The official text of the Privacy Notice and Cookie Policy, in the version in force.
SOCIALEAT S.R.L. — STA — Super Trading Agents
Version 1.8 - 03/10/2026
STA - Super Trading Agents is a software product and a digital service of Socialeat S.r.l. (VAT no./Tax code 13257270960; registered office: Via G. Compagnoni 26, 20129 Milano (MI), Italy; e-mail: info@socialeat.net; tel. +39 349 310 6730). STA is not a separate legal entity: the contract, the provision of the Service and any fees are the responsibility of Socialeat S.r.l.
The data controller is Socialeat S.r.l., registered office Via G. Compagnoni 26, 20129 Milano (MI), Italy, VAT no./Tax code 13257270960, e-mail info@socialeat.net, tel. +39 349 310 6730. Privacy requests may be sent to info@socialeat.net; requests sent to info@supertradingagents.com are forwarded to the competent channel.
STA — Super Trading Agents is a product of Socialeat S.r.l.; there is no separate data controller called STA.
| Purpose | Legal basis / interest pursued |
|---|---|
| Account creation, authentication, provision of STA, display of exchange data and management of the requested functions | Performance of the contract / pre-contractual measures (Art. 6.1.b GDPR). |
| Technical forwarding of orders specifically confirmed by the User, where the function is active | Performance of the contract (Art. 6.1.b), in compliance with the applicable regulatory perimeter. |
| Purpose | Legal basis / interest pursued |
|---|---|
| Calculation, invoicing and collection of the performance fee, including the transfer of the amount due through the specifically authorised withdrawal API permission | Performance of the contract (Art. 6.1.b) and tax/accounting obligations (Art. 6.1.c). |
| Security, fraud/abuse prevention, account protection, defence of rights | Legitimate interest of Socialeat and of the Users in security and protection of rights (Art. 6.1.f), with balancing and minimisation measures. |
| Improvement of models, quality and reliability of the Service using aggregated, anonymised or, when necessary, pseudonymised data | Legitimate interest (Art. 6.1.f). When data are irreversibly anonymised, the GDPR does not apply to the anonymous data. |
| Legal obligations, requests from the Authorities, accounting and tax obligations | Legal obligation (Art. 6.1.c). |
| E-mail marketing and other optional promotional communications | Consent (Art. 6.1.a), collected separately and revocable at any time. |
The data necessary to create the account, verify the acceptances, connect the exchange when requested and calculate the fees are necessary for the conclusion or performance of the contract: failure to provide them may prevent activation or specific functions. Data indicated as optional may be omitted without preventing the use of the functions that do not require them. Marketing consent is always optional and refusal does not affect access to STA.
The data may be processed by authorised personnel of Socialeat and by suppliers selected according to the role actually performed: hosting/cloud, security and monitoring, technical support, e-mail/push services, payment providers, accounting/legal consultants, the exchange connected by the User and, where used on personal data, artificial intelligence service providers. When they act on behalf of Socialeat, such parties are appointed data processors pursuant to Art. 28 GDPR; when they autonomously determine purposes and means, they act as independent controllers.
For AI services, Socialeat applies minimisation and, where possible, pseudonymisation, avoiding transmitting direct identifiers when not necessary. The updated list of the categories of processors and, where appropriate, of the main suppliers is made available on request or in the privacy area of the Service.
The primary infrastructure is preferably located in the European Economic Area. If a supplier processes personal data outside the EEA, Socialeat verifies the existence of an adequacy decision or adopts appropriate safeguards, including the standard contractual clauses of the European Commission and, when necessary, supplementary measures and transfer assessments. The User may request information on the safeguards applied and, within the limits of the law and of confidentiality obligations, a copy or an indication of where they are made available.
Trade cards are automated outputs relating to the market and do not, in themselves, constitute an automated decision on the User's personal profile within the meaning of Art. 22 GDPR: the User decides whether to confirm the transaction. Socialeat does not adopt decisions based solely on automated processing that produce legal or similarly significant effects on the User, unless a specific function requires it and it is managed in compliance with the conditions and safeguards provided for by the GDPR. Any fraud-prevention or security checks entailing significant limitations provide, where required by law, for the possibility of challenge and human intervention.
Socialeat adopts technical and organisational measures proportionate to the risk, including encryption, role-based access control, logging, segregation of secrets, vulnerability management and incident response procedures. The live API key includes the withdrawal permission exclusively because it is necessary to collect the performance fee: the application use of this permission is limited to the amount actually due and to the contractually authorised purposes. Where supported by the exchange, further technical restrictions are used, such as destination or IP whitelists and equivalent controls. In the event of a personal data breach, Socialeat applies Articles 33 and 34 GDPR when the relevant conditions are met.
| Category of data | Indicative term | Basis / criterion |
|---|---|---|
| Contractual, account and acceptance data | Up to 10 years from the end of the relationship, for the necessary part | Accounting/evidentiary obligations, limitation periods and legal protection; minimisation for data that are not necessary. |
| Trading data, executions, fee ledger and calculation documents | Up to 10 years from the end of the relationship, limited to the necessary data | Proof of the calculation of fees, accounting obligations and defence of rights. |
| Tax and accounting documentation | 10 years from recording or a different legal term | Art. 2220 of the Italian Civil Code and tax legislation. |
| Fee collection data and API withdrawal authorisation | For the duration of the relationship and thereafter for the period necessary for disputes, accounting obligations and defence of rights | Performance of the contract, proof of collection, accounting obligations and protection of rights. |
| Keys/API tokens | Deletion or rendering unusable without delay after revocation/closure; technical backups according to a limited cycle | Minimisation and security. Revoked keys cannot be reused. |
| Technical and security logs | As a rule 12 months; limited extension for incidents, litigation or legal obligations | Legitimate interest in security and protection of rights. |
| Support | 24 months from the closure of the request, unless there is litigation or further obligations | Complaint handling and quality of service. |
| Marketing | Until consent is withdrawn and in any case with periodic verification that it is still current | Consent; minimal retention in a suppression list to respect the opt-out. |
| Anonymised data | Possible further retention if anonymisation is irreversible | Anonymous data are no longer personal data within the meaning of the GDPR. |
The User may request access, rectification, erasure, restriction, portability in the cases provided for, objection to processing based on legitimate interest and withdrawal of consent without affecting the lawfulness of the previous processing. The User may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) and bring proceedings before the judicial Authority. Requests may be sent to info@socialeat.net.
This Cookie Policy describes the configuration provided for supertradingagents.com and for the web application. The actual technical configuration in production must be consistent with this notice.
If only strictly necessary technical cookies and tools are used, consent is not required and the information may be provided in this policy. If non-technical analytics, profiling, advertising or third-party technologies that are not strictly necessary are introduced, such tools are blocked until consent is collected through a compliant solution, with equally easy refusal and withdrawal.
Marketing communications sent on the basis of consent do not use pixels or open/click tracking techniques for further purposes unless the User has been specifically informed and the legal basis required by the applicable rules has been obtained. Simply subscribing to marketing does not automatically authorise further unnecessary tracking.
Cookies and local storage may be deleted through the browser settings and, for session elements, by logging out. Disabling the strictly necessary technical tools may prevent authentication or some functions. The actual list of tools, suppliers, purposes and durations must be kept up to date with respect to the production environment.
Version 3
