Privacy Policy & GDPR — Skyra CIP

Skyra Commodity Trading Platform — Last Updated: 03 April 2026

This platform processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679. You retain full rights over your data at all times.

1. Overview

Skyra ("we", "our", "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you access the Skyra Commodity Trading Platform (the "Platform"). This policy is compliant with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable data protection laws. By accessing or using the Platform, you acknowledge that you have read and understood this policy.

2. Data Controller

The data controller responsible for your personal data is: Skyra — Commodity Trading Platform. Contact: privacy@skyra.com.hk. If you have any questions or concerns about this Privacy Policy or our data practices, you may contact our Data Protection Officer (DPO) at the address above.

3. Data We Collect

We collect the following categories of personal data:

Account & Identity Data: Username and display name; role designation (Admin / Partner Member); membership tier (Free, Pro, Investor); account creation date and last login timestamp.

Session & Usage Data: Session tokens stored locally in your browser (sessionStorage / localStorage); pages visited and features used within the Platform; IP address and browser/device type for security logging.

Communication Data: Any correspondence you send to us via email or support channels.

We do not collect payment card data, government identification numbers, or sensitive personal categories as defined under GDPR Article 9.

4. Purpose & Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

Performance of a contract (Art. 6(1)(b)): To authenticate your identity, maintain your session, and provide the Platform features you have subscribed to.
Legitimate interests (Art. 6(1)(f)): To monitor Platform security, detect fraud, and improve service quality — provided such interests are not overridden by your rights.
Compliance with legal obligations (Art. 6(1)(c)): To retain records as required by applicable financial and commercial regulations.
Consent (Art. 6(1)(a)): Where you have explicitly consented — for example, by accepting the market price disclaimer before viewing live data.

5. Data Retention

We retain personal data only for as long as necessary:

Account data: retained for the duration of your active membership and up to 3 years thereafter for legal compliance purposes.
Session data: automatically cleared when your browser session ends (sessionStorage) or upon explicit logout (localStorage).
Security logs: retained for up to 12 months.
Email correspondence: retained for up to 5 years for dispute resolution purposes.

Upon expiry of the relevant retention period, data is securely deleted or anonymised.

6. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We may share data with:

Market Data Providers: Prices displayed on the Platform are retrieved from third-party financial data feeds (CME/NYMEX, COMEX, LBMA, gold-api.com). These requests are proxied through our servers; your personal data is not transmitted to these providers.
Service Providers: Trusted third-party processors (e.g. cloud hosting, analytics) acting on our behalf under GDPR-compliant data processing agreements.
Legal Authorities: Where required by law, court order, or regulatory obligation.

All third-party processors are contractually bound to process your data only on our instructions and in compliance with applicable data protection legislation.

7. Your GDPR Rights

Under GDPR Chapter III, you have the following rights regarding your personal data:

Right of Access (Art. 15): You may request a copy of all personal data we hold about you.
Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
Right to Erasure / "Right to be Forgotten" (Art. 17): You may request deletion of your personal data where there is no overriding legal basis for continued processing.
Right to Restriction of Processing (Art. 18): You may request that we limit processing of your data in certain circumstances.
Right to Data Portability (Art. 20): You may request your data in a structured, commonly used, machine-readable format.
Right to Object (Art. 21): You may object to processing based on legitimate interests, including profiling.
Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right to Lodge a Complaint: You have the right to lodge a complaint with your national supervisory authority. In the EU, the lead authority is determined by your country of residence.

To exercise any of the above rights, contact: privacy@skyra.com.hk. We will respond within 30 days in accordance with GDPR Article 12.

8. Cookies & Local Storage

The Platform uses browser storage mechanisms exclusively for functional purposes:

localStorage (skyra_auth_v1): Stores your encrypted authentication credentials to maintain your login session across browser restarts. No tracking or advertising data is stored.
sessionStorage (skyra_session_v1, skyra_price_disclaimer_v1): Stores temporary session state including your disclaimer acceptance. Automatically cleared when the browser tab is closed.

We do not use third-party tracking cookies, advertising pixels, or analytics scripts that transmit data to external parties without your knowledge.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure, including:

Password hashing before storage
HTTPS/TLS encryption for all data in transit
Role-based access control limiting data visibility by user role
Session invalidation on logout

No method of electronic transmission or storage is 100% secure. We encourage you to use a strong, unique password and to sign out when using shared devices.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. When we do, we will update the "Last Updated" date at the bottom of this page and, where required, notify you via the Platform or email. Continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.

Contact

Data Controller: Skyra Holdings Limited, 95 Queensway, Unit B, 17/F United Centre, Admiralty, Hong Kong. Email: privacy@skyra.com.hk.