Qualification Privacy Policy

Last updated: 5 September 2026

---

1. Purpose and Scope

1.1 This document explains what personal data is generated while you take part in a Qualification Program, why it is generated, and what becomes of it afterwards. It concerns the assessment process only.

1.2 It supplements the Privacy Policy and does not replace it. Identity verification, payment data, cookies, security, international transfers, breach notification and the full statement of your rights are dealt with there; the rules of the assessment itself are set out in the Qualification Terms of Service and the Qualification Rules.

1.3 Terms defined in the Qualification Terms of Service — including Best Day Rule, Buying Power, Calendar Day, Daily Loss Limit, Intraday Trading Period, Maximum Loss, Profit Target, Qualification Account and Qualification Program — bear the same meaning here. "Participant" means an individual taking part in a Qualification Program. This document applies equally to a Test Flight, which is an attempt taken on the conditions of one full tier for a period of one (1) calendar month and which does not produce a Qualification result.

---

2. Controller

2.1 Hitomorrow Assessment Data Classification and Analysis L.L.C (United Arab Emirates, Commercial License No. 1275729) is the controller of Qualification data. It operates the Qualification Account, the assessment platform and the automated controls described in Section 6.

2.2 Qualification Accounts are simulated: no real instrument is bought or sold and you bear no real market risk. The market data against which the account is priced is real, and what is recorded below is your own conduct.

---

3. Data Recorded During an Attempt

3.1 Orders and executions. Every order placed, amended, cancelled or executed, including the instrument, the direction, the order type, the quantity, the price and the resulting position.

3.2 Positions and exposure. Open and closed positions, the size of each position measured against available Buying Power, aggregated exposure in the same underlying instrument, the number of concurrent positions, and positions carried at the end of the Intraday Trading Period.

3.3 Timing. The time at which each position is opened and closed, holding periods, the interval between consecutive orders, and the times at which you begin and end trading on a Calendar Day.

3.4 Risk and performance measures. Realised and unrealised profit and loss, account equity, drawdown against the Maximum Loss, progress towards the Profit Target, the proportion of total profit produced by your single best day, average and largest loss per position, and any increase in the Profit Target resulting from the application of the Best Day Rule.

3.5 Platform behaviour. Sessions on the trading terminal and the Client Section: login and logout times, session duration, device type and identifiers, IP address, connection characteristics, and the sequence of actions taken in the terminal.

3.6 Rule and integrity records. A record of each occasion on which a published parameter is reached or a rule is breached: the parameter concerned, the values recorded at that moment, the time, the automated action taken, and any subsequent assessment by a member of staff. Where prohibited conduct is investigated, the record includes the material relied on and the conclusion reached.

3.7 Result. The outcome of the attempt (passed, failed, ended by rule, withdrawn or expired), the date of determination, the tier and parameters which applied, the reason where the attempt was ended by rule, and the aggregate measures on which the outcome rests.

3.8 Entitlements arising from an attempt. Some outcomes create an entitlement, and we keep the records needed to grant and to honour it:

(a) the discount code issued in a Test Flight. Where a Test Flight reaches the published discount threshold under the consistency rule and within the loss limit, the system issues a single-use discount code. We record that the threshold was reached, the code, the tier it was issued against, its expiry, whether it has been used and against which purchase, and its link to you and to that Test Flight. The link to you is what makes the code non-transferable, and the record of use is what makes it single-use;

(b) one Test Flight for each person. We keep a durable record that a Test Flight has been taken, so that a second cannot be opened. This record outlives the Test Flight itself, because the rule would otherwise have no effect;

(c) repeat pricing. We keep the history of your previous attempts on a tier, because the price of a repeat attempt depends on it.

3.9 Matters not recorded. We do not record the content of your screen outside the trading terminal, keystrokes, or activity in any other application on your device. No special category of personal data is processed in the assessment.

---

4. Purposes of Processing

4.1 Conduct of the assessment. The records described in Section 3 constitute the assessment, and the outcome of an attempt is determined from them.

4.2 Consistency. The parameters for each tier are published in advance. Recording the values against which they are applied is what allows the same rule to produce the same outcome for every Participant, and allows a Participant to check that it did.

4.3 Integrity and security. Coordinated activity between accounts, duplicate profiles and strategies designed to exploit platform or data feed behaviour distort the results of everyone who takes part. Trading, session and device records are how such conduct is identified, how the account is secured, and how a disputed order is established.

4.4 Progression. Aggregate performance measures may be considered when deciding whether a Participant is invited to our onboarding process. Every candidate is reviewed individually and the final decision rests with the firm. At the tiers for which placement is verified, a passing result is followed by a review of trading activity outside the assessment before the corresponding Level is allocated, and the data processed for that review is described in the Privacy Policy.

4.5 Entitlements. The records in Section 3.8 exist so that a discount code can be issued and honoured on the terms published for it, so that the limit of one Test Flight for each person has effect, and so that a repeat attempt is priced correctly.

4.6 Validation. Aggregated and anonymised measures are used to check whether the published parameters produce a fair assessment.

---

5. Legal Basis

5.1 Performance of a contract. Recording orders, positions, timing, risk measures and the result, operating the automated controls, and determining the outcome are necessary for the performance of the contract you enter into when you register. This is the principal basis for the data in Section 3.

5.2 Legitimate interests. Platform behaviour data, integrity monitoring, retention for evidential purposes and aggregated validation rest on our legitimate interest in operating an assessment which cannot be manipulated, and in defending claims. Where integrity monitoring determines whether the published rules have been complied with, it is also necessary for the performance of the contract under Section 5.1. You may object as described in Section 10.

5.3 Legal obligation. Payment records and records required by anti-money-laundering legislation are retained because the law requires it.

5.4 Basis for monitoring. Participation is not conditional on your consenting to monitoring. Where the Qualification Terms of Service state that you consent to the recording and analysis of your trading activity, that statement records your awareness of the monitoring and does not displace the bases in Sections 5.1 to 5.3. Withdrawing a consent does not stop the recording of assessment data, which continues for as long as you take part.

---

6. AutoStop and Automated Limit Control

6.1 Controls operating automatically. Two controls act on your Qualification Account without a person reviewing the matter first: limit control, which compares your account continuously against the parameters published for your tier, and AutoStop, which ends your trading day when a defined threshold is reached.

6.2 Limit control. During the Intraday Trading Period the system evaluates the account against the Daily Loss Limit, the Maximum Loss, the Profit Target, the limit on the size of a single position, and the Best Day Rule. Reaching a parameter is recorded, and the system takes the action published for it, which may include preventing a further order, closing positions, raising the Profit Target, or determining the outcome of the attempt.

6.3 AutoStop. The AutoStop Threshold for your tier is set above the Daily Loss Limit for that tier. When aggregate realised and unrealised loss on the Qualification Account reaches that threshold, the system closes open positions and suspends trading for the remainder of that Calendar Day. Two (2) AutoStop events may occur within a calendar month without ending your participation. A third AutoStop event within the same calendar month ends the Qualification attempt.

6.4 Character of the decision. Any automated determination of the outcome of an attempt is a decision taken solely by automated means which produces a significant effect for you. That includes a third AutoStop event within a calendar month, a breach of the Maximum Loss, and the expiry of the attempt period. Each such decision is taken under Article 22(2)(a) of the GDPR and the corresponding provisions of the UAE PDPL, on the ground that it is necessary for the performance of the contract between us. The safeguards in Sections 6.7 and 6.8 apply to each of them, and to every individual AutoStop event, because each event counts towards the total which ends an attempt.

6.5 Data used in the decision. The records described in Sections 3.1 to 3.4, together with the account identifier, the parameters applicable to your tier, and previous AutoStop events within the same calendar month. No special category of personal data is used, and no data from advertising, social media or third-party profiling services is used.

6.6 Reason for automation. The control operates automatically because a published parameter must be applied at the moment it is reached and identically for every Participant.

6.7 Human intervention. You have the right to obtain human intervention, to express your point of view, and to contest the decision. A request may be made at any time to privacy@hi2morrow.com, quoting your account identifier and the date and time concerned; no time limit applies to the exercise of this right. The review shall be carried out by a member of staff who was not involved in the decision under review and who has authority to set it aside. That person shall consider the point of view you put forward together with the records of the event, and you shall receive a reasoned reply within one (1) month of receipt of your request.

6.8 The logic applied, and correction. The logic is as follows. The system measures aggregate realised and unrealised loss against the AutoStop Threshold published for your tier; reaching that threshold closes the trading day; and the third such event within one calendar month ends the attempt. The threshold for each tier is published in the Qualification Rules. On request we shall also provide the parameters applied to your account, the values and time at which the threshold was reached, the action taken, and the previous AutoStop events relied on. Where the review establishes a technical fault, a market data error, an error in which tier's parameters were applied to your account, or any other reason why the decision ought not to stand, the affected event shall be disregarded and the account shall be restored to the position it would have occupied had the event not occurred.

6.9 Matters not determined automatically. A determination that conduct amounts to a prohibited practice is taken by a person on the basis of automated flags. A decision to invite a Participant to our onboarding process is taken by a person.

---

7. Disclosure of Qualification Data

7.1 Group entities. Aggregate performance measures and the result of an attempt may be shared with Neoway Trading Ltd and Hitomorrow Securities LTD where a Participant is being considered for progression or for an invitation to our onboarding process.

7.2 Service providers. The trading platform provider, market data providers, hosting providers and IT support, in each case under a written data processing agreement.

7.3 Professional advisers, regulators and courts, where required by law or where necessary to establish, exercise or defend a legal claim.

7.4 Not shared with affiliates, not published. Referral partners receive confirmation that a referred registration or purchase has occurred, and nothing about your trading, your conduct or your result. Qualification data is not disclosed to other Participants.

---

8. Retention

8.1 Qualification data is retained for the duration of your account relationship, and thereafter only where one of the following requires it: a period during which a claim arising from the attempt may still be brought; an obligation imposed by anti-money-laundering, tax or accounting legislation; or the defence of an actual or threatened claim.

8.2 Records required by anti-money-laundering legislation are retained for not less than the minimum period prescribed by that legislation, which under the law currently applicable to the Cyprus group entities is five (5) years from the end of the business relationship. Those records are not deleted before that period expires, even where deletion of other data has been requested.

8.3 The result of an attempt, the tier and parameters which applied, and the date of determination are retained for as long as your account relationship subsists, because a later attempt, a progression decision or a dispute may turn on them. A Test Flight is retained as a record of an attempt and is not recorded as a Qualification result.

8.4 Order-by-order records, session records and device records are retained for the period needed to resolve disputes and to detect coordinated activity across accounts, after which they are deleted or aggregated.

8.5 Aggregated and anonymised measures which can no longer be attributed to an identified or identifiable person may be retained indefinitely for validation of the assessment methodology.

8.6 A discount code issued under Section 3.8(a) and the record of its use are retained while the code is valid and thereafter as part of the payment and accounting record. The record that a Test Flight has been taken, and the history of previous attempts, are retained for as long as your account relationship subsists, because the rules they support would otherwise cease to have effect.

8.7 The specific periods applied to each category are set out in our retention schedule, a copy of which may be requested at the address in Section 11.

---

9. Failure, Withdrawal and Expiry

9.1 An attempt runs for the period published for the tier. An attempt which does not reach the Profit Target within that period, or which is ended by rule, produces a result. That result and the measures supporting it are retained in accordance with Section 8. A failed attempt is not deleted from our records, and failure does not of itself prevent you from taking part again.

9.2 If you withdraw or stop trading, the account is closed at the end of the published period and the outcome is recorded as withdrawn or expired. Data already generated is retained in accordance with Section 8.

9.3 If you ask us to delete your account, we shall act on the request as described in the Privacy Policy. Records covered by Section 8.2 are retained for the statutory period and their use restricted to that purpose. Where a dispute concerning the attempt is open, or where you contest an outcome, the records relevant to it are retained until the matter is concluded, whatever else you may have asked us to delete.

---

10. Your Rights

10.1 The rights set out in the Privacy Policy apply in full to Qualification data. Two of them work differently in an assessment and are explained here.

10.2 Rectification. You may ask us to correct a record which is factually wrong, such as an execution recorded at the wrong price or time. That corrects the record. It does not reopen the outcome of a rule which was correctly applied to accurate data; a challenge to the outcome itself is made under Section 6.7.

10.3 Objection. You may object to processing carried out on the ground of legitimate interests, including integrity monitoring, by stating the grounds relating to your particular situation. Processing which is necessary for the performance of the contract continues while an attempt is running.

10.4 Completion of the record. Where you consider a record incomplete, you may require your own statement to be added to it, and that statement shall be kept with the record and shown to anyone who reviews the attempt.

10.5 Restriction while accuracy is contested. While you contest the accuracy of a record, you may require its processing to be restricted until we have verified it. Restriction means that the record is retained but is not used to determine anything about you.

10.6 Portability has limits here. The right to portability covers the records you generated by your own activity, such as your orders and executions. It does not extend to the measures we derive from them — profit and loss, drawdown, consistency measures — or to the result of the attempt, because those are produced by us rather than provided by you.

10.7 Requests for access, portability, erasure and human intervention are made at the address in Section 11. Erasure is subject to Section 8.

---

11. Contact

Hi2morrow — Data Protection Hitomorrow Assessment Data Classification and Analysis L.L.C Email: privacy@hi2morrow.com · Support: support@hi2morrow.com · Formal notices: legal@hi2morrow.com Telephone: +971 54 358 5747

Complaints may also be made to a supervisory authority, as described in the Privacy Policy.

---

This document forms part of hi2morrow's contractual framework and does not constitute legal advice.