Privacy notice

Who to contact

Contact Bull&Bear Funded at support@bullbearfunded.com. Founder: Raslan Rassalan. Supplied business address: Soukalova, 143 00 Praha 12, Czech Republic.

The full legal data-controller identity, registration details, and complete postal address have not yet been published. Ask support to confirm the controller before submitting identity documents if this information is needed for your decision. No independent data protection officer is identified here.

Information collected and purposes

Account and authentication

Email, authentication records, session information, and account identifiers are used to create accounts, authenticate requests, and protect access.

Trading and challenge records

Orders, positions, balances, settlements, cycle history, and operational records are used to provide the simulation, calculate eligibility, and investigate errors.

Payments

Payment references, amounts, statuses, and account links are used to credit purchases, handle refunds, and reconcile transactions. Stripe collects payment details at Checkout; do not send card numbers through our forms.

Payout review

Name, date of birth, contact and address details, country, ID document, consent records, and payment destination are used for manual eligibility and identity review, fraud prevention, and fulfilment.

Support

Name, email, topic, message, and optional bug-report attachments are sent to support for investigation and response.

Technical information

Request and security logs can include connection information such as IP addresses and timestamps. Browser storage retains preferences and cached quotes.

Reasons and legal bases for processing

Account delivery, payment crediting, and requested payout handling involve information needed to provide the service or take steps you request. Security, fraud prevention, and dispute investigation may rely on legitimate interests, balanced against your rights. Recordkeeping may be required by applicable law.

Where processing relies on your consent, you can withdraw it by contacting support. This does not undo processing already lawfully completed or override a separate valid basis for retaining a record. Payout-form acknowledgements do not authorize unrelated marketing.

Without required account details, authentication may not be possible. Without required payout information, a request may not be reviewed or fulfilled. Demo practice does not require a payout ID upload.

Who receives information

Authorized platform and finance administrators can review relevant records. The configured Supabase services support authentication, database records, and identity-file storage. Stripe processes payments. The configured email provider handles support messages and transactional mail. If enabled, Telegram receives operational or payout notifications. A selected payout provider receives the information necessary for an approved transfer.

Support attachments travel through email. Identity documents are uploaded through the payout form and stored separately for administration. Do not include unrelated people’s data or secrets in either.

Some pages request external market-logo images, including Google-hosted favicons; those requests can expose your IP address to the image provider. Market-price services supply quote data and are not intended destinations for your uploaded identity document.

Cookies and browser storage

Authentication uses session cookies, including access and refresh cookies. Local browser storage keeps your language choice and cached market information. These support login, preferences, and page performance. Blocking or clearing them can sign you out or reset preferences.

Payment-provider pages can have their own cookies and privacy notices. This notice does not grant permission for future advertising trackers. Any additional tracking and any required consent must be disclosed separately.

Retention, location, and security

Account and trading records are needed while the service is used. Payment, payout, support, and identity records may need to be retained for outstanding requests, disputes, fraud investigation, and applicable legal recordkeeping. A fixed category-by-category retention schedule has not yet been published; request that information from support before uploading an ID if you need it.

Closing a page or challenge cycle does not automatically delete personal data. Deletion requests must also account for necessary records, provider copies, and backups; no instant deletion of all copies is promised.

Provider processing locations and any international-transfer safeguards depend on the deployed services and their contracts. The actual regions and safeguards must be confirmed with support; no EU-only storage claim is made. Access controls and secure transport reduce risk but cannot eliminate it.

Your rights and choices

Where applicable, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent for processing based on it and complain to your competent supervisory authority. In Czechia, the supervisory authority is the Úřad pro ochranu osobních údajů (ÚOOÚ).

Email support with “Privacy request” and your account email. We may need proportionate verification before releasing or changing records. Applicable legal response deadlines apply. Explain the data or processing concerned; do not send your password.

Challenge thresholds and modeled settlements are calculated automatically. Payout decisions involve manual review. Contact support to contest an eligibility result or ask for a human explanation.

For an independent overview, see EU data-protection guidance.