Privacy Policy

Valuefy Technologies Private Limited ("Valuefy", "we", "our", or "us") respects your privacy and is committed to protecting personal information processed through our website, applications, software platforms and related services (collectively, the "Services").

Valuefy is an India-based wealth technology company providing software and technology solutions for wealth management, portfolio management, investment management, reporting, client engagement and related financial technology requirements.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information when you visit our website, communicate with us, submit information through our forms, request a demonstration, or use our Services.

This Privacy Policy is intended to address applicable Indian data protection requirements, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable rules thereunder, and reflects information-security practices aligned with applicable ISO/IEC 27001 and SOC 2 requirements, where relevant to the applicable service and scope.

Depending on how you interact with Valuefy, we may collect the following information.

2.1 Personal Information

This may include:

• Name
• Business email address
• Telephone/mobile number
• Job title or designation
• Organisation/company name
• Business address
• City and country
• Information submitted through contact or enquiry forms
• Information provided during product demonstrations
• Information provided during business communications

2.2 Technical and Usage Information

We may automatically collect:

• IP address
• Browser type and version
• Device type
• Operating system
• Date and time of access
• Website pages visited
• Referring URLs
• Website interaction information
• Security and diagnostic logs
• Error information
• Information required for security monitoring and system performance

2.3 Information You Voluntarily Provide

We may collect information when you:

• Contact us
• Submit an enquiry
• Request a product demonstration
• Subscribe to communications
• Participate in webinars or events
• Respond to surveys
• Communicate with our employees or representatives

2.4 Customer and Platform Data

Where customers use Valuefy's software platforms, customers may submit information for processing through the Services. Depending on the customer's use of the Services, this may include personal, financial, portfolio, account, transaction or other business information.

Where Valuefy processes such information on behalf of a customer, such processing is governed by the applicable customer agreement, data processing terms and documented instructions.

Valuefy may use personal information for the following purposes:

• Providing and operating our Services
• Responding to enquiries and requests
• Providing product demonstrations
• Managing customer and business relationships
• Providing technical and customer support
• Improving our products, Services and website
• Monitoring system performance
• Maintaining security
• Detecting and preventing fraud, abuse and security incidents
• Maintaining audit and security records
• Managing contracts and commercial relationships
• Meeting legal, regulatory and contractual obligations
• Performing internal governance, risk and compliance activities
• Conducting security assessments and testing
• Managing business operations
• Sending service-related communications
• Sending marketing communications where permitted by applicable law

We will not use personal information for purposes materially incompatible with the purpose for which it was collected unless permitted or required by applicable law.

Valuefy processes personal information in accordance with applicable Indian data protection requirements. Depending on the circumstances, processing may be based on:

• Consent
• Performance of a contract
• Steps taken at the request of an individual before entering into a contract
• Compliance with applicable legal or regulatory obligations
• Legitimate business purposes where permitted by applicable law
• Protection of individuals, systems and organisational interests
• Other lawful grounds available under applicable law

Where processing is based on consent, individuals may withdraw consent in accordance with applicable law.

Valuefy seeks to collect and process information that is reasonably necessary for the relevant business, contractual, security or legal purpose. We do not intentionally collect personal information that is unnecessary for the stated purpose.

Valuefy does not sell personal information. We may share information where reasonably necessary with:

6.1 Service Providers

Trusted third parties that provide services such as cloud hosting, infrastructure management, security services, analytics, communication services, customer support, technology services and professional services. Such providers are subject to applicable contractual, confidentiality and security requirements.

6.2 Customers

Where Valuefy processes information on behalf of a customer, authorised customer representatives may access relevant information in accordance with the customer's agreement and applicable access controls.

6.3 Legal and Regulatory Authorities

We may disclose information where required by applicable law, regulation, court order, governmental authority or lawful request.

6.4 Security and Protection

We may disclose information where reasonably necessary to detect or investigate security incidents, prevent fraud or abuse, protect our systems, protect customers and users, enforce contractual rights, or protect our legal rights or property.

6.5 Corporate Transactions

Information may be disclosed as part of a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, subject to applicable legal requirements.

For enterprise SaaS engagements, the customer may determine the purpose and manner in which customer-submitted information is processed. Depending on the applicable legal and contractual arrangement, Valuefy may act as a service provider or processor on behalf of the customer.

Valuefy processes customer data in accordance with customer agreements, data processing agreements where applicable, documented customer instructions, applicable legal requirements, and information-security controls.

Access to customer data is restricted to authorised personnel based on business need and applicable access-control requirements.

Valuefy maintains administrative, technical and organisational safeguards designed to protect information against unauthorised access, alteration, disclosure, loss or destruction. Our information-security programme may include:

• Information-security governance
• Identity and access management
• Multi-factor authentication where applicable
• Encryption of data in transit and at rest where applicable
• Secure software development practices
• Vulnerability assessments and penetration testing
• Security monitoring and logging
• Endpoint and infrastructure security
• Backup and recovery controls
• Incident response
• Business continuity and disaster recovery
• Security awareness and training
• Change management
• Vendor and third-party risk management
• Periodic security reviews and audits

Valuefy maintains information-security controls aligned with ISO/IEC 27001 and relevant SOC 2 control requirements, subject to the applicable certification, report and service scope.

No security system can guarantee absolute security. Valuefy therefore continuously reviews and improves its security controls.

Valuefy retains personal information only for as long as reasonably necessary for the purpose for which it was collected, contractual requirements, legitimate business requirements, security and audit requirements, legal and regulatory obligations, and dispute resolution.

When information is no longer required, Valuefy takes reasonable steps to securely delete, anonymise or otherwise dispose of it in accordance with applicable requirements and internal retention procedures.

Valuefy maintains processes for identifying, assessing, containing, investigating and responding to information-security incidents.

Where a personal data breach occurs, Valuefy will take appropriate steps in accordance with applicable law, contractual obligations and its incident response procedures. Where required, affected customers, individuals and/or relevant authorities will be notified through appropriate channels.

Subject to applicable law, individuals may have rights relating to their personal information, including:

• Access to personal information
• Correction of inaccurate information
• Updating of information
• Deletion or erasure where applicable
• Withdrawal of consent where processing is based on consent
• Raising privacy-related grievances
• Exercising other rights available under applicable data protection laws

Requests may be subject to appropriate identity verification and applicable legal or contractual limitations.

Valuefy may use cookies and similar technologies to enable essential website functionality, maintain security, understand website usage, improve website performance, remember preferences, measure website traffic, and support analytics and marketing activities where applicable.

Where required by applicable law, Valuefy will obtain appropriate consent before using non-essential cookies. Users may manage their cookie preferences through the website's cookie consent mechanism or browser settings.

Where permitted by applicable law, Valuefy may send communications relating to products, services, events, webinars and other business activities.

Users may opt out of marketing communications through the unsubscribe mechanism provided in the relevant communication or by contacting Valuefy. Service-related, security-related, contractual or legally required communications may continue where necessary.

Our Services are intended primarily for organisations, professionals and business users. Our website and Services are not intentionally directed toward children.

Valuefy does not knowingly seek to collect personal information from children except where permitted by applicable law and appropriate safeguards are in place.

Our website or Services may contain links to third-party websites, applications or services. Third-party services are governed by their own privacy policies and terms.

Valuefy is not responsible for the privacy practices, security, content or availability of third-party websites or services that are not operated by Valuefy.

Valuefy's operations are primarily based in India.

Where personal information is transferred, accessed or processed outside India through authorised service providers, infrastructure or contractual arrangements, Valuefy will implement appropriate safeguards and comply with applicable Indian legal and contractual requirements.

Valuefy incorporates privacy and information-security considerations into relevant business and technology processes. Depending on the nature of the activity, this may include:

• Data classification
• Access-control reviews
• Security assessments
• Privacy assessments
• Vendor assessments
• Data retention controls
• Secure development practices
• Logging and monitoring
• Incident management
• Periodic governance reviews

Valuefy may update this Privacy Policy periodically to reflect changes in applicable laws, regulatory requirements, technology, business processes, security practices, or our Services.

The updated Policy will be published on this page with a revised "Last Updated" date. Where required by law, material changes will be communicated through appropriate channels.

For privacy-related questions, requests or grievances:

• Valuefy Technologies Private Limited
• Privacy / Grievance Contact: biz@valuefy.com
• Website: https://www.valuefy.com/

Where Valuefy has formally appointed a Data Protection Officer or designated grievance officer for a specific processing activity, the applicable contact details may also be published on this page.

This Privacy Policy shall be governed by the laws of India, subject to applicable statutory and regulatory requirements.