Privacy Policy

Information We Collect Through Forms

When you reach out to us — whether through our contact form, a research subscription, or a career application — you're voluntarily sharing information. Here's exactly what we collect and how long we keep it:

• Contact form submissions: your full name, email address, phone number (if provided), investable assets range selection, and the content of your message
• Newsletter and research subscriptions: your email address only — nothing more
• Career applications: your resume, cover letter, any supporting materials (e.g., GitHub profiles, writing samples, trading track records), and contact information
• Retention policy: contact inquiries are retained for 24 months, then securely deleted. Career applications are retained for 12 months following the close of the position, then permanently removed from our systems

We don't ask for information we don't need. That dropdown asking about your investable assets? It helps Sienna route your inquiry to the right person. Nothing more.

Information Collected Through Cookies

Cookies are small text files stored on your device. We use them sparingly and transparently — here's the full inventory:

• Essential cookies: session management tokens and security identifiers required for site functionality. These cannot be disabled without breaking the site.
• Analytics cookies: we use Google Analytics to understand how visitors navigate the site. Data collected includes page views, session duration, and approximate geographic location — all with IP anonymization enabled
• Preference cookies: your cookie consent choice and any theme or display preferences are stored locally so you don't see the same banner every visit
• Third-party advertising cookies: none. Zero. We do not share cookie data with advertising networks, nor have we ever. Our entire growth has come from referrals — not retargeting pixels
• Cookie lifespan: session cookies expire when you close your browser. Analytics cookies expire after 13 months. Preference cookies persist until you clear them

You can withdraw consent for non-essential cookies at any time by clearing your browser cookies or contacting us directly.

Information Collected Through Analytics

We use website analytics to understand what's working and what isn't — so we can make this site more useful for you. Here's exactly what our analytics capture:

• Page views and navigation patterns across the site
• Referral sources — how you found us (search engine, direct, referral link)
• Device type, browser type, and screen resolution
• Approximate geographic location (city-level, derived from anonymized IP)
• Session duration and engagement metrics

No personally identifiable information is collected through our analytics. IP addresses are anonymized before processing. We don't know your name, your email, or your trading preferences from analytics data alone. This information is used solely to improve the website experience and content — it's never sold, shared, or used for targeted advertising.

Client Portal Data

If you're an IBKR Investments client, your portal contains sensitive financial information. Here's how we protect it:

• Encryption: all client portal data is secured with 256-bit SSL encryption in transit and AES-256 encryption at rest
• Authentication: two-factor authentication (2FA) is required for all portal access — no exceptions
• Data storage: account data, portfolio information, trade history, and performance records are stored on encrypted servers located in Canada, subject to Canadian data sovereignty laws
• Access controls: portal data access is limited to authorized IBKR Investments personnel on a strict need-to-know basis. Every access event is logged and auditable
• Regular audits: our Operations Manager, Amara Chen, conducts quarterly access reviews and annual penetration testing of portal infrastructure

Your portfolio data is your data. We treat it with the same precision we apply to managing the capital itself.

How We Use Your Information

Transparency isn't just our trading philosophy — it applies to data handling too. Here's every way we use the information you share with us:

• Responding to inquiries: when you fill out our contact form, your information goes directly to Sienna Marchetti's inbox. She responds — typically within one business day, often faster
• Providing requested services: onboarding documentation, Investment Policy Statements, performance reporting, and ongoing portfolio communication
• Regulatory compliance: maintaining records required by the British Columbia Securities Commission (BCSC) and the Canadian Investment Regulatory Organization (CIRO) under National Instrument 31-103
• Improving our website: analytics data helps us understand which research articles resonate, which pages need improvement, and how to make your experience better
• Delivering research: if you subscribe, we send market analysis briefs and investment commentary to your email address. You can unsubscribe at any time

Your information is never sold, rented, traded, or shared with third parties for marketing purposes. Not now. Not ever. We didn't build a referral-only firm over 16 years just to sell your email address to a data broker.

Your Rights

You're in control. Here's what you can request at any time, without providing a reason:

• Access: request a complete copy of all personal data we hold about you
• Correction: ask us to update or correct any inaccurate information
• Deletion: request that we permanently delete your personal data from our systems (subject to regulatory retention requirements)
• Cookie withdrawal: withdraw your consent for non-essential cookies at any time
• Portability: receive your data in a commonly used, machine-readable format
• Objection: object to any specific use of your data outlined in this policy

To exercise any of these rights, reach out to us at contact@ibkrinvestments.com or call (312) 215-4761. We'll acknowledge your request within two business days and fulfill it within thirty calendar days.

Data Security

Protecting your information isn't an afterthought here — it's embedded in our operations from the ground up:

• Encryption: industry-standard TLS 1.3 encryption on all website communications and AES-256 encryption for stored data
• Security audits: regular penetration testing and vulnerability assessments conducted by independent third-party security firms
• Staff training: every team member completes annual data protection and cybersecurity training. Amara Chen oversees compliance and conducts internal audits quarterly
• Access management: principle of least privilege applied to all internal systems. Multi-factor authentication required for all staff accessing client data
• Incident response: documented breach response protocol with 72-hour notification commitment to affected individuals and relevant regulatory authorities

No system is perfectly impervious — anyone who tells you otherwise is selling something. But we apply the same disciplined, process-driven approach to data security that we apply to risk management in the market. Every gap is identified, measured, and addressed.

Changes to This Policy

We may update this privacy policy periodically to reflect changes in our practices, technology, or regulatory requirements. Here's how we handle that:

• The "Last Updated" date at the top of this page will reflect the most recent revision
• Material changes — anything that substantively affects how your data is collected, used, or shared — will be communicated via email to registered contacts and research subscribers
• Continued use of our website after changes are posted constitutes your acceptance of the updated policy
• Previous versions are archived and available upon request

Questions About This Policy