Privacy & Data Protection

Data Controller & Legal Entity

Legal Entity: Forneus Technologies (hereinafter “Forneus Technologies”, “We”, “Us”, “the Company”).

Data Protection Officer (DPO): oleksandr.l@forneus.io

Scope of Application: This Privacy Policy applies to all personal data processed by Forneus Technologies through:

• The corporate website (forneus.io) and all subdomains
• KAIROS — Autonomous Neural Trading Ecosystem
• GARM — Zero-Knowledge Encrypted Communication Platform
• PHANES — Decentralized Identity & Authentication Framework
• ELIGOS — Autonomous Defense & Tactical Intelligence System
• AUTHENTICATOR — Hardware-Bound Multi-Factor Authentication Module
• All APIs, SDKs, cloud services, and infrastructure operated by Forneus Technologies

Lawful Grounds Under GDPR Art. 6 & Art. 9

We process personal data exclusively under the following legal bases as defined by Regulation (EU) 2016/679 (GDPR):

Balancing Test (Art. 6(1)(f)): Where we rely on legitimate interest, we conduct and document a Legitimate Interest Assessment (LIA). You may request a copy of any LIA by contacting our DPO.

Comprehensive Data Inventory

The following details every category of personal data processed across the Forneus Technologies ecosystem:

Military-Grade Protection Framework

Forneus Technologies implements a 7-layer defense architecture to protect all personal data:

• Layer 7 — Post-Quantum Encryption: Kyber-1024 + X25519 hybrid key exchange; AES-256-GCM symmetric encryption.
• Layer 6 — Zero-Knowledge Authentication: TPM-bound biometric fusion with neural risk scoring.
• Layer 5 — Hardware-level isolation Isolation: Hardware-level vault below OS kernel. Self-destructs in <200ms.
• Layer 4 — VRAM-Only Rendering: Sensitive data via DirectX 12 / Vulkan to GPU VRAM. Never touches CPU RAM.
• Layer 3 — AI Sentinel (Edge ML): Local NVIDIA TensorRT models. Sub-50ms threat response.
• Layer 2 — Decentralized Mesh Network: P2P routing with onion-style encryption. Zero metadata leakage.
• Layer 1 — Hardware Silicon Binding: Cryptographic binding to TPM/HSM unique silicon ID.

Certification Roadmap: SOC 2 Type II, ISO/IEC 27001:2022, FIPS 140-3, Common Criteria EAL4+.

Zero-Knowledge Financial Protocol

• Broker Credentials (MT5/MT4): Encrypted via AES-256-GCM and stored exclusively in the device’s Hardware-Backed Keystore (NIST SP 800-53). Forneus Technologies has Zero Knowledge.
• On-Device Cryptographic Keys: Private keys generated and stored locally using standard cryptographic frameworks. Forneus Technologies never has access.
• Trading Execution: All orders pass directly from client to broker. Forneus Technologies is not an intermediary.
• Algorithmic Risk Management: Circuit Breakers modeled on SEC Rule 15c3-5 and MiFID II RTS 6.

No Profit Guarantee: Forneus Technologies does not guarantee profits. Primary directive: Capital Preservation.

Automated Decision-Making (GDPR Art. 22)

The KAIROS ecosystem utilizes a decentralized AI consortium (Risk Engine) for autonomous trade execution and lot recalculation. By utilizing the platform, you acknowledge and explicitly consent to automated processing that carries financial consequences, voluntarily waiving the right to mandatory "human intervention" prior to individual trade execution.

Our algorithms assess market volatility and execute decisions based strictly on mathematical parameters without subjective bias or hidden profiling.

Data License for Machine Learning

Forneus Technologies enforces strict separation between Local Processing and Global Telemetry to protect your intellectual property:

• Local Processing: Uploaded strategies (RAG Pipeline) and visual data (Computer Vision screenshots) are processed and vectorized strictly within your isolated local instance. They are never transmitted, stored, or reviewed by Forneus Technologies servers.
• Global Telemetry: Only anonymized, obfuscated mathematical weightings are synced to the cloud. We do not ingest your proprietary trading setups to train global models for other clients.

Zero-Knowledge Credential Management

KAIROS acts purely as an infrastructure layer integrating with external brokerages (e.g., MetaTrader 5) and proprietary trading firms. We employ Zero-Knowledge Credential Management, meaning Forneus Technologies cannot access, intercept, or modify your API keys or funds.

Forneus Technologies acts exclusively as a Software Provider. We bear zero liability for broker downtime, infrastructure hacks at the broker level, or account bans initiated by third-party proprietary firms resulting from algorithmic configurations (e.g., HFT detection limits).

Software Infrastructure Classification

Forneus Technologies processes technical data and telemetry to provide algorithmic infrastructure. We are not a broker, financial advisor, or asset manager.

The routing of trading signals via the KAIROS or PHANES protocols constitutes raw data transmission, not financial instruction or advisory services. All financial risks remain the sole responsibility of the operator.

Defensive Network Optimization

To ensure protocol integrity and bypass latency arbitrage restrictions (Execution Jittering), our systems collect micro-telemetry including ping variations, execution timestamps, and packet routing metrics. This data is end-to-end encrypted and used strictly for defensive node optimization (Project GARM) to protect execution quality.

Authorized Data Processors

No Data Sales: Forneus Technologies does not sell, rent, lease, or trade personal data to any third party for any purpose.

Your Rights Under GDPR, CCPA/CPRA & Global Privacy Laws

Response Time: 30 calendar days (extendable by 60 days for complex requests).

Contact: oleksandr.l@forneus.io (PGP-encrypted submissions accepted)

Cookie Policy & Tracking Technologies

No Third-Party Marketing Cookies. Forneus Technologies does not deploy advertising pixels, retargeting beacons, or cross-site tracking.

DNT & GPC: We honor Do Not Track and Global Privacy Control signals.

Neural Entity Directive & Algorithmic Accountability

• AI Classification: KAIROS trading algorithms classified as high-risk AI systems under the EU AI Act (Regulation 2024/1689).
• Transparency: Users are informed when an AI decision affects their trading. Reasoning is logged and reviewable.
• Human Override: Users may disable automated trading at any time. No fully automated decision with legal effects without human oversight.
• No Global Model Training: Your data is never used to train global models or shared with third-party LLM providers.

Retention Policy & Automated Purge Protocol

Cryptographic Shredding: Destruction of encryption keys rendering data permanently unrecoverable.

Incident Response & Breach Disclosure

• Detection: AI Sentinel provides continuous real-time anomaly detection with sub-50ms response.
• Authority Notification: Confirmed breaches reported within 72 hours (GDPR Art. 33).
• User Notification: High-risk breaches communicated without undue delay (GDPR Art. 34).
• Emergency Lockout: Rapid session lockout and volatile-key clearing target within 200 milliseconds.

Age Verification & AML/KYC

Forneus Technologies services are designed exclusively for institutional and professional operators aged 18+ (or 21+ depending on local jurisdiction). Access by minors is strictly prohibited.

As a Non-Custodial infrastructure provider (handling no client funds or digital assets), Forneus Technologies does not conduct traditional KYC asset checks. However, we continuously monitor network traffic to comply with global AML/CFT standards and reserve the right to instantly terminate nodes originating from sanctioned IP addresses or identified threat actors.

Government Requests & Data Sovereignty

• Warrant Canary: Cryptographically signed, updated quarterly. Confirms no secret subpoenas, NSLs, or FISA orders received.
• Architectural Impossibility: Zero-Knowledge architecture means Forneus Technologies physically cannot comply with most data handover demands.
• Transparency Reports: Annual public reports on government requests received, complied with, and rejected.

Modification Protocol

• Material Changes: Email + in-app notification 30 days before effective date.
• Non-Material: Typo fixes may be made without notice.
• Version Archive: All previous versions available from DPO on request.

Complaints & Legal Recourse

• Internal: Contact DPO — response within 30 days.
• Supervisory Authority: Lodge complaint with your local DPA (GDPR Art. 77). edpb.europa.eu
• Judicial Remedy: GDPR Art. 79 guarantees effective judicial remedy.
• Arbitration: ICC rules for disputes outside EU/EEA.

Data Protection Officer

For all privacy inquiries, data subject requests, and compliance communications:

oleksandr.l@forneus.io

PGP-encrypted submissions accepted. Public key available upon request.
Response guaranteed within 30 calendar days (GDPR Art. 12(3)).