Legal · draft
Privacy notice
1. Who we are
TTC Holdings Group Ltd (“we”, “us”) operates the public website www.ttctrading.co.uk and related Rook™ / TTC Trading™ marketing materials. Rook™ is paper-trading operations software under development — not a signal service and not discretionary investment management.
Registered in England and Wales. Company number: 16879126 (Companies House). Registered office: 86-90 Paul Street, London, England, EC2A 4NE. Contact for privacy requests: use the email address you used to subscribe, or the contact channel shown on the site when available, marked “Privacy”.
2. What this notice covers
This notice covers personal data we process when you:
- browse the public marketing site;
- subscribe to the weekly desk note / Operator early-access list;
- email us about the product.
It does not cover exchange accounts, API keys, or engine data on your own machine — those stay under your control. We do not ask for API keys on this website.
3. What we collect
| Data | When | Why |
|---|---|---|
| Email address | Subscribe form | Send the weekly desk note; Operator early-access notices when relevant |
| Signup metadata (time, source tags) | Form submission | Prove consent; debug delivery; stop spam |
| Technical logs (IP, user agent) if provided by our form/hosting providers | Submit / browse | Security, abuse prevention, basic analytics if enabled |
| Email engagement (opens/clicks) if our mail tool records them | After we send | Improve the note; honour unsubscribe |
We do not collect: payment card data on this site (no paid checkout yet); API keys; wallet addresses; identity documents via the waitlist.
4. Lawful basis (UK GDPR) and PECR
- Consent (UK GDPR Art. 6(1)(a)) and PECR rules on electronic mail marketing — for sending the weekly desk note and related Operator early-access emails to individual subscribers.
- Legitimate interests (Art. 6(1)(f)) — limited site security, spam filtering, and responding to messages you send us (balanced against your rights).
You can withdraw marketing consent at any time (unsubscribe link in every email, or email us). Withdrawal does not affect earlier lawful processing.
5. Who we share data with (processors)
We use service providers as processors, for example:
- Formspree — receives signup form posts and notifies us;
- IONOS (or successor host) — hosts the static website;
- Email tool (e.g. Formspree notifications now; later a newsletter tool such as Buttondown/Brevo) — stores the list and sends mail.
We do not sell your email. We do not share it with signal vendors or “partner” spam lists.
6. International transfers
Some processors may store or process data outside the UK. Where that happens we rely on appropriate safeguards offered by those providers (e.g. standard contractual clauses / UK addendum) as described in their documentation. Ask us if you need current processor details.
7. Retention
- Active subscribers: while subscribed, plus a short period after unsubscribe to prove we stopped mailing (typically up to 24 months for compliance evidence, then delete or anonymise where practical).
- Formspree free-tier history: may be limited by their plan (e.g. short archive) — we keep our own export when we migrate lists.
- Server/security logs: only as long as needed for security (provider defaults).
8. Your rights
Under UK GDPR you may have rights to access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent. You may also complain to the Information Commissioner’s Office (ICO).
To exercise rights, contact us using the privacy channel above and include the email you subscribed with.
9. Children
The site and desk note are aimed at adults interested in trading operations software. We do not knowingly collect children’s data.
10. Future member accounts (not live yet)
We are designing a separate Member Lounge (logged-in area by tier) on a dedicated subdomain. It is not live as of this notice. Before any account goes live we will:
- update this privacy notice for account data (email, tier, security logs);
- sign data-processing terms with the identity and hosting providers;
- prefer UK/EU data residency for authentication where available;
- provide in-product ways to access, export, and request deletion of your account data;
- not ask for exchange API keys, wallets, or payment cards in Phase A.
Processing will follow UK GDPR and, where we offer accounts to EU residents, EU GDPR standards. Other countries: we minimise data first and will not claim local compliance until reviewed. Design record: Member Lounge Phase A (internal task T-SAAS-012). Solicitor review remains required before paid beta (T-SAAS-003).
11. Changes
We may update this draft. The “Last updated” date will change. Material changes before paid beta will be reviewed with a solicitor.