Privacy Policy

Last updated: 5 September 2026

This Policy sets out how Hi2morrow and its group entities collect, use, store and protect your personal data. It should be read together with the General Terms and Conditions, the Qualification Terms of Service, the Qualification Rules, the Cookie Policy and the Qualification Privacy Policy, which describes the data generated while you take part in a Qualification Program.

---

1. Introduction and Controller

1.1 Controller. Hitomorrow Assessment Data Classification and Analysis L.L.C, a limited liability company incorporated in the United Arab Emirates under Commercial License No. 1275729 (Register No. 2159450), is the controller of the personal data described in this Policy. In this Policy it is referred to as "we", "us", "our" or "hi2morrow". Where a group entity determines the purposes of processing on its own account, that entity acts as controller for the processing concerned and is identified below.

1.2 Group entities. The following entities may process your personal data in the roles described:

(a) Hitomorrow Assessment Data Classification and Analysis L.L.C (United Arab Emirates, Commercial License No. 1275729) — operator of the hi2morrow platform, the Client Section and the Qualification Programs, and the entity responsible for the services and the obligations arising from them;

(b) Neoway Trading Ltd (Republic of Cyprus, reg. no. HE443630, registered office: Agias Foteinis 19, Office 201, 2235 Nicosia, Cyprus), of which ninety-five per cent (95%) of the issued share capital is held by Hitomorrow Assessment Data Classification and Analysis L.L.C. It acts as payment agent and authorised representative for the collection of Qualification fees and related transactions and, where a separate written agreement has been concluded, as counterparty to real capital arrangements;

(c) Hitomorrow Securities LTD (Republic of Cyprus), regulated by the Cyprus Securities and Exchange Commission under CIF License No. 237/14 and wholly owned by Hitomorrow Assessment Data Classification and Analysis L.L.C — execution entity providing Direct Market Access where a Participant has entered into the applicable agreement;

(d) other group entities as disclosed from time to time on the Website.

1.3 Acceptance. By using the Website or the Services you acknowledge that we process your personal data as described in this Policy. Where processing depends on your consent, that consent is sought separately and may be withdrawn at any time.

---

2. Scope

2.1 This Policy applies to:

(a) visitors to www.hi2morrow.com and any related platform or subdomain, including the Client Section at trader.hi2morrow.com;

(b) individuals who register for, purchase or take part in a Qualification Program, the Test Flight, or any educational service;

(c) affiliates, partners and referrers;

(d) any person who contacts us by email, live chat, support ticket, messaging channel or telephone;

(e) individuals whose data we process in connection with identity verification, anti-money-laundering obligations, assessment for real capital allocation, or compliance monitoring.

2.2 Related documents. Cookies and similar technologies are dealt with in the Cookie Policy. Data generated by trading activity during a Qualification Program is dealt with in the Qualification Privacy Policy. Where a Participant enters into a separate agreement for the management of real capital, processing under that agreement is governed by the terms of that agreement and by the privacy notice issued by the contracting entity.

---

3. What Information We Collect and How We Collect It

3.1 Information You Provide to Us

3.1.1 Account and contact information. Full name, email address, telephone number, date of birth, nationality, country of residence and billing address.

3.1.2 Identity and verification information. Government-issued identity document (passport, national identity card or driving licence), proof of address, liveness or biometric verification data where permitted by law, occupation, source of funds, source of wealth, and any further documentation required to satisfy our regulatory obligations.

3.1.3 Profile and credentials. Username, password and other login details for the Client Section.

3.1.4 Payment information. Card details or other payment method information. Payments are processed by third-party payment providers and we do not store full card numbers on our systems.

3.1.5 Voluntary information. Anything you choose to tell us in correspondence, feedback, support requests, community channels or trading journals.

3.2 Information We Collect Automatically

3.2.1 Device and technical information. IP address, device identifiers, browser type and version, operating system, screen resolution and device type, collected for security and fraud prevention, and for analytics where you have consented to analytics cookies.

3.2.2 Usage and interaction information. Pages visited, time spent, login times, navigation paths, product engagement and interaction data.

3.2.3 Cookies and similar technologies. Identifiers stored on or read from your device, described in full in the Cookie Policy.

3.3 Qualification Program Data and Automated Risk Controls

3.3.1 Trading and performance data. Where you take part in a Qualification Program we record all activity on the Qualification Account, including orders, executions, open and closed positions, position sizes measured against Buying Power, realised and unrealised profit and loss, equity, entry and exit times, holding periods, drawdown, consistency measures, session data and behavioural patterns.

3.3.2 Rule-monitoring data. The same records are compared automatically and continuously against the parameters published for your tier, including the Daily Loss Limit, the AutoStop Threshold, the Maximum Loss, the Profit Target, the Best Day Rule under which the best Calendar Day is measured against the published proportion of the Profit Target and may raise that target, and the limit on the size of a single position. The system records each occasion on which a parameter is reached, the values recorded at that moment, and the action taken.

3.3.3 The AutoStop control. The AutoStop Threshold for your tier is set above the Daily Loss Limit for that tier. When aggregate realised and unrealised loss on the Qualification Account reaches that threshold, the system closes open positions and suspends trading for the remainder of that Calendar Day, without a person reviewing the matter first. Two (2) AutoStop events may occur within a calendar month without ending your participation; a third AutoStop event within the same calendar month ends the Qualification attempt. Section 13 sets out the data used, the basis for the processing and the safeguards which apply.

3.3.4 Integrity monitoring. We monitor for conduct prohibited under the Qualification Terms of Service, including coordinated activity between accounts, duplicate profiles, use of infrastructure intended to circumvent detection, and strategies designed to exploit platform or data-feed behaviour. This monitoring uses the trading records described above together with device, network and session data.

3.3.5 The Qualification Privacy Policy sets out these categories, the retention that applies to them, and what happens to them if you do not pass or stop taking part.

3.3.6 Verification of a trading record before a Level is allocated. At the tiers for which placement is verified, being Lead and Principal, a passing result is followed by a review of your trading activity outside the assessment, carried out before the corresponding Level is allocated. For that purpose we process the records and statements you provide, any references you give us together with the confirmations we obtain from them, the criteria published for the review, the conclusion reached and the date on which it was reached and, where the record does not support the tier purchased, the choice you make between the highest level the record supports and a refund of the participation fee. The lawful bases for this processing are those set out in Sections 5.1(a) and 5.1(c).

3.4 Information from Third Parties

3.4.1 We may receive information about you from identity verification and anti-money-laundering providers, including biometric or liveness check providers where permitted; sanctions and watch-list screening services; fraud prevention agencies; payment processors and financial institutions; publicly available sources; affiliates and referral partners who introduced you to us; and group entities, for shared compliance, onboarding and capital allocation purposes.

3.5 Communications

3.5.1 Calls, emails, live chat sessions and other correspondence with hi2morrow may be recorded, monitored or retained for quality control, training, evidential, regulatory and dispute resolution purposes. Where a call is recorded, we shall inform you at the start of the call.

---

4. How We Use Your Information

4.1 We use personal data for the following purposes:

(a) to register, verify and administer your account and the Client Section;

(b) to deliver Qualification Programs, simulated trading assessments, educational content and related services;

(c) to operate the automated risk controls described in Section 3.3 and Section 13, and to keep an auditable record of their operation;

(d) to process payments, apply promotional codes and administer billing and refunds;

(e) to carry out identity verification, sanctions screening and anti-money-laundering checks;

(f) to assess performance, discipline and risk conduct, and to consider eligibility for progression or for an invitation to our onboarding process;

(g) to detect prohibited practices, fraud, abuse of the platform and coordinated activity between accounts;

(h) to communicate with you about your account, your Qualification, service updates and support requests;

(i) to send marketing communications where you have subscribed, and to measure whether those communications are opened and acted upon;

(j) to improve our services, platform security, user experience and product development, including by analysing aggregated or anonymised data;

(k) to comply with legal, regulatory, tax and reporting obligations;

(l) to establish, exercise or defend legal claims and to protect our rights and the rights of other users.

---

5. Legal Basis for Processing

5.1 We process personal data on one or more of the following grounds under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and, where it applies to you, Regulation (EU) 2016/679 (the "GDPR"):

(a) Performance of a contract. Registration, delivery of the Qualification Program, operation of the published rules and automated controls including AutoStop, payment processing, and support.

(b) Compliance with a legal obligation. Identity verification, anti-money-laundering and sanctions screening, tax and accounting records, and responses to lawful requests from authorities.

(c) Legitimate interests. Platform and account security, fraud prevention, detection of prohibited practices and coordinated activity, assessment methodology validation, product development using aggregated data, and the establishment or defence of legal claims. Where we rely on this ground we have considered whether our interest is overridden by your interests and rights, and you may object as described in Section 10.

(d) Consent. Marketing communications, non-essential cookies and similar technologies, and any processing of biometric data for identity verification. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

(e) Vital interests. In the limited circumstances where processing is necessary to protect the vital interests of you or of another person.

5.2 Sensitive data. Where we process biometric data for the purpose of verifying identity, we do so only where permitted by applicable law, on the basis of your explicit consent or another lawful exemption, and with safeguards appropriate to the sensitivity of the data.

5.3 Consent is not a condition of assessment. Participation in a Qualification Program does not depend on your consenting to processing which is already necessary for the performance of the contract or for compliance with a legal obligation. Where a document states that you consent to monitoring of your trading activity, that statement records your awareness of the monitoring; the lawful basis for that monitoring is set out in Sections 5.1(a) and 5.1(c) and in the Qualification Privacy Policy.

5.4 Whether you have to provide personal data. The account, contact and payment data in Sections 3.1.1 and 3.1.4 is required in order to enter into a contract with us, and the identity and verification data in Section 3.1.2 is required by law. Without them we cannot open an account, accept a payment or allow you to take part in a Qualification Program. The data described in Section 3.3 is generated by your own activity and cannot be separated from taking part. Everything else is optional, and declining to provide it affects only the feature it relates to.

5.5 Age. The Services are offered only to persons aged eighteen (18) or over. We do not knowingly process the personal data of a child, and where we learn that we have done so we shall delete it.

---

6. Who We Share Your Information With

6.1 We do not sell personal data. Sharing is limited to recipients with a genuine need to know and to the purposes set out in this Policy.

6.2 We may share personal data with:

(a) Group entities — Neoway Trading Ltd and Hitomorrow Securities LTD, and other group companies, for payment processing, onboarding, compliance, identity verification, assessment for real capital allocation and operational purposes;

(b) Service providers — platform and hosting providers, IT support, payment providers, identity verification providers, email and messaging providers, and customer support tools, each engaged under a written data processing agreement containing confidentiality and security obligations. Advertising and analytics platforms are not all processors: for the Meta Pixel we and Meta act as joint controllers, as described in the Cookie Policy;

(c) Professional advisers — lawyers, auditors, insurers and consultants bound by professional or contractual confidentiality;

(d) Regulators and law enforcement — government authorities, regulators including the Cyprus Securities and Exchange Commission where applicable, courts and law enforcement bodies, where required by law or where necessary to protect our rights;

(e) Affiliates and referral partners — limited confirmation that a referred registration or purchase has occurred, for the purpose of calculating commission. Affiliates do not receive your identity documents, trading records or Qualification results;

(f) Corporate transactions — a prospective buyer or successor in the context of a merger, acquisition or sale of assets, subject to confidentiality undertakings and limited to what the recipient reasonably requires.

6.3 Every recipient is required to handle personal data securely and to use it only for the purposes we have authorised.

---

7. International Transfers of Your Information

7.1 Personal data may be transferred to and processed in countries outside your country of residence. The Website and the interfaces which serve it are hosted on infrastructure located in the Russian Federation. Personal data is also processed in the United Arab Emirates, in the Republic of Cyprus, and in other jurisdictions in which our group entities or service providers operate.

7.2 Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on an adequacy decision where one is in place, or on Standard Contractual Clauses approved by the European Commission or the equivalent United Kingdom addendum, supported by an assessment of the transfer and by additional technical and organisational measures where that assessment requires them. Transfers governed by the PDPL rely on the mechanisms recognised under that law.

7.3 You may request a copy of the safeguards applied to a transfer by writing to the address in Section 18.

---

8. Data Retention

8.1 We retain personal data only for as long as it is needed for the purpose for which it was collected, and thereafter only where a legal obligation or a legitimate interest requires it.

8.2 Retention is determined by the following criteria:

(a) Account and contract data is retained for the duration of the account relationship and for the period during which a claim arising from that relationship may be brought;

(b) Identity verification and anti-money-laundering records are retained for not less than the minimum period prescribed by the applicable anti-money-laundering legislation, calculated from the end of the relationship, and are not deleted before that period expires even if you ask for deletion of other data;

(c) Payment and accounting records are retained for the period required by applicable tax and accounting law;

(d) Qualification Program data, including trading records, rule-monitoring records and the results of automated controls, is retained as set out in the Qualification Privacy Policy;

(e) Correspondence and call recordings are retained for the period needed for quality control, evidential and dispute resolution purposes;

(f) Cookie identifiers and marketing data are retained for the periods stated in the Cookie Policy or until consent is withdrawn, whichever occurs first.

8.3 When personal data is no longer required it shall be securely deleted or anonymised. Aggregated or anonymised data which can no longer be attributed to an identified or identifiable person may be retained indefinitely for research, statistical and product development purposes.

---

9. Security of Personal Information

9.1 We hold personal data electronically, and where applicable physically, using technical and organisational measures intended to protect its confidentiality, integrity and availability. Those measures include access control on a need-to-know basis, encryption of data in transit, segregation of production and test environments, logging of administrative access, periodic security review, supplier assessment and staff training.

9.2 No system is entirely secure and transmission over the internet carries inherent risk. We take measures which are appropriate to the risk, and you remain responsible for keeping your login credentials confidential and for notifying us promptly if you suspect that your account has been accessed without your authority.

---

10. Your Rights

10.1 Subject to applicable law, you have the right to:

(a) obtain confirmation of whether we process your personal data and to receive a copy of it;

(b) have inaccurate or incomplete personal data corrected;

(c) request erasure of your personal data, subject to the retention obligations described in Section 8;

(d) request restriction of processing in the circumstances permitted by law;

(e) object to processing carried out on the ground of legitimate interests, and to object at any time and without giving reasons to processing for direct marketing;

(f) receive personal data which you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where that is technically feasible;

(g) withdraw consent at any time where processing is based on consent, noting that withdrawal may affect our ability to provide part or all of the Services;

(h) obtain human intervention in relation to a decision taken solely by automated means, express your point of view, and contest that decision, as described in Section 13;

(i) lodge a complaint with a supervisory authority, as described in Section 14.

10.2 Exercising your rights. Write to the address in Section 18. We may ask for information reasonably needed to verify your identity before we act on a request. We shall respond within one (1) month of receipt. That period may be extended by a further two (2) months where the request is complex or where you have made a number of requests; where we extend it, we shall inform you within one (1) month of receipt and give the reasons for the delay.

10.3 Fees. Requests are dealt with free of charge. Where a request is manifestly unfounded or excessive we may charge a reasonable fee reflecting our administrative costs, or refuse to act, and in either case we shall explain the reason and how you may challenge it.

---

11. Cookies and Similar Technologies

11.1 The Website and the Client Section use cookies and similar technologies to keep the site working, to remember your choices, to measure how the site is used, and, with your consent, to measure and personalise advertising.

11.2 The categories used, the specific cookies and third-party services involved, their storage periods, the legal basis for each category, and the means by which consent may be given, refused or withdrawn are set out in the Cookie Policy, which forms part of this Policy.

11.3 Blocking cookies which are strictly necessary may prevent parts of the Website and the Client Section from working, including secure sign-in and payment.

---

12. Data Breach Notification

12.1 Where a personal data breach occurs we shall notify the competent supervisory authority. Where the GDPR applies, notification shall be made without undue delay and, where feasible, not later than seventy-two (72) hours after we become aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the PDPL applies, notification shall be made immediately upon becoming aware of the breach, and the seventy-two (72) hour period does not apply.

12.2 Where a breach is likely to result in a high risk to your rights and freedoms we shall notify you without undue delay, describing the nature of the breach, the likely consequences, the measures taken or proposed, and the contact point from which further information may be obtained.

12.3 We maintain an internal record of personal data breaches, their effects and the remedial action taken, whether or not they are notifiable.

---

13. Automated Decision-Making and Profiling

13.1 Scope. This Section explains the decisions we take about you by automated means, and the safeguards which apply to them. It applies in addition to the Qualification Privacy Policy, which describes the same controls from the point of view of the assessment process.

13.2 The AutoStop control. AutoStop is a decision taken solely by automated means. During the Intraday Trading Period the system evaluates the Qualification Account continuously and measures aggregate realised and unrealised loss against the AutoStop Threshold published for your tier, which is set above the Daily Loss Limit for that tier. When that threshold is reached, the system closes open positions and suspends trading on that account for the remainder of the Calendar Day. No person reviews the position before the action is taken; intervention after the event is described in Section 13.6.

13.3 Automated determination of an outcome. Two (2) AutoStop events may occur within a calendar month without ending your participation. A third AutoStop event within the same calendar month ends the Qualification attempt. That outcome, a breach of the Maximum Loss, and the expiry of the attempt period are each an automated determination which brings a paid Qualification attempt to an end and which therefore produces a significant effect for you. The safeguards in Sections 13.6 and 13.7 apply to each of them, and to every individual AutoStop event, because each event counts towards the total which ends an attempt.

13.4 Data used. The decision uses order and execution records, open position data and position sizes, realised and unrealised profit and loss, account equity, Buying Power utilisation, timestamps, the account identifier, the tier parameters applicable to your account, and the record of previous AutoStop events in the same calendar month. It does not use your ethnicity, health, religious or political views, or any other special category of personal data, and it does not use data obtained from advertising or social media services.

13.5 Legal basis. The automated controls are a term of the Qualification Program and are necessary for the performance of the contract between us, within the meaning of Article 22(2)(a) of the GDPR and the corresponding provisions of the PDPL. The controls operate automatically because a published parameter must be applied at the moment it is reached and identically for every Participant.

13.6 Safeguards. You have the right to obtain human intervention, to express your point of view, and to contest the decision. A request may be made at any time by writing to the address in Section 18, quoting your account identifier and the date and time concerned; no time limit applies to the exercise of this right. The review shall be carried out by a member of staff who was not involved in the decision under review and who has authority to set it aside. That person shall consider the point of view you put forward together with the records of the event. We shall confirm receipt and give a reasoned reply within one (1) month of receipt of your request.

13.7 The logic applied, and the outcome of a review. The logic is as follows. The system measures aggregate realised and unrealised loss on the Qualification Account against the AutoStop Threshold published for your tier; reaching that threshold closes the trading day; and the third such event within one calendar month ends the attempt. The threshold for each tier is published in the Qualification Rules on the Website. On request we shall also provide the parameters applied to your account, the recorded values and the time at which the threshold was reached, the action taken, and the previous AutoStop events relied on. Where the review establishes a technical fault, a market data error, an error in which tier's parameters were applied to your account, or any other reason why the decision ought not to stand, the affected event shall be disregarded and the account shall be restored to the position it would have occupied had the event not occurred.

13.8 Other automated processing. We also use automated processing to screen registrations against sanctions and watch lists, to score transactions for fraud risk, and to flag conduct which may amount to a prohibited practice. Screening and fraud scoring produce alerts for review, and a decision to refuse or terminate a relationship on those grounds is taken by a person. A determination that a prohibited practice has occurred is taken by a person on the basis of automated flags and is not made by the system alone.

13.9 Profiling in the assessment. Measures such as drawdown, consistency and the proportion of profit produced by a single day are derived from your trading records in order to evaluate conduct and discipline. That is profiling within the meaning of Article 4(4) of the GDPR. It informs the outcome of an attempt, which is determined by the published parameters described in Section 13.7, and it informs whether a Participant is invited to our onboarding process, which is decided by a person.

13.10 Marketing profiling. Where you have subscribed to marketing communications we may measure which messages you open and which links you follow, and use that to decide what to send you next. This does not produce legal or similarly significant effects, and you may object at any time.

---

14. Complaints and Disputes

14.1 If you are dissatisfied with the way in which we handle your personal data, please contact us first at the address in Section 18 so that we have the opportunity to put the matter right.

14.2 You also have the right to lodge a complaint with a supervisory authority:

(a) for matters governed by the PDPL, the UAE Data Office or the authority designated under that law;

(b) for matters governed by Cyprus law, the Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus (dataprotection.gov.cy);

(c) where the GDPR applies to you, the supervisory authority of the Member State of your habitual residence, place of work or the place of the alleged infringement.

14.3 Making a complaint to a supervisory authority does not affect any other remedy available to you.

---

15. External Links

15.1 The Website may contain links to third-party websites and services, including social media platforms and messaging channels. We are not responsible for their privacy or cookie practices, and this Policy does not apply to them. We encourage you to read their notices before providing personal information.

---

16. Updates to This Policy

16.1 We may amend this Policy to reflect changes in law, in our practices or in the Services. The current version shall always be published on the Website with the date on which it was last updated.

16.2 Where a change materially expands our processing or requires a fresh consent, we shall notify you by email or by prominent notice on the Website, and processing which requires consent shall begin only after that consent has been given.

---

17. Account Deletion

17.1 You may ask us to close your account and delete the personal data associated with it by writing to the address in Section 18.

17.2 We shall act on the request subject to the retention obligations described in Section 8. Where a record must be retained, we shall tell you which category is retained and on what ground, and we shall restrict its use to that ground. Data which is not subject to a retention obligation shall be deleted or anonymised.

17.3 Deletion of your account does not reverse the outcome of a Qualification attempt and does not entitle you to a refund. Refunds are governed by the Refund Policy.

---

18. Contact Us

18.1 For questions about this Policy, to exercise your rights, to request a review under Section 13, or to request deletion of your account, contact:

Hi2morrow — Data Protection Hitomorrow Assessment Data Classification and Analysis L.L.C Email: privacy@hi2morrow.com General support: support@hi2morrow.com Formal notices: legal@hi2morrow.com Telephone: +971 54 358 5747 Registered Address: Office No. 03-1701, Business Bay, Dubai, United Arab Emirates

18.2 We may request information reasonably necessary to verify your identity before acting on a request concerning personal data.

---

This Privacy Policy forms part of hi2morrow's contractual framework and does not constitute legal advice. For the current version, always refer to this page on hi2morrow.com.

© Hi2morrow and group entities. All rights reserved.