education services
  • Processing course registrations and payments
  • Tracking educational progress and completion
  • Providing customer support
  • Sending course-related communications

2.3 Categories of Data: We process the following types of personal data:

  • Contact information (name, email, phone number)
  • Billing and payment information
  • Course progress and educational records
  • Communications and support interactions
  • Website usage and technical data

3. Your Rights Under GDPR

As a data subject, you have the following rights:

3.1 Access: You can request information about what personal data we process and obtain a copy of that data.

3.2 Rectification: You can request correction of inaccurate or incomplete personal data.

3.3 Erasure: You can request deletion of your personal data in certain circumstances.

3.4 Portability: You can request to receive your personal data in a structured, machine-readable format.

3.5 Restriction: You can request limitation of processing in certain circumstances.

3.6 Objection: You can object to processing based on legitimate interests or direct marketing.

4. Legal Basis for Processing

We process your personal data based on:

  • Contract Performance: To provide educational services you've purchased
  • Legitimate Interests: To improve our services and provide customer support
  • Consent: For marketing communications (where applicable)
  • Legal Obligation: To comply with applicable laws and regulations

5. Data Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

  • SSL encryption for data transmission
  • Secure servers and access controls
  • Regular security audits and updates
  • Staff training on data protection
  • Incident response procedures

6. Data Transfers

6.1 International Transfers: Your data may be transferred to and processed in the United States where our servers are located.

6.2 Safeguards: For transfers outside the EEA, we implement appropriate safeguards such as:

  • Standard Contractual Clauses (SCCs)
  • Adequacy decisions by the European Commission
  • Other approved transfer mechanisms

7. Third-Party Processors

We may engage third-party processors to help provide our services, including:

  • Payment processors for billing
  • Email service providers for communications
  • Analytics providers for website improvement
  • Customer support platforms

All third-party processors are contractually required to protect your data and process it only as instructed.

8. Data Retention

8.1 Retention Period: We retain personal data for as long as necessary to:

  • Provide educational services
  • Comply with legal obligations
  • Resolve disputes and enforce agreements

8.2 Deletion: Upon account termination or expiry of retention periods, we securely delete or anonymize your personal data, except where retention is required by law.

9. Data Breach Notification

9.1 Incident Response: In the event of a personal data breach, we will:

  • Notify relevant supervisory authorities within 72 hours where required
  • Inform affected individuals when there is a high risk to their rights and freedoms
  • Document all breaches and remediation measures taken

10. Exercising Your Rights

10.1 How to Contact Us: To exercise your GDPR rights, contact us at:

10.2 Response Time: We will respond to your requests within 30 days (extendable by 60 days for complex requests).

10.3 Identity Verification: We may need to verify your identity before processing certain requests.

11. Supervisory Authority

You have the right to lodge a complaint with your local data protection authority if you believe we have not complied with GDPR requirements.

12. Educational Data Specific Provisions

12.1 Course Records: We maintain records of your educational progress and course completion for legitimate educational and credentialing purposes.

12.2 No Trading Data: We do not process personal data related to your actual trading activities or financial performance, only educational engagement.

13. Updates to This DPA

We may update this DPA to reflect changes in GDPR requirements or our processing activities. We will notify you of material changes via email or website notice.

14. Contact Information

Data Protection Officer:

Aeromir Corporation
Email: [email protected]
Subject: "GDPR/Data Protection Inquiry"
Website: futures.aeromir.com

This DPA is incorporated into and forms part of our Terms of Service and Privacy Policy.