Privacy Policy

1. Controller

The controller responsible for data processing on this website is:
Tom Löbel
Gamigstraße 21, 01809 Heidenau, Germany
Email: contact@tlfx.trading

Personal data means any information relating to an identified or identifiable natural person. Providing personal data is generally voluntary; where data is required to conclude or perform a contract (for example to issue a license), this is indicated at the point of collection.

2. Server log data

When you visit this website, your browser automatically transmits information to the hosting server (IP address, date and time of access, the pages visited, browser type). This data is processed for the technical delivery and security of the website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating the website reliably and securely).

3. Hosting via Netlify

This website is hosted by Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, California 94104, USA. When the site is accessed, technical data is transferred to Netlify. Transfers to the USA take place on the basis of the EU Standard Contractual Clauses. More information: https://www.netlify.com/privacy/

4. License request form

When you submit a license request through the form, I process the data you provide (partner-broker MT5 account number, the email address used to open the broker account, your chosen Expert Advisor and broker, and a marketing opt-in if ticked) to verify your eligibility and issue your license. The legal basis is Art. 6(1)(b) GDPR (steps prior to / performance of a contract) and, for the optional marketing opt-in, Art. 6(1)(a) GDPR (consent).

The form is protected against spam by Cloudflare Turnstile, a privacy-friendly CAPTCHA that does not use tracking cookies (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Submissions are received via Netlify Forms, screened by a serverless function (which also enforces a short anti-duplicate rate limit), and the record is then stored in a self-hosted Cloudflare D1 database (Cloudflare, Inc., address above) that I use to manage and approve licenses. Data is deleted once it is no longer required and no statutory retention period applies.

5. Hire-me enquiry form (custom development)

When you send an enquiry through the form on the Hire me page, I process the data you provide (your name, your email address, the project type, your budget range, your timeline and your description of the project) in order to assess the enquiry, reply to you and, where we go ahead, to prepare and perform a development contract. The legal basis is Art. 6(1)(b) GDPR (steps prior to / performance of a contract) and Art. 6(1)(a) GDPR (consent) for the storage of the data you submit.

The technical route is the same as for the license form above: the form is protected by Cloudflare Turnstile, submissions are received via Netlify Forms, screened by a serverless function (which also enforces a short anti-flood rate limit), and the record is stored in a self-hosted Cloudflare D1 database that I use to manage enquiries. Enquiry records are deleted once they are no longer required and no statutory retention period applies.

I reply from my own mailbox, which is hosted by Zoho Mail (Zoho Corporation). If we move on to scoping your project, I may send you a link to a Google Form (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) containing detailed technical questions; the answers you give there are stored in my Google account. Using that form is voluntary — you can always send the same details to me by email instead. Note that Google may require you to sign in to a Google account if the form asks you to upload a file.

If we go ahead with a paid project, I invoice you directly — there is no third-party escrow. To issue invoices and keep the required accounting records, I process your billing details (such as your name, address and the invoice items) using Lexware bookkeeping software (Haufe-Lexware GmbH & Co. KG, Germany) as a processor. Invoice and accounting records are retained for the statutory retention periods (up to ten years under § 147 AO and § 257 HGB) and are not deleted before those periods expire. The legal basis is Art. 6(1)(b) GDPR (performance of the development contract) and Art. 6(1)(c) GDPR (compliance with commercial and tax record-keeping obligations).

6. License verification & software downloads

The Expert Advisors check their license at runtime and are downloaded through a Cloudflare Worker (Cloudflare, Inc., address above). For a license check, the software sends your MT5 account number, the chosen EA and the broker name reported by your terminal; the Worker compares this against the license database (Cloudflare D1) and returns only whether the license is valid. Your IP address is processed transiently for delivery, security and rate-limiting of the download endpoint. A "last active" date may be stored on your license record so I can identify and clean up long-unused licenses. Legal basis: Art. 6(1)(b) GDPR (performance of the free-license arrangement) and Art. 6(1)(f) GDPR (security and abuse prevention).

One Expert Advisor (Forex Flipper) offers an optional daily-limit feature ("Guard"). When you enable it, the software sends your MT5 account number together with the daily limits and trading window you have set to the same Cloudflare Worker, which stores that state for the current day so the limit can be enforced consistently; it resets automatically each day. No trade contents or personal identifiers beyond the account number are stored for this feature. Legal basis: Art. 6(1)(b) GDPR (performance of the free-license arrangement).

7. Contact by email

If you contact me by email, the data you provide (your email address, your name if given, and the content of your message) is processed solely to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). You may object to this processing at any time.

8. Web analytics (Pirsch)

This website uses Pirsch Analytics, a privacy-friendly, cookieless web-analytics service (Emvi Software GmbH, Germany), to understand aggregate traffic. Pirsch does not set cookies and does not store personal data such as full IP addresses; visits are counted using an anonymous, non-reversible hash. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in measuring reach).

9. Cookies & local storage

This website itself uses only technically necessary storage and sets no advertising or tracking cookies of its own. Third-party elements are not loaded automatically: the video embeds (see the YouTube section) are served in privacy-enhanced mode, and the Buy Me a Coffee support button is a plain link that takes you to the provider's site only if you click it. You can manage or delete cookies and local storage through your browser settings.

10. Fonts (self-hosted)

The fonts used on this website are hosted directly on the website's own server. They are not loaded from Google Fonts or any other third party, so no data is transmitted to external font providers when you access the site.

11. YouTube video embeds

Some pages embed videos hosted on YouTube in privacy-enhanced mode (via the youtube-nocookie.com domain). In this mode YouTube does not set cookies unless you actually start playback. When the embed loads, a connection to YouTube's servers is nonetheless established and your IP address is transmitted so the video can be delivered. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing by YouTube is governed by Google's own privacy policy.

12. Buy Me a Coffee widget

This website links to my "Buy Me a Coffee" support page. To protect your privacy the Buy Me a Coffee widget is not embedded, and nothing is loaded from the provider's servers while you browse this site. Only if you click the support button are you taken to buymeacoffee.com in a new tab, where your data is then handled by the provider under its own privacy policy. Provider: Buy Me a Coffee.

13. Affiliate links

This website contains affiliate links to partner brokers. When you click such a link and open an account, the broker may set cookies or use tracking parameters to attribute the referral. This processing is carried out by the respective broker under its own privacy policy. TLFX does not receive your personal trading data through these links — only a referral confirmation.

14. International transfers

Several of the processors above (Netlify, Cloudflare, Google/YouTube) are based in or transfer data to the USA. Such transfers are based on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, together with the providers' own safeguards. Pirsch (analytics) and the controller are based in the EU/Germany.

15. Your rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw any consent you have given at any time with effect for the future. To exercise any of these rights, contact me using the details in section 1.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for the controller is: Der Sächsische Datenschutzbeauftragte, Devrientstraße 5, 01067 Dresden, Germany.