Data Use & Protection Policy

Our clients trust FINCOR IT with some of their most sensitive information, including financial transactions, remittance records, customer identity (KYC) data, sanctions and PEP screening results, and commercial data. This Data Use & Protection Policy sets out the principles, controls and commitments we apply to protect that data across our software products, SaaS platforms, implementation projects and support services.

This policy should be read together with our Privacy Policy and Terms & Conditions. Where a client has signed a data processing agreement (DPA) with us, the DPA takes precedence over this policy.

Contents

1. Purpose and Scope
2. Roles and Responsibilities
3. Data Protection Principles
4. How We Use Client Data
5. What We Never Do With Client Data
6. Data Classification
7. Security Controls
8. Access to Client Environments
9. Secure Software Development
10. Sub-processors and Third Parties
11. Data Location and Cross-Border Transfers
12. Retention, Return and Deletion
13. Incident and Breach Management
14. Data Subject Requests
15. Our People
16. Compliance, Audit and Review
17. Contact

1. Purpose and Scope

This policy applies to:

• all data that clients and their users submit to, store in or process through our software, whether hosted by FINCOR IT (SaaS) or deployed on the client's own infrastructure ("Client Data");
• all personal data processed by FINCOR IT in the course of its business; and
• all FINCOR IT employees, contractors, consultants and sub-processors who have access to such data.

It covers all our products and services, including the Multi-Vendor E-Commerce Platform, Remittance Management Application, Restaurant Management System, Sanction Screening Management System, PEP Screening Management System, custom software development, business process automation, consulting and support.

2. Roles and Responsibilities

• Client as data controller. Our clients determine the purposes and means of processing data about their customers, employees and counterparties. They are responsible for having a lawful basis for collecting that data, providing privacy notices to individuals, and meeting their own regulatory obligations (for example, KYC, AML/CFT record-keeping and regulatory reporting).
• FINCOR IT as data processor. When we host, support, migrate or maintain Client Data, we act only on the client's documented instructions and in line with this policy and the applicable agreement.
• FINCOR IT as data controller. For our own business data, such as website enquiries, client contacts, billing and recruitment, we act as data controller, as described in our Privacy Policy.
• Data Protection Officer. Our Data Protection Officer oversees implementation of this policy, advises on data protection matters, coordinates incident response and acts as the point of contact for clients and authorities.
• Management. Senior management is accountable for providing the resources, governance and culture needed to protect data.

3. Data Protection Principles

We apply internationally recognised data protection principles in everything we do:

• Lawfulness, fairness and transparency – data is processed lawfully and in a manner that is transparent to clients.
• Purpose limitation – data is used only for the specified purposes agreed with the client.
• Data minimisation – we access and process only the data necessary to perform a task.
• Accuracy – our software provides tools for clients to keep their data accurate and up to date.
• Storage limitation – data is retained only for as long as required by the client's instructions or applicable law.
• Integrity and confidentiality – data is protected with appropriate technical and organisational security measures.
• Accountability – we document our processing activities and controls and can demonstrate compliance.
• Privacy by design and by default – data protection is built into our products from the design stage, with secure defaults.

4. How We Use Client Data

We use Client Data solely to:

• provide, host, operate and maintain the Services the client has subscribed to;
• perform implementation, configuration, data migration and integration work requested by the client;
• investigate and resolve support tickets, bugs and performance issues reported by the client;
• create and test backups and disaster recovery procedures;
• detect, prevent and respond to security incidents, fraud and abuse affecting the Services; and
• comply with applicable law or a binding order of a competent authority, after notifying the client where legally permitted.

We may generate aggregated, anonymised technical metrics (such as system performance, error rates and feature usage counts) that do not identify any client, individual or transaction, in order to maintain and improve our products.

5. What We Never Do With Client Data

• We never sell Client Data or personal data.
• We never use Client Data for our own marketing, advertising or profiling.
• We never share one client's data with another client.
• We never use production Client Data in development or testing environments without the client's written approval and appropriate masking or anonymisation.
• We never use identifiable Client Data to train artificial intelligence or machine learning models without the client's explicit written consent.
• We never disclose Client Data to authorities unless legally compelled, and we will challenge unlawful or overly broad requests where appropriate.

6. Data Classification

We classify data to apply proportionate protection:

7. Security Controls

We maintain a security programme aligned with recognised industry frameworks such as ISO/IEC 27001 and the OWASP guidelines. Our controls include:

Encryption

• All data in transit is encrypted using TLS 1.2 or higher.
• Restricted data at rest in hosted environments is encrypted using strong industry-standard algorithms (such as AES-256), with sensitive fields encrypted at the application level where appropriate.
• Passwords are stored using strong, salted one-way hashing algorithms (such as bcrypt or Argon2) and are never stored in plain text.

Access control

• Role-based access control (RBAC) with granular permissions in all our products, enabling clients to apply the principle of least privilege and segregation of duties (for example, maker-checker approval for remittance transactions).
• Multi-factor authentication for administrative and privileged access to our hosting infrastructure.
• Login throttling, session timeouts and account lockout to prevent brute-force attacks.
• Prompt revocation of access when staff change roles or leave the company.

Infrastructure and operations

• Firewalls, network segmentation and logical separation of each client's data in hosted environments.
• Regular security patching of operating systems, frameworks and dependencies.
• Vulnerability scanning and periodic penetration testing of our products and infrastructure.
• Centralised logging and monitoring, with tamper-resistant audit trails of user and administrator activity.
• Automated, encrypted backups stored in a separate location, with periodic restoration testing and documented business continuity and disaster recovery plans.
• Hosting with reputable data centre or cloud providers that maintain strong physical security controls.

8. Access to Client Environments

For on-premise deployments and client-hosted environments, FINCOR IT personnel access client systems only:

• when requested or authorised by the client for support, maintenance or implementation;
• through secure, client-approved channels such as VPN or controlled remote access tools;
• using individual, named accounts (never shared credentials); and
• for the minimum time and scope necessary to complete the task.

Our personnel will not copy, download or export Client Data from a client environment unless this is required to resolve an issue and has been approved by the client. Any such copy is stored securely and deleted once the task is complete.

9. Secure Software Development

• Security and privacy requirements are considered at the design stage of every product and feature.
• Code is reviewed by peers before release, with attention to common vulnerabilities such as injection, cross-site scripting, cross-site request forgery and broken access control.
• Development, testing, staging and production environments are separated.
• Test environments use synthetic, masked or anonymised data.
• Source code is stored in access-controlled repositories, and secrets and credentials are never committed to source code.
• Third-party libraries are monitored for known vulnerabilities and updated in a timely manner.

10. Sub-processors and Third Parties

We may engage carefully selected sub-processors, such as cloud hosting providers, email delivery services, SMS gateways and watchlist data providers, to help us deliver the Services. Before engaging a sub-processor, we assess its security and data protection practices, and we bind it by written terms that impose data protection obligations no less protective than those in this policy. We remain responsible for our sub-processors' performance.

Clients may request a list of the sub-processors relevant to their Services. Where agreed in a DPA, we will notify clients in advance of any new sub-processor so they can raise reasonable objections.

Integrations that a client chooses to enable (for example, payment gateways, banking partners, courier services or third-party APIs) are governed by the client's own agreement with that third party.

11. Data Location and Cross-Border Transfers

We respect our clients' data residency requirements. Where a client is required by law or by its regulator, such as Bangladesh Bank, to keep data within a particular country, we will host the data in that jurisdiction or support an on-premise deployment. Where data is transferred across borders, we implement appropriate safeguards, such as contractual clauses, encryption and access restrictions, in accordance with applicable law.

12. Retention, Return and Deletion

• Client Data is retained for as long as the client's subscription is active, or as instructed by the client.
• Our products allow clients to configure retention to meet their legal obligations, such as record-keeping periods required under anti-money laundering laws.
• On termination of a SaaS subscription, the client may export its data within thirty (30) days. After that period, Client Data is securely deleted from active systems, and from backups as they expire on their normal rotation cycle, unless retention is required by law.
• Data held in support tickets, temporary files or migration workspaces is deleted once no longer needed.
• Storage media are securely wiped or physically destroyed at the end of their life.

On request, we will confirm in writing that deletion has been completed.

13. Incident and Breach Management

We maintain a documented incident response procedure. If we become aware of a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Data, we will:

1. act immediately to contain the incident and limit its impact;
2. notify the affected client without undue delay, and in any event within seventy-two (72) hours of confirming the incident, with the information reasonably available about its nature, scope, likely consequences and the measures taken;
3. investigate the root cause and provide the client with reasonable assistance to meet its own notification obligations to regulators and affected individuals;
4. notify the relevant authorities where we are legally required to do so; and
5. implement corrective actions to prevent recurrence and document the lessons learned.

If you believe you have discovered a security vulnerability in any FINCOR IT product or website, please report it responsibly to info@fincorit.com. We will investigate all good-faith reports promptly.

14. Data Subject Requests

Where an individual contacts FINCOR IT directly to exercise data protection rights over data held in a client's system, we will promptly forward the request to the relevant client and will not respond directly unless authorised by the client. Our products provide functionality that helps clients locate, export, correct and delete personal data in order to respond to such requests within legal deadlines.

Requests relating to data for which FINCOR IT is the controller are handled as described in our Privacy Policy.

15. Our People

• All employees and contractors sign confidentiality and non-disclosure agreements before gaining access to any client systems or data.
• Background verification is carried out for personnel in roles with access to restricted data, where permitted by law.
• All staff receive data protection and information security training at onboarding and at least annually.
• Breaches of this policy by staff are treated seriously and may result in disciplinary action, up to and including termination of employment or contract, as well as legal action where appropriate.

16. Compliance, Audit and Review

We comply with the data protection, information and communication technology and cyber security laws of the People's Republic of Bangladesh as in force from time to time, and, where we serve international clients, with applicable foreign data protection laws such as the EU and UK GDPR to the extent they apply to our processing.

Subject to reasonable notice, confidentiality and frequency, clients may request information about our security controls, complete security questionnaires, or, where provided for in their agreement, audit our compliance with this policy. We also support clients when they undergo audits or inspections by their own regulators.

This policy is reviewed at least annually, and whenever there are significant changes to our services, technology or the legal environment. The latest version is always available on this page.

17. Contact

For questions about this policy, to request a data processing agreement, or to report a data protection concern, please contact:

Data Protection Officer, FINCOR IT
Flat-4A, Road-10, House-11, Block-G, Aftabnogor, Badda, Dhaka
Email: info@fincorit.com
Phone: +880 1700-000000