Data Controller: JoinX Hub Ltd ("JoinX", "we", "us", "our")
Registration number 03407373
Kralja Nikole 27A/4, 81000 Podgorica, Montenegro
Privacy contact: support@joinx.capital
Last updated: 6 August 2026
This Policy explains how we process personal data of Students (aged 13 to 17), their parents or legal guardians ("Guardians"), and visitors to theprop.academy. Because our program is designed for minors, we apply heightened care to all Student data.
1. Who This Policy Covers
- Guardians, who create and manage the account, make purchases, and provide consent.
- Students, who use the platform for simulated trading and learning.
- Visitors, who browse the website or join the notification list.
2. Data We Collect
From Guardians:
- name, email address, and relationship to the Student;
- billing information and payment confirmation (card details are processed by our payment providers and never stored by us);
- shipping address when a physical reward is redeemed;
- consent records, including time and method of consent;
- support correspondence.
From Students:
- name, email address, and date of birth (used to verify age eligibility);
- account credentials;
- platform activity: simulated trades, challenge progress, XP balance, Academy lesson completion, and reward redemptions;
- technical data: device type, browser, IP address, and log data.
From Visitors:
- email address if you join the notification list;
- cookie and analytics data as described in Section 8.
We collect only what is needed to run the program. We do not collect real financial account data, real trading history, or real investment information from anyone, because no real trading takes place on the platform.
3. Why We Process Data and Legal Bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and managing accounts | Guardian and Student registration data | Performance of a contract, Art. 6(1)(b) |
| Verifying age eligibility | Student date of birth | Legal obligation and legitimate interest in child protection, Art. 6(1)(c) and (f) |
| Obtaining and documenting Guardian consent | Guardian identity and consent records | Legal obligation, Art. 6(1)(c), and Art. 8 GDPR |
| Running challenges and calculating XP | Platform activity data | Performance of a contract, Art. 6(1)(b) |
| Delivering rewards | Email and shipping address | Performance of a contract, Art. 6(1)(b) |
| Payment processing and fraud prevention | Billing data, transaction records | Contract and legitimate interest, Art. 6(1)(b) and (f) |
| Support and communication | Correspondence | Contract and legitimate interest |
| Service emails about the account | Guardian and Student email | Performance of a contract |
| Marketing emails | Guardian email only | Consent, Art. 6(1)(a) |
| Analytics and site improvement | Cookie and usage data | Consent, Art. 6(1)(a) |
| Legal compliance, accounting, dispute handling | Transaction and account records | Legal obligation, Art. 6(1)(c) |
We do not use Student data for marketing. Marketing communications are sent only to Guardians and only with consent, which can be withdrawn at any time. We do not show targeted advertising to Students, we do not sell personal data, and we do not use Student data for advertising profiles.
4. Children's Data and Guardian Consent
4.1 The platform is intended for Students aged 13 to 17 acting with Guardian consent. We do not knowingly collect data from children under 13. If we learn that an account belongs to a child under 13, or that a Student account lacks valid Guardian consent, we will suspend it and delete the data unless retention is legally required.
4.2 Where EU or national law sets a digital consent age above the Student's age, we rely on the Guardian's consent given during registration. We keep a record of that consent and take reasonable steps to verify it, such as confirmation via the Guardian's email and payment by the Guardian's own payment method.
4.3 Guardians may at any time review the Student's data, request corrections or deletion, or withdraw consent by contacting support@joinx.capital. Withdrawal of consent closes the Student's account as described in the Terms.
5. Who Receives Data
We share personal data only with service providers who process it on our instructions under data processing agreements:
- payment processors, for purchases and refunds, including where applicable our subsidiary JoinX CZ s.r.o., Kratka 227, 742 45 Fulnek, Czech Republic;
- email delivery providers, for service and consented marketing messages;
- hosting and infrastructure providers;
- reward fulfilment partners, who receive only what is needed to deliver a specific redeemed reward (for example a shipping address for a physical item);
- analytics providers, subject to your cookie choices;
- professional advisers and authorities where legally required.
We never sell personal data. Reward brands (for example the issuers of gift cards) do not receive Student profiles or activity data.
6. International Transfers
Where data is transferred outside the European Economic Area, we use safeguards recognised under GDPR, such as adequacy decisions or Standard Contractual Clauses. Details of the safeguards used for each provider are available on request at support@joinx.capital.
7. Retention
- Account and activity data: for the life of the account and up to 12 months after closure, then deleted or anonymised.
- Consent records: for the life of the account plus the period needed to demonstrate compliance.
- Transaction and invoicing records: as required by tax and accounting law, typically 8 years.
- Support correspondence: up to 3 years after resolution.
- Notification list emails: until you unsubscribe or 24 months of inactivity.
Data no longer needed is deleted or irreversibly anonymised. Anonymised, aggregated statistics (for example overall challenge pass rates) contain no personal data and may be retained indefinitely.
8. Cookies and Analytics
The website uses:
- Essential cookies, required for login, checkout, and security. These do not require consent.
- Analytics cookies (such as Google Analytics via Google Tag Manager), used to understand site usage. These load only with your consent via the cookie banner.
- Advertising pixels (such as Meta Pixel, Google Ads or TikTok Pixel) may be used on public marketing pages only, with consent, and are never used inside the logged in Student environment. Automatic advanced matching is disabled, and Student birth dates, names, email addresses and other identifying registration details are not sent to advertising platforms.
You can change your cookie choices at any time through the cookie settings link in the footer. Full details of cookies, providers, and lifetimes are listed in the Cookie Notice at theprop.academy/cookies.
9. Security
We protect personal data with encryption in transit, access controls, least privilege access for staff, logging, and regular review of our providers. Student accounts are protected by authentication, and Guardian approval is required for sensitive actions such as high value reward redemptions. No system is perfectly secure, and we will notify affected users and authorities of any breach as required by law.
10. Your Rights
Guardians, and Students to the extent permitted by their age and applicable law, have the right to:
- access the personal data we hold;
- correct inaccurate data;
- delete data ("right to be forgotten");
- restrict or object to processing based on legitimate interest;
- receive data in a portable format;
- withdraw consent at any time, without affecting prior processing;
- lodge a complaint with a supervisory authority. For Hungary this is the NAIH (naih.hu); users in other countries may contact their local data protection authority.
Requests can be sent to support@joinx.capital. We respond within one month. Requests concerning a Student's data are handled with the Guardian, and we verify identity before releasing any data.
11. Automated Decisions
XP is calculated automatically from challenge results and platform activity according to the published rules. This automation does not produce legal effects and does not involve profiling of Students beyond program mechanics. Verification of unusual results always involves human review before any XP is cancelled.
12. Changes to This Policy
We will post updates on this page and notify Guardians by email of any material change at least 30 days before it takes effect. The change history is available on request.
13. Contact
Questions about this Policy or your data: support@joinx.capital
JoinX Hub Ltd, Kralja Nikole 27A/4, 81000 Podgorica, Montenegro
Phone and WhatsApp: +36 70 300 1789