1. INTRODUCTION

1.1 Israel Interactive Trading is a brand of MEXEM LIMITED (hereinafter referred to as the “Company”) which is registered under Cyprus Company Law. It is authorised and regulated as a Cyprus Investment Firm (“CIF”) with License Number 325/17 by the Cyprus Securities and Exchange Commission (“CySEC”, hereinafter referred to as the “Commission”), under the Investment Services and Activities and Regulated Markets Law of 2007, as amended (Law 144(I)/2007 and subsequent amendments, including Law 165(I)/2023) (hereinafter referred to as the “Laws”), and is subject to the Rules and Directives of the Commission. The Company, as a regulated investment firm, is governed by the Markets in Financial Instruments Directive (“MiFID”), which provides a harmonised regulatory framework for investment services across the European Economic Area (“EEA”).

1.2 This Privacy Policy outlines how we collect, use, store, share, and protect personal data when providing our investment and ancillary services in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Law on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of such Data (Law 125(I)/2018) (hereinafter referred to as “Law 125(I)/2018”), and all other relevant laws of the European Union (“EU”) and the Republic of Cyprus.

1.3 This Policy applies to all personal data collected from individuals who are prospective, current, or former clients; visitors to any of our websites, including www.mexem.com, www.inter-il.com, www.c2gateway.com and trade.collective2.eu; and any other individuals whose data we may lawfully process in connection with our services and affiliated brands operated by MEXEM LTD.

1.4 We are committed to safeguarding your privacy and ensuring the lawful, fair, and transparent processing of your personal data in accordance with our legal and regulatory obligations.

2. COLLECTION OF PERSONAL INFORMATION

2.1 We collect personal information from clients, prospective clients, and other individuals in the course of providing our investment services and complying with legal and regulatory obligations, including those related to anti-money laundering (“AML”) and know-your-customer (“KYC”) requirements.

2.2 When you register with us or engage our services, you provide personal data directly to us. This information is necessary for us to assess your application, perform due diligence checks, provide services, fulfill contractual obligations, and comply with applicable laws. In particular, it is required for the purpose of facilitating the opening of a trading account with Interactive Brokers Ireland Limited, where we act as an introducing broker.

2.3 We rely on legal bases including contractual necessity, legal obligation, and, in specific cases, your consent (e.g. for marketing) to collect and process your personal data.

2.4 You are required to provide accurate, complete, and up-to-date information. You must act on your own behalf and not impersonate any other individual or provide false information.

2.5 In addition to the information you provide, we may collect data automatically through your use of our website and online platforms. This includes technical and usage data gathered through cookies and similar technologies. Such tools help us improve website performance, enhance security, and understand user behavior.

2.6 You may choose to accept or reject cookies. Most web browsers accept cookies automatically, but you can change your browser settings to decline them. Please note that disabling cookies may affect website functionality.

2.7 All personal data is collected in accordance with strict internal procedures and is only accessible to authorized personnel for legitimate business and compliance purposes.

3. CATEGORIES OF PERSONAL DATA COLLECTED

3.1 Depending on your relationship with us, we may collect the following categories of personal data:

a) Identification Data: Full name, gender, date of birth, nationality, ID/passport number, copies of ID documents, signature.

b) Contact Data: Email address, phone number, residential and mailing address.

c) Financial and Tax Information: Employment details, source of wealth/funds, income, investment objectives, tax residency, Tax Identification Number (TIN).

d) Transaction and Account Data: Trading history, holdings, deposits, withdrawals, account balances, order activity.

e) Compliance and AML/KYC Data: PEP status, sanctions screening, documentation for due diligence.

f) Technical and Website Usage Data: IP address, browser type, device identifiers, operating system, login timestamps, geolocation, clickstream data, cookies and related tracking technologies.

g) Marketing and Communication Preferences: Opt-in/opt-out records, consent history, marketing responses.

h) Support and Correspondence Records: Communications via email, phone, website chat, or other channels, including service-related interactions.

3.2 We may also collect personal data from third-party sources, such as publicly available databases, credit reference agencies, fraud prevention services, or sanctions lists, to comply with legal requirements and assess client eligibility.

4. GOOGLE ACCOUNT INTEGRATION

4.1 We offer users the option to sign up for or log in to our services using their Google account credentials via the Google OAuth 2.0 authentication protocol.

4.2 If you choose to authenticate using your Google account, we will request your explicit authorization to access specific personal data associated with that account. This typically includes your first name, last name, and email address, and may include other information strictly necessary to create and manage your account with us.

4.3 The personal data obtained from your Google account will be used solely for the purposes of:

a) Verifying your identity,

b) Creating and managing your client profile, and

c) Facilitating secure access to our platform.

4.4 We do not collect or access any additional data from your Google account beyond what is required for these limited purposes, nor do we share this data with third parties unless required to do so by law or with your explicit consent.

4.5 By using your Google account to register or log in, you provide your consent to this data access and use as outlined in this section. You may revoke this authorization at any time through your Google account settings.

4.6 We maintain appropriate technical and organizational measures to ensure the confidentiality, integrity, and security of all personal data accessed through this integration.

5. SHARING PERSONAL INFORMATION WITH THIRD PARTIES

5.1 We do not sell or rent your personal information. We only disclose it to third parties where necessary for the provision of services, to comply with legal obligations, or where you have provided your consent.

5.2 We may share your personal data with third parties under the following lawful bases:

a) To comply with legal or regulatory obligations, including those imposed by CySEC, tax authorities, or AML legislation.

b) To perform our contractual obligations, including facilitating your account with Interactive Brokers, where we act as an introducing broker.

c) With your explicit consent, where required — for example, for marketing purposes or where you instruct us to do so.

d) To protect your legitimate interests, such as preventing fraud, securing your account, or resolving disputes.

5.3 In each case, we limit the disclosure to only the information necessary for the specific purpose and ensure that the recipient is contractually bound to maintain the confidentiality and security of your personal data.

5.4 Personal data may be disclosed to:

a) Service providers and professional advisors assisting us in delivering operational, legal, audit, IT, compliance, or support services.

b) Regulatory and supervisory authorities, courts, or other public bodies where disclosure is required by applicable law.

c) Interactive Brokers, for the purpose of account onboarding, execution, and custody services, in accordance with our Terms and Conditions.

5.5 In limited cases, certain third-party technology providers that support our platform infrastructure may have potential access to personal data when providing development or maintenance services. These providers do not process personal data on their own behalf but may access it solely to fulfill technical or operational requirements, such as ensuring functionality or resolving system issues. Such access is strictly governed by appropriate confidentiality obligations, contractual safeguards (including Standard Contractual Clauses where required), and security measures in line with applicable data protection laws.

5.6 We take appropriate contractual and organizational measures to ensure that any third party receiving personal data from us processes it in compliance with applicable data protection laws and only for the intended purpose.

6. USE OF PERSONAL INFORMATION

6.1 We use the personal data we collect for the following purposes, in accordance with our legal obligations, contractual commitments, and legitimate interests:

a) Account management and service delivery: To establish, manage, and administer your account, verify your identity, and execute your instructions in connection with services provided by MEXEM.

b) Regulatory compliance: To meet legal and regulatory requirements, including AML, tax reporting, market abuse prevention, and obligations under CySEC, MiFID II, and GDPR.

c) Transaction monitoring and fraud prevention: To monitor transactions and activity for the purposes of fraud detection, financial crime prevention, and risk management.

d) Dispute resolution and legal claims: To store and use data in connection with resolving client disputes or defending legal or regulatory claims.

e) Service improvement and analytics: To conduct internal analysis, performance tracking, and service optimization. This may include anonymized or aggregated data for system testing, usage trends, or client behavior analytics.

f) Marketing and communication (only with your consent or where otherwise permitted): To send you service-related notices or marketing communications, subject to your preferences and applicable laws.

g) Audit and internal controls: To conduct audits, assessments, and enforce internal security or operational procedures.

6.2 We rely on different legal bases for processing, including:

a) Contractual necessity – for account creation and service provision.

b) Legal obligation – to meet CySEC, AML, and other regulatory requirements.

c) Legitimate interests – to improve services, detect fraud, and manage operational risks.

d) Consent – for sending marketing communications, if and where legally required.

6.3 From time to time, we may contact you by email or phone for:

a) Market research purposes, or

b) To provide information about our services, promotions, or updates that may be of interest to you.

6.4 You may opt out of receiving such communications at any time, either through the unsubscribe option in our messages or by contacting us directly. We do not send marketing messages without your consent, where such consent is required under applicable laws.

6.5 Monitoring and Recording Communications

In accordance with legal and regulatory requirements (including MiFID II), we may record or monitor communications between you and MEXEM. This includes, but is not limited to, telephone calls, emails, and chat sessions via our platforms. Such recordings may be used for training, quality assurance, regulatory audits, dispute resolution, and fraud prevention.

7. SECURITY OF PERSONAL INFORMATION

7.1 We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or alteration, in accordance with our obligations under the GDPR, the Cyprus Law 125(I)/2018, and relevant guidance from the Office of the Commissioner for Personal Data Protection.

7.2 These measures include, but are not limited to:

a) Encryption and secure data transmission protocols,

b) Network and system access controls,

c) Multi-factor authentication,

d) Data loss prevention tools,

e) Ongoing monitoring of systems and infrastructure, and

f) Physical access controls at our facilities.

7.3 Access to personal data is strictly limited to authorized personnel who require access for legitimate business or regulatory purposes. All employees and service providers are subject to confidentiality obligations and receive regular training on data protection and information security.

7.4 Our internal data protection policies are reviewed and updated regularly to reflect changes in technology, regulatory expectations, and industry best practices. We also assess and test our security measures periodically to ensure continued effectiveness and resilience.

8. TRANSFERRING YOUR PERSONAL INFORMATION OUTSIDE THE EEA

8.1 In the course of providing our services, we may transfer your personal data to countries outside the European Economic Area (“EEA”). This may include transfers to jurisdictions that do not offer the same level of data protection as those within the EEA, such as the United States or other third countries.

8.2 Where such transfers occur, we ensure that they are conducted in compliance with the GDPR and other applicable laws. Specifically, we implement appropriate safeguards such as:

a) Adequacy decisions issued by the European Commission;

b) Standard Contractual Clauses (“SCCs”) adopted by the European Commission;

c) Other lawful mechanisms recognized under GDPR.

These safeguards are designed to ensure that your personal data receives an adequate level of protection, even when transferred outside the EEA.

8.3 You may contact us at any time using the details provided in this policy to request more information about the safeguards we apply to international data transfers.

9. UPDATING YOUR PERSONAL INFORMATION

9.1 It is important that the personal information we hold about you is accurate, complete, and up to date. Please inform us promptly if your details change — for example, if you update your email address, residential address, or contact number.

9.2 You can update your information or notify us of changes by contacting Mexem Customer Service through our website at www.mexem.com or by using the contact details provided in this policy.

9.3 Providing accurate and current information helps ensure that we can continue to provide our services effectively and in compliance with applicable legal and regulatory requirements.

10. RETENTION OF PERSONAL INFORMATION

10.1 We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to comply with legal, regulatory, accounting, and reporting obligations.

10.2 Retention periods are determined based on the type of data, the nature of our relationship with you, and our obligations under applicable law — including regulations imposed by the CySEC and AML legislation. In particular, we may retain personal data:

a) For the duration of our contractual relationship with you.

b) For up to five (5) years (or longer, if required) after the end of our business relationship, in accordance with AML laws.

c) For the duration of any ongoing legal claim, regulatory investigation, or dispute resolution process.
10.3 We review our data retention policies regularly to ensure that personal data is not kept longer than necessary. When data is no longer required, it is securely deleted or anonymized in accordance with our internal procedures.

11. RIGHTS OF INDIVIDUALS UNDER GDPR

11.1 If you are located in the EEA, or where the GDPR applies to the processing of your personal data, you have the following rights:

a) Right of Access: You can request confirmation as to whether we process your personal data and receive a copy of that data.

b) Right to Rectification: You can ask us to correct any inaccurate or incomplete personal information.

c) Right to Erasure: You may request the deletion of your personal data in specific circumstances. We may retain certain data where required by law or regulatory obligations.

d) Right to Restriction of Processing: You can request that we restrict the processing of your data in specific cases (e.g. while a correction or objection request is under review).

e) Right to Object: You can object to the processing of your personal data where we rely on legitimate interests as the legal basis, including for direct marketing.

f) Right to Data Portability: Where processing is based on consent or contract, you may request your data in a structured, commonly used, and machine-readable format.

g) Right to Withdraw Consent: Where we rely on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.

Please note that some rights may be subject to legal exceptions or conditions. For example, we may refuse access if disclosure would violate the rights of another individual or where legal privilege applies.

11.2 To exercise your rights, please contact our Data Protection Officer (“DPO”) at [email protected]. We may request proof of identity before fulfilling any request to protect against unauthorized access or disclosure of personal data.

11.3 We reserve the right to charge a reasonable administrative fee for any manifestly unfounded or excessive requests or for additional copies of the data you request.

11.4 If you are not satisfied with our response, you may take your complaint to the relevant privacy regulator. We will provide you with the contact details of the appropriate supervisory authority upon request.

12. OPT-OUT FROM MARKETING COMMUNICATIONS

12.1 You have the right to opt out of receiving marketing or promotional communications from us at any time. You can do so by contacting us at [email protected] with your request.

12.2 Once we receive your request, we will update your preferences and ensure that no further marketing communications are sent to you. Please note that even after opting out, you may continue to receive important service-related or regulatory communications necessary for the management of your account.

13. MEXEM GROUP COOKIE POLICY

13.1 What Are Cookies and Web Beacons?

Cookies are small text files placed on your device when you visit a website. They help store information about your session and preferences, enabling the site to function efficiently and enhance your user experience.

Web beacons (also known as pixel tags) are tiny transparent images embedded in emails or websites that allow us to collect limited information, such as whether a message was opened or a page was viewed.

Cookies and web beacons may collect data including your device type, browser, IP address, general location, pages visited, time spent on the site, and referral sources.

13.2 How We Use Cookies and Web Beacons

We use cookies and web beacons to improve the functionality, performance, and security of our website, and to better understand how users interact with our content.

Cookies and similar technologies are used across all websites operated by MEXEM LTD, including www.mexem.com, www.inter-il.com, www.c2gateway.com, and trade.collective2.eu. These technologies help enhance your browsing experience, analyze site traffic, and support the delivery of targeted advertising. By using any of our websites, you consent to the use of cookies in accordance with this Policy:

a) Strictly necessary cookies – to enable core site functionality such as security, authentication, and network management.

b) Performance cookies – to collect anonymous data about how visitors use our website, so we can improve its performance and usability.

c) Functional cookies – to remember your preferences and enhance your browsing experience.

d) Marketing and targeting cookies – to deliver relevant advertising or content based on your browsing behavior.

Certain cookies may be set by trusted third-party service providers, such as analytics and marketing platforms.

Additionally, third-party tools embedded in our website — including the trading portal hosted by Interactive Brokers — may place cookies when used. Please refer to their privacy and cookie policies for further details.

You can manage your cookie preferences through the cookie banner presented when you visit our website, or by adjusting your browser settings.

13.3 Strictly Necessary Cookies

These cookies are essential for the basic operation of our website and cannot be disabled through our cookie settings. They are typically set in response to actions taken by you, such as logging in, setting privacy preferences, or completing forms.

You can configure your browser to block or alert you about these cookies; however, doing so may impair some parts of the site and prevent it from functioning properly.

Strictly necessary cookies do not collect information that identifies you directly. However, they may store technical data required for secure access and core functionality.

13.4 Performance Cookies and Web Beacons

These cookies and web beacons help us understand how visitors interact with our website by collecting and reporting information on usage patterns. They allow us to count visits, analyze traffic sources, and identify which pages are most and least popular — enabling us to improve site performance and user experience.

The data collected is aggregated and does not directly identify individuals. However, some usage information (such as IP addresses) may constitute personal data under applicable data protection laws.

We use Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies to gather statistical information about how visitors use our site. This information may include your IP address, browser type, device information, and browsing behavior. It is transmitted to and stored by Google on servers that may be located outside the EEA, including in the United States.

We have implemented appropriate safeguards for such transfers, including Standard Contractual Clauses approved by the European Commission. For more information, please refer to Google’s privacy policy: https://policies.google.com/privacy.

You may opt out of Google Analytics by using the tools provided in our cookie consent manager or via Google’s browser add-on: https://tools.google.com/dlpage/gaoptout.

13.5 Functional Cookies

Functional cookies allow the website to offer enhanced features and personalized content, such as remembering your preferences or enabling interactive tools. These cookies may be set by us or by third-party service providers whose functionalities are integrated into our website (e.g. support chat, language settings, or embedded media).

If you disable these cookies, certain website features may not function as intended, and your user experience may be limited.

13.6 Marketing and Targeting Cookies

Marketing and targeting cookies (and related web beacons) may be set by us or by third-party advertising partners to build a profile of your interests and deliver relevant advertisements across websites.

These cookies typically identify your browser and device and may track your browsing activity over time and across different websites. While they do not store directly identifiable personal information such as your name or contact details, the data they collect may be used to create behavioral user profiles — which can be considered personal data under applicable data protection laws.

If you disable these cookies, you will still see advertisements, but they may be less relevant to your interests.

Our website does not currently respond to browser “Do Not Track” (DNT) signals, as there is no universally accepted standard for honoring such signals.

You can manage your consent preferences for these cookies using the cookie banner on our site or by adjusting your browser settings.

14. INTERNATIONAL TRANSFERS OF PERSONAL DATA

14.1 In the course of maintaining and supporting our IT infrastructure, limited access to personal data may be granted to certain third-party service providers located outside the European Economic Area (“EEA”). These providers do not process personal data on their own behalf but may have access to it strictly for the purposes of delivering technical support or development services. Such access is subject to robust contractual safeguards, including Standard Contractual Clauses (“SCCs”) or other appropriate mechanisms, to ensure an adequate level of protection in line with applicable data protection laws.

15. CHANGES TO THIS PRIVACY POLICY

15.1 We may update this Privacy Policy from time to time to reflect legal, regulatory, or operational changes, or to align with updates to our services and internal practices. When changes are made, we will revise the “Last Updated” date shown at the end of this document.

The most current version of the Privacy Policy will always be available on our official websites, including but not limited to:

• www.mexem.com
• www.inter-il.com
• www.c2gateway.com
• trade.collective2.eu

We encourage you to review the Privacy Policy periodically to stay informed about how we collect, use, and protect your personal data.

16. CONTACT INFORMATION

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal information, you may contact us using the details below:

• Email: [email protected]
• Phone: +357 24022446
• Website: www.mexem.com

For privacy-related matters, including data subject rights under GDPR, you may also contact our Data Protection Officer (DPO) at [email protected].

July 2025