Privacy Policy

This Privacy Policy ("Policy") describes how Bishop ("we", "us", or "our") collects, uses, stores, shares, and protects your personal information when you access or use Bishop ("Platform"). By registering an account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy is incorporated by reference into our Terms of Service.

1. Information We Collect

We collect information in the following categories in order to provide, maintain, and improve the Platform:

2. How We Use Your Information

We process your personal information for the following purposes, each supported by a lawful basis under applicable data protection law:

• Account Management: To create, verify, maintain, and secure your account, including processing identity verification and authentication.
• Platform Operations: To facilitate trading, process deposits and withdrawals, settle markets, and provide all core Platform functionality.
• Compliance and Legal Obligations: To comply with applicable laws and regulations, including anti-money laundering (AML), know-your-customer (KYC), counter-terrorism financing (CTF), and tax reporting requirements.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, market manipulation, unauthorised access, and other prohibited conduct.
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance.
• Communications: To send transactional notifications (trade confirmations, withdrawal alerts, security notices) and, where you have opted in, promotional communications about new features and offers.
• Analytics and Improvement: To analyse usage patterns, monitor Platform performance, conduct research, and improve our products and services.
• Personalisation: To tailor your experience on the Platform, including recommending markets and displaying relevant content based on your trading history and preferences.
• Responsible Trading: To monitor trading behaviour and enforce responsible trading tools such as deposit limits and self-exclusion.
• Legal Claims: To establish, exercise, or defend legal claims arising in connection with the Platform.

3. Legal Bases for Processing

Where applicable data protection law requires a lawful basis for processing, we rely on the following:

• Contractual Necessity: Processing required to perform our contract with you, including operating your account, executing trades, and processing payments.
• Legal Obligation: Processing necessary to comply with applicable laws, including AML/KYC regulations, tax obligations, and regulatory reporting requirements.
• Legitimate Interests: Processing for our legitimate business interests, including fraud prevention, Platform security, analytics, and improving our services, where such interests are not overridden by your rights.
• Consent: Processing based on your explicit consent, such as for marketing communications or optional data collection. You may withdraw consent at any time without affecting the lawfulness of prior processing.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies we use are as follows:

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may impair the functionality of the Platform. For more information, refer to your browser's help documentation.

5. Third-Party Sharing and Disclosure

We do not sell your personal information to third parties. We may share your information in the following circumstances:

• Service Providers: We share data with trusted third-party vendors who assist us in operating the Platform, including payment processors (Stripe, M-Pesa), cloud hosting providers, identity verification services, email delivery providers (Resend), analytics platforms, and customer support tools. These providers are contractually bound to process your data only on our instructions and in accordance with applicable law.
• KYC and AML Partners: We share identity documents and verification data with regulated third-party KYC/AML service providers to fulfil our legal compliance obligations.
• Legal and Regulatory Authorities: We may disclose your information to law enforcement agencies, regulatory bodies, courts, or other government authorities where required by law, court order, or regulatory directive, or where we believe disclosure is necessary to protect the rights, property, or safety of Bishop, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of our business, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you of any such transfer and any changes to this Policy.
• With Your Consent: We may share your information with third parties where you have given explicit consent, such as for integration with third-party services you choose to connect to your account.
• Aggregated or Anonymised Data: We may share aggregated, anonymised, or de-identified data that cannot reasonably be used to identify you with partners, researchers, or the public for analytical or promotional purposes.

6. International Data Transfers

Bishop operates globally, and your personal data may be transferred to and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction. Where we transfer personal data internationally, we implement appropriate safeguards to ensure your data remains protected, including:

• Standard contractual clauses approved by relevant data protection authorities.
• Adequacy decisions recognising the destination country's data protection standards.
• Binding corporate rules where applicable.
• Other legally recognised transfer mechanisms under applicable data protection law.

By using the Platform, you acknowledge and consent to the transfer of your personal data to countries outside your jurisdiction as described in this section.

7. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Account Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, as required by AML and financial regulations.
• KYC and Identity Documents: Retained for a minimum of five (5) years following the end of the business relationship, in accordance with applicable anti-money laundering legislation.
• Transaction Records: Retained for a minimum of seven (7) years to comply with financial record-keeping and tax reporting obligations.
• Communications and Support Records: Retained for up to three (3) years following the resolution of the relevant matter.
• Marketing Data: Retained until you withdraw consent or opt out of marketing communications, after which it is deleted or anonymised.
• Technical Logs: Retained for up to twelve (12) months for security and performance monitoring purposes.

When data is no longer required, we securely delete or anonymise it in accordance with our data disposal procedures. Certain data may be retained for longer periods where required by law or where we have a legitimate interest in doing so, such as in connection with ongoing legal proceedings.

8. Data Security

We implement comprehensive technical and organisational security measures to protect your personal information against unauthorised access, disclosure, alteration, loss, or destruction. Our security practices include:

• Encryption of data in transit using TLS/SSL protocols and encryption of sensitive data at rest.
• Strict access controls ensuring that only authorised personnel can access personal data on a need-to-know basis.
• Multi-factor authentication requirements for administrative access to systems containing personal data.
• Regular security assessments, penetration testing, and vulnerability scanning of our infrastructure.
• Incident response procedures to detect, contain, and remediate data security incidents promptly.
• Employee training on data protection and security best practices.
• Contractual security obligations imposed on all third-party service providers who process personal data on our behalf.

Despite these measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your data. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

9. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights in relation to your personal data. We are committed to honouring these rights in accordance with applicable law:

• Right of Access: You have the right to request a copy of the personal data we hold about you and information about how we process it.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data we hold about you.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent. This right is subject to our legal retention obligations.
• Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances, such as while a dispute about accuracy is resolved.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on our legitimate interests, including profiling, and to opt out of direct marketing at any time.
• Rights Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce significant legal or similarly significant effects, unless such processing is necessary for a contract or authorised by law.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact our Privacy Team at privacy@bishopmarkets.com. We will respond to your request within 30 days. We may need to verify your identity before processing your request. In some cases, we may be unable to fulfil your request due to legal obligations or other legitimate grounds, in which case we will explain the reasons.

10. Children's Privacy

The Platform is strictly intended for users who are 18 years of age or older (or the legal age of majority in their jurisdiction, whichever is higher). We do not knowingly collect, solicit, or process personal information from individuals under the age of 18. If you are under 18, you must not use the Platform or provide any personal information to us. If we become aware that we have inadvertently collected personal data from a person under 18, we will take immediate steps to delete that information from our systems and close any associated account. If you believe a minor has provided us with personal information, please contact us immediately at privacy@bishopmarkets.com.

11. Third-Party Links and External Services

The Platform may contain links to third-party websites, applications, or services that are not operated or controlled by Bishop. This Policy does not apply to those third-party services. We have no control over and assume no responsibility for the content, privacy practices, or security of any third-party sites or services. We encourage you to review the privacy policies of any third-party services you access through the Platform before providing any personal information.

Third-party services integrated into the Platform, such as payment processors (Stripe, M-Pesa) and analytics providers, operate under their own privacy policies. By using these integrated services, you are also subject to their respective privacy terms.

12. Marketing Communications and Preferences

With your consent, we may send you promotional emails, push notifications, and in-platform messages about new features, markets, promotions, and other updates related to the Platform. You can manage your communication preferences at any time by:

• Updating your notification settings in your account profile.
• Clicking the "unsubscribe" link in any marketing email we send you.
• Contacting our support team at support@bishopmarkets.com.

Please note that even if you opt out of marketing communications, we will continue to send you transactional and service-related messages that are necessary for the operation of your account, such as trade confirmations, withdrawal notifications, and security alerts. These communications cannot be opted out of while your account remains active.

13. Regulatory Compliance and KYC/AML Processing

As a financial services platform, Bishop is subject to regulatory obligations that require us to collect and process certain personal information regardless of your consent preferences. These obligations include:

• Identity Verification (KYC): We are required by law to verify the identity of all users before allowing deposits, withdrawals, or trading above certain thresholds. This involves collecting and verifying government-issued identification documents and proof of address.
• Anti-Money Laundering (AML): We monitor transactions and account activity for signs of money laundering, terrorist financing, and other financial crimes. We are required to report suspicious activity to relevant authorities without notifying the subject of the report.
• Sanctions Screening: We screen users against international sanctions lists and may be required to freeze or restrict accounts identified as matching sanctioned individuals or entities.
• Tax Reporting: We may be required to collect and report certain financial information to tax authorities in applicable jurisdictions, including information about your trading activity and winnings.

Processing carried out for regulatory compliance purposes is based on our legal obligations and cannot be restricted or objected to. Failure to provide required information may result in restrictions on your account or termination of our services to you.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by posting the updated Policy on the Platform and updating the "Last updated" date at the top of this page. For significant changes that materially affect how we process your personal data, we will provide more prominent notice, which may include an email notification to the address associated with your account. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must stop using the Platform and may request account closure. Changes to this Policy do not affect your rights and obligations under our Terms of Service.

15. Contact Us and Data Protection Enquiries

If you have any questions, concerns, or complaints about this Privacy Policy, our data processing practices, or wish to exercise your privacy rights, please contact our Privacy Team:

We will acknowledge your request within 5 business days and aim to resolve all privacy enquiries within 30 days. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. For questions relating to your account, trading activity, or general platform usage, please also refer to our Terms of Service.