Privacy Policy

Risk warning. Trading foreign exchange and CFDs carries a high level of risk and can result in the loss of all your capital. This material is educational only and is not financial advice. We are not authorised by any financial regulator.

The Candle Trap Method — EMS Digital Solutions candletrapmethod.online Last updated: 12 September 2026

We sell worldwide, so this policy is written to meet the GDPR (EU), the UK GDPR and Data Protection Act 2018, South Africa's POPIA, and the CCPA/CPRA (California), and to be honest with everyone else.

1. Who we are

EMS Digital Solutions, South Africa, is the controller (POPIA: responsible party) for personal information collected through this Site.

Contact for any privacy matter, including requests to exercise your rights: support@candletrapmethod.online

We have not appointed a Data Protection Officer, as we are not required to. Privacy requests go to the address above and are handled by the business owner.

2. What we collect

You give us: | Data | When | Why | |---|---|---| | Email address | Entered before checkout | To deliver the product, send your receipt and access links, and — until you opt out — send reminders about an order you did not complete | | Name (if provided by PayPal) | At payment | Order records, support | | Country / billing country | At payment | Tax, fraud checks, sanctions screening | | Order details and reference | At payment | Support, refunds, accounting | | Anything in a support email | When you write to us | To answer you |

Collected automatically: | Data | Source | Why | |---|---|---| | IP address, browser, device, referring page | Server and analytics | Security, fraud prevention, understanding traffic | | Cookie identifiers (_fbp, _fbc), page and click events | Meta Pixel | Advertising measurement — see the Cookie Policy | | Course progress | Members' dashboard | To show you where you left off |

We never collect your card number. Payment card details go directly to PayPal and never touch our servers.

We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, tell us and we will delete it.

3. Why we may use it, and our legal basis

Purpose	Legal basis (GDPR/UK GDPR)	POPIA justification
Deliver what you bought	Performance of a contract	Contract performance
Receipts, access links, service messages	Performance of a contract	Contract performance
Abandoned-checkout reminders	Legitimate interests — recovering an order you began; you may opt out in one click, in every message	Legitimate interests
Fraud prevention, sanctions screening	Legal obligation and legitimate interests	Legal obligation
Tax and accounting records	Legal obligation	Legal obligation
Advertising measurement via Meta	Consent — collected through the cookie banner and withdrawable	Consent
Analytics and improving the Site	Legitimate interests, or consent where required locally	Legitimate interests
Defending legal claims	Legitimate interests	Legitimate interests

Where we rely on legitimate interests, we have weighed them against your rights, and you may object at any time (section 7).

4. Marketing

Entering your email at checkout is not a subscription to a newsletter.

Abandoned-checkout reminders run for a short sequence and stop automatically. Every one has a one-click unsubscribe, and unsubscribing is honoured immediately and permanently.
Purchase emails (receipt, download links, access) are service messages you cannot opt out of while your purchase is live, because they are how you receive the product.
We will not add you to unrelated marketing without your consent, and we do not sell or rent your data to anyone.

5. Who we share it with

Only these processors, only to run the service:

Who	What they get	Where	Why
PayPal	Payment and buyer details	Global	Processing payments. PayPal is an independent controller for its own purposes under its own policy
Resend (and AWS SES)	Email address, email content	United States	Sending your emails
Render	Server logs, order records	United States	Hosting the backend
Hostinger	Site traffic	Global	Hosting and DNS
Meta Platforms	Hashed email, cookie IDs, event data — only with your consent	Global	Advertising measurement. Meta acts as an independent controller for parts of this
Accountants, lawyers	Records as needed	South Africa	Professional advice, legal duties

We may also disclose data where the law compels us, or to establish or defend legal claims. If the business is ever sold or merged, records may transfer to the buyer, who would remain bound by this policy or give you notice of any change.

A note on Meta. When you consent to advertising cookies, your email may be sent to Meta in hashed (SHA-256) form to measure whether an ad led to a purchase. Hashing means we do not transmit your address in readable form, but it is still personal data and Meta can match it to an existing account. If you decline advertising cookies, none of this happens. You can withdraw consent at any time.

6. International transfers

We are in South Africa; our providers are largely in the United States and the EU. So your data will be transferred across borders.

For transfers out of the EEA or UK we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), or on an adequacy decision where one applies, as incorporated in our providers' data processing terms. For POPIA, transfers are made to recipients bound by contractual terms providing comparable protection. You may request details of the safeguards for any specific transfer.

7. Your rights

Wherever you live, we will honour these on request:

Access — a copy of what we hold
Rectification — correct anything wrong
Erasure — deletion, subject to records we must keep for tax or legal reasons
Restriction — pause processing while a dispute is resolved
Portability — your data in a machine-readable format
Objection — to legitimate-interests processing, including profiling
Withdraw consent — at any time, without affecting what was lawful beforehand
Opt out of marketing — one click, in every message

California residents additionally have the right to know the categories collected, disclosed and "shared", to delete, to correct, to opt out of "sale" or "sharing" for cross-context behavioural advertising, and not to be discriminated against for exercising any of them. We do not sell personal information for money. Sharing hashed identifiers with Meta for advertising may qualify as "sharing" under the CPRA; declining advertising cookies, or emailing us, opts you out. You may use an authorised agent.

How to exercise them: email support@candletrapmethod.online. Our deadlines:

GDPR / UK GDPR: we respond without undue delay and within one month, extendable by up to two further months for complex or numerous requests, in which case we tell you within the first month and explain why.
South Africa: access requests follow the PAIA procedure — a decision as soon as reasonably possible and within 30 days, extendable once by up to a further 30 days.
California: we acknowledge within 10 business days and respond within 45 days, extendable once by a further 45 days with notice. We may ask you to confirm the email address used for the order, so we do not disclose data to the wrong person. There is no charge unless a request is manifestly excessive.

Complaints. You may complain to your regulator — the Information Regulator (South Africa), the ICO (UK), your national Data Protection Authority (EU), or the California Privacy Protection Agency. We would appreciate the chance to fix it first.

8. How long we keep it

Data	Retention
Order and payment records	5 years after the transaction, for tax and accounting
Purchaser email and access records	While your access is live, then 5 years with the order record
Abandoned-checkout leads that never purchase	12 months, then deleted
Unsubscribe records	Kept indefinitely, so we do not email you again by mistake
Support correspondence	2 years
Server and security logs	90 days
Analytics and advertising cookie data	Per the Cookie Policy, generally up to 13 months

9. Security

Traffic is encrypted with HTTPS. Credentials and API keys are held as encrypted environment variables, never in the website's code. Card data never reaches us. Access to order records is limited to the business owner. Emails to Meta carry hashed identifiers, not plain addresses.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs we notify as the law requires:

Under POPIA, we notify the Information Regulator and every affected person as soon as reasonably possible after discovering the compromise. POPIA has no "risk" threshold for telling you — if your data is caught in a breach, you hear about it. We may delay only if law enforcement tells us disclosure would impede a criminal investigation.
Under GDPR / UK GDPR, we notify the supervisory authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to your rights and freedoms; we notify you directly where the breach is likely to result in a high risk to you.

10. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means alone.

11. Changes

We will post any change here with a new date. Material changes affecting how we use your data will be notified by email where we hold your address.

12. Contact

EMS Digital Solutions support@candletrapmethod.online South Africa