Last updated: 28 October 2026. Version 2.2.
1. Introduction
This Privacy Policy is issued by TFG (Payments) Limited, a company registered in England and Wales (company number 10537331) with registered office at 85 Great Portland Street, First Floor, London W1W 7LT, trading as ThinkCapital ("we", "our", "us"). We are the controller of the personal data processed as described in this Policy.
This Policy explains how we collect, use, share and protect your personal data and the rights you have. It is a statement of our practices, not a contract, and we do not rely on your acceptance of it as consent; where we need your consent for a specific processing activity, we will ask for it separately and clearly. If you have any questions about this Policy or your personal data, please contact us at privacy@thinkcapital.com.
All third parties (including clients, suppliers, sub-contractors, or agents) who have access to or use personal information collected and held by us must abide by this Privacy Policy. ThinkCapital is responsible for protecting the privacy of all personal data it acquires and for managing the protection of privacy and the safekeeping of your personal and financial information.
The following definition is used in this Privacy Policy:
- Special category data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data processed to uniquely identify a person, data concerning health, or data concerning a person's sex life or sexual orientation. Data relating to criminal convictions and offences is treated with equivalent care under the separate conditions that apply to it.
2. What kind of personal information does ThinkCapital collect and hold?
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
Certain special category data requires a higher level of protection, such as information about a person's health or sexual orientation. Information about criminal convictions and offences also warrants this higher level of protection and is processed only under the separate conditions that apply to it.
We may collect and hold a range of personal information about you to provide you with our services, including:
- Identity Data includes first name, maiden name, last name, proof of identity, username or similar identifier, marital status, title, date and place of birth and gender, country of residence and citizenship, and identification documents such as passport or driving licence details.
- Contact Data includes billing address, email address and telephone numbers and proof of address.
- Professional Data includes level of education, profession, employer name and your trading experience.
- Financial Data includes annual income, net worth, source of funds, anticipated account turnover, bank account, bank statements, payment card details and copies, E-wallet information.
- Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our websites and client portal.
- Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
- Usage Data includes information about how you use our websites, products and services.
- Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
- other personal information we require to meet your needs and provide our services to you.
We obtain this information through your use of our services or other dealings with us including through any of our websites, apps, the account opening applications, demo sign up, webinar sign up, subscribing to news updates and from information provided in the course of ongoing customer communication.
3. How does ThinkCapital collect personal information?
We generally collect personal information directly from you. For example, personal information will be collected through our application processes, forms, and other interactions with you while providing you with our products and services, including when you visit our website, use a mobile app from us, call us or send us correspondence.
We may also collect personal information about you from a third party, such as electronic verification services, referrers, marketing agencies, payment service providers and financial institutions, and providers of customer support tools. If so, we will take reasonable steps to ensure that you are made aware of this Privacy Policy.
We will not collect special category data about you unless a legal condition permitting its processing applies, such as your explicit consent, or where the processing is required or authorised by law or is necessary in relation to suspected unlawful activity or serious misconduct.
If the personal information we request is not provided by you, we may not be able to provide you with the benefit of our services or meet your needs appropriately.
We cannot provide the Services anonymously or under a pseudonym. We verify identity before providing funded-stage services and screen against applicable sanctions lists, and we need accurate identity information to perform our contract with you and to prevent fraud and abuse.
4. Who does ThinkCapital collect personal information about?
The personal information we may collect and hold includes (but is not limited to) personal information about:
- customers;
- potential customers;
- visitors to our website;
- introducing marketing affiliates;
- service providers or suppliers;
- prospective employees, employees, and contractors; and
- other third parties with whom we come into contact.
5. Website collection
ThinkCapital collects personal information when we receive completed online forms submitted through our websites, including www.thinkcapital.com and our client portal at portal.thinkcapital.com. We may also use third parties to analyse traffic on our websites, which may involve the use of cookies.
We use strictly necessary cookies, including security cookies set by Cloudflare, to operate and protect our websites; these do not require your consent. We will ask for your consent through our cookie banner before setting any non-essential cookies, such as analytics or advertising cookies, and you may withdraw or change your choices at any time. Please refer to our Cookie Policy at https://www.thinkcapital.com/cookie-policy/ for details.
6. Website security and bot protection
Our websites and client portal are protected by security services provided by Cloudflare, Inc., a US-headquartered network security provider. To distinguish human visitors from automated traffic and to protect our services against spam, abuse and malicious activity, Cloudflare's security tools (including Cloudflare's Challenge Platform and, where deployed, Cloudflare Turnstile) process limited technical data from your device, such as your IP address, TLS fingerprint, browser type and user-agent, and characteristics of your interaction with the page. Cloudflare processes this data on our behalf and on our instructions; Cloudflare may also use it to improve its bot-detection services, for which Cloudflare acts as an independent controller. This processing is strictly necessary for the security of our services, and we rely on our legitimate interests in securing our websites and preventing fraud and abuse (Article 6(1)(f) GDPR and UK GDPR). Because Cloudflare operates a global network headquartered in the United States, this data may be transferred to the United States; Cloudflare is certified under the EU-US Data Privacy Framework and its UK Extension, and our data processing terms with Cloudflare incorporate the European Commission's Standard Contractual Clauses. Further details are available in Cloudflare's Privacy Policy at https://www.cloudflare.com/privacypolicy/ and the Turnstile Privacy Addendum at https://www.cloudflare.com/en-gb/turnstile-privacy-policy/.
7. Why does ThinkCapital collect and hold personal information?
We may use and disclose the information we collect about you for the following purposes:
- provide you with our products and services;
- review and meet your ongoing needs;
- provide you with information we believe may be relevant or of interest to you;
- let you know about other products or services we offer, send you information about special offers or invite you to events;
- consider any concerns or complaints you may have;
- comply with relevant laws, statutes, regulations and other legal obligations;
- help us improve the products and services offered to our customers and enhance our overall business.
We may use and disclose your personal information for any of these purposes. We may also use and disclose your personal information for secondary purposes which are related to the primary purposes set out above, or in other circumstances authorised by law.
For users in the EU, the UK and Switzerland, the legal basis for each purpose is as follows: providing and administering your challenge account and any funded account, and processing your payments: performance of our contract with you (Article 6(1)(b)); identity verification, sanctions and politically exposed person screening, and compliance with applicable laws: legal obligation (Article 6(1)(c)) and our legitimate interests (Article 6(1)(f)); detecting breaches of trading rules, preventing fraud and abuse, and protecting the security and integrity of our platform and websites, including bot detection: our legitimate interests (Article 6(1)(f)); improving our services: our legitimate interests (Article 6(1)(f)); marketing our services to existing customers: our legitimate interests (Article 6(1)(f)); marketing to prospective customers and any use of non-essential cookies: your consent (Article 6(1)(a)).
Where we rely on legitimate interests, those interests are: preventing fraud and abusive trading conduct; protecting the integrity, security and proper functioning of our platform, websites and simulated markets, including bot detection; enforcing our terms and conditions; establishing and defending legal claims; improving our services; and marketing our services to existing customers. You may request further information about our balancing assessments by contacting privacy@thinkcapital.com.
Special category data will be used and disclosed only for the purpose for which it was provided or a directly related purpose, unless you agree otherwise or the law permits or requires otherwise.
Information Use
ThinkCapital uses the personal information we collect from you to deliver our services, to provide customer support, to undertake the necessary security and identity verification checks, to comply with relevant laws, statutes and regulations and other legal obligations, to process any of your online transactions, to assist your participation in third-party promotions, to meet certain business requirements and for any other purpose related to the operation of the services.
Your personal information may also be used by us to provide you with promotional offers and information regarding our products and services and for us to better provide a range of products and services and improved customer service.
From time to time, we may request information from you via surveys. Participation in these surveys is completely voluntary, and, therefore, you have the choice of whether to disclose such information. Information requested may include contact information (such as name, correspondence address, and telephone number), and demographic information (such as postal code or age).
8. Who would ThinkCapital disclose personal information to?
We may disclose personal information to:
- a related entity of ThinkCapital;
- an agent, contractor or service provider we engage to carry out our functions and activities, such as our lawyers, accountants, debt collectors or other advisers;
- organisations involved in a transfer or sale of all or part of our assets or business;
- organisations involved in managing payments, including payment merchants and other financial institutions, such as banks;
- identity verification, sanctions and politically exposed person screening providers;
- trading platform and technology providers;
- IT, hosting, security and content-delivery providers (including Cloudflare, Inc.);
- regulatory bodies, government agencies, law enforcement bodies and courts;
- anyone else to whom you authorise us to disclose it, or to whom disclosure is required by law.
If we disclose your personal information to service providers that perform business activities for us, they may only use your personal information for the specific purpose for which we supply it. We will ensure that all contractual arrangements with third parties adequately address privacy issues, and we will make third parties aware of this Privacy Policy.
9. Data sharing for platform integrity
ThinkCapital may process and disclose personal data, including identifiers such as names, email addresses, IP addresses and transaction behaviour, for the purpose of investigating or preventing suspected abusive conduct, fraudulent activity or behaviour harmful to the integrity of our platform. Such processing may include limited sharing of data with risk-management partners, technology providers and group companies engaged for fraud and platform-integrity investigations, where we believe this is necessary to protect the services, safeguard platform functionality or enforce platform policies. These disclosures are carried out under our legitimate interests and with appropriate safeguards in place, including confidentiality undertakings and data protection obligations for recipients.
10. Your rights under data protection law
If you are in the EU, the UK or Switzerland, you have the following rights: to access your personal data; to have inaccurate data rectified; to have your data erased in certain circumstances; to restrict processing in certain circumstances; to receive the data you provided to us in a portable format and have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means; to object to processing based on legitimate interests; and, without exception, to object to direct marketing. Where processing is based on your consent, you may withdraw that consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal, and withdrawing is as easy as giving consent.
To exercise any of these rights, contact us at privacy@thinkcapital.com. We will respond without undue delay and in any event within one month of receipt; that period may be extended by two further months where requests are complex or numerous, in which case we will tell you within the first month. We will act on your requests free of charge unless a request is manifestly unfounded or excessive.
You may object to processing carried out on the basis of our legitimate interests, including fraud prevention, abuse detection and platform integrity. Certain processing is essential to the operation and security of our platform; where your objection would prevent us from carrying out those core functions, we may be unable to provide you with continued access to our services. This does not apply to direct marketing, which we will always stop on request.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of an alleged infringement, or, in the United Kingdom, with the Information Commissioner's Office (ico.org.uk). We would appreciate the opportunity to address your concerns first, but you may contact the authority at any time.
Questions about this Policy or our processing of your personal data may be addressed to our privacy team at privacy@thinkcapital.com.
We have appointed TF Global Markets (Europe) Ltd, of Agias Fylaxeos 82, 3025 Limassol, Cyprus (Registration No. HE 321503), as our representative in the European Union under Article 27 of the GDPR. You may contact our representative on any matter relating to the processing of your personal data.
We use automated systems to monitor activity on challenge and funded accounts against the rules of your programme (for example drawdown limits and prohibited trading practices) and to detect fraud and abusive conduct, which may include profiling of transaction behaviour and device and network signals.
11. Sending information overseas
We may transfer your personal data to group companies and service providers located outside your country of residence, including, but not limited to, the United Kingdom, Saint Lucia, Australia and the United States. Where a destination has not been found adequate by the European Commission or the United Kingdom, we protect the transfer with appropriate safeguards, namely the European Commission's Standard Contractual Clauses and, for transfers from the United Kingdom, the International Data Transfer Agreement or Addendum. Transfers necessary to perform our contract with you, or made with your explicit consent, may also take place on those grounds. You may obtain a copy of the relevant safeguards, or further information about them, by contacting privacy@thinkcapital.com.
12. Failure to provide personal data
ThinkCapital needs to collect your personal data as part of statutory obligations or as part of the contractual arrangements we have with you. If you fail to provide that data when requested, we will not be able to perform the contract we have or are trying to enter with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.
13. Management of personal information
ThinkCapital recognises the importance of securing all personal information of our customers. We implement appropriate technical and organisational measures to ensure the confidentiality, integrity, availability and resilience of our systems, protecting your personal information against unauthorised or unlawful processing and against accidental loss, destruction or damage.
Your personal information is generally stored in our encrypted databases. Any paper files are stored and maintained in secure areas. To protect the data we collect and process against unauthorised access, alteration, disclosure or destruction, we have implemented and strictly adhere to robust organisational and technical measures.
14. Recording of telephone conversations and of electronic communication
We may record and monitor telephone conversations and electronic communications between us, including email and messages exchanged through our websites and client portal, for quality assurance, security, dispute resolution, fraud prevention and compliance purposes. We will tell you when a call is being recorded. Copies of such records will be provided to you on request, in the language in which the Services were provided to you.
15. Direct marketing
We send direct marketing to prospective customers only with your consent. We may send marketing about our own similar services to existing customers without prior consent, provided you were given a clear opportunity to opt out when we collected your details and in every message since. Every marketing message we send contains a simple means of opting out, and you may opt out at any time by contacting privacy@thinkcapital.com or using the unsubscribe link. Your right to object to direct marketing is unconditional: if you object, we will stop. If we obtained your contact details from a third party, we will tell you the source of that information on request, free of charge.
16. How does ThinkCapital keep personal information accurate and up to date?
We are committed to ensuring that the personal information we collect, use and disclose is relevant, accurate, complete and up to date.
We encourage you to contact us to update any personal information we hold about you. If we correct information that has previously been disclosed to another entity, we will notify each recipient to whom it was disclosed, unless this proves impossible or involves disproportionate effort. Where we are satisfied information is inaccurate, we will take reasonable steps to correct the information within one month, unless you agree otherwise.
We retain your personal information only for as long as necessary for the purposes for which it was collected, including satisfying legal, tax, accounting and regulatory requirements, and in accordance with the retention periods set out in the European Union, United Kingdom and Switzerland section below and our internal retention schedule. When personal data is no longer required, we delete or anonymise it; if that is not immediately practicable, we securely store it and restrict access until deletion is possible.
17. Accessing your personal information
Subject to limited exceptions, you may request access to the personal information we hold about you by contacting privacy@thinkcapital.com. We will respond within one month of your request. If we refuse a request, we will tell you why and how to complain.
We will need to verify your identity and may ask you to specify the information you require.
18. Updates to this Privacy Policy
This Privacy Policy is reviewed at least annually and whenever our processing, the law or our business changes materially. If we make material changes, we will notify you by email or by prominent notice on our website before the changes take effect, and we will update the date shown at the top of this Policy.
19. Responsibilities
We train our employees in the appropriate handling of personal information, and we require our employees and relevant third parties to comply with this Privacy Policy.
Personal information we collect and hold is governed by the version of this Privacy Policy published on our website at the relevant time. It is important that the personal data we hold about you is accurate and current; please keep us informed if your personal data changes during your relationship with us.
It is important that you read this policy together with any other policy statement or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This policy supplements the other notices and is not intended to override them.
20. Children
Our services are available only to persons aged 18 or over. We do not knowingly collect personal data from anyone under 18; if we become aware that we hold such data, we will delete it. Age is verified as part of our identity verification process.
21. Incidents/Complaints handling/Making a complaint
If you have any questions about this Privacy Policy, or wish to complain about how we have handled your personal information, contact us at privacy@thinkcapital.com. We will acknowledge your complaint within two (2) business days, investigate it, and respond within one month. If you are not satisfied with our response, you may refer the matter to the supervisory authority described in the section on your rights above.
22. Contractual arrangements with third parties
Third parties will be required to implement policies in relation to the management of your personal information in accordance with relevant law. These policies include:
- regulating the collection, use and disclosure of personal information (including special category data);
- de-identifying personal information (including special category data) wherever possible;
- ensuring that personal information (including special category data) is kept securely, with access to it only by authorised employees or agents of the third parties; and
- ensuring that the personal information (including special category data) is only disclosed to organisations which are approved by us.
23. European Union, United Kingdom and Switzerland
This section applies to users located in the European Union, the United Kingdom or Switzerland. The EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation and Data Protection Act 2018 (together, UK GDPR) and the Swiss Federal Act on Data Protection require us to state the legal grounds for processing your personal data. The legal ground for each purpose is set out in the section on why we collect and hold personal information; in summary, we process your information based on the following legal grounds:
- Consent: we process your information where you have given consent for a specific purpose. You may withdraw your consent at any time by emailing privacy@thinkcapital.com; withdrawal does not affect the lawfulness of processing carried out before withdrawal.
- Legitimate interests: we may use your information where necessary for the specific legitimate interests listed in the section on why we collect and hold personal information, provided those interests are not outweighed by your interests and fundamental rights.
- Legal obligation: we may process your information to fulfil our legal obligations, such as cooperating with law enforcement or regulatory bodies, defending our legal rights, or using your information as evidence in pertinent legal proceedings. Additionally, we may process your information if it is essential to protect your vital interests or the vital interests of others, for example in emergency situations where safety is at stake.
We process personal data for the following periods of time:
- For the purpose of performance of the contract and for the exercise of rights and obligations in connection with the contract, including any complaints, settlement of damage claims or related litigation, personal data are processed for the necessary period of time, but not more than 10 years from the termination of the last contract, or such longer period as is required by applicable law or regulation;
- For the purpose of sending business communications without your given consent, personal data are processed for a maximum of 5 years from the expiry of the last contract between us or until you raise an objection or unsubscribe from the business communications;
- For the purpose of enhancing our services, we usually process personal data for a maximum period of 6 months;
- In order to fulfil our legal obligations, we process personal data for the period set out by the relevant legal regulations (e.g. in accordance with tax regulations for a period of 10 years from the issuance of the relevant documents relating to your purchase);
- If you have given your consent, for the period specified in the consent.
Where we obtain personal data about you from sources other than you, those sources are: identity and electronic verification service providers; sanctions and politically exposed person screening providers; payment service providers and banks; marketing affiliates and referrers; and analytics providers. We will tell you that we hold this data within one month of obtaining it, or at our first communication with you, whichever is earlier, unless you already have the information.
24. Canada
If you are in Canada, our privacy officer is accountable for our compliance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act, and can be reached at privacy@thinkcapital.com. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; withdrawal may affect our ability to provide the services. Canadian residents may complain to the Office of the Privacy Commissioner of Canada. For Quebec residents, the relevant person in charge of the protection of personal information is also reachable at privacy@thinkcapital.com; your personal information may be communicated outside Quebec.