Privacy Policy

FINCOR IT ("FINCOR IT", "we", "our" or "us") is a software and IT solutions company that builds and supports enterprise software, including e-commerce, remittance, restaurant management, sanction screening and PEP screening systems. We are committed to protecting the privacy of everyone whose personal information we handle.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you visit our website, request a demonstration, contact us, become our client, apply for a job, or otherwise interact with us. It also explains the choices and rights available to you.

Contents

1. Scope and Our Role
2. Information We Collect
3. How We Use Your Information
4. Legal Basis for Processing
5. How We Share Information
6. International Data Transfers
7. Data Retention
8. How We Protect Information
9. Cookies
10. Your Rights and Choices
11. Marketing Communications
12. Children's Privacy
13. Changes to This Policy
14. Contact Us

1. Scope and Our Role

This policy applies to personal information for which FINCOR IT decides how and why it is processed (where we act as a data controller), including information about:

• visitors to our website;
• prospective clients who request demonstrations, quotations or information;
• representatives and users of our clients, partners and suppliers; and
• job applicants.

Data in our clients' systems. Our clients use our software to process data about their own customers, such as remittance senders and beneficiaries, KYC records, screening subjects, e-commerce buyers and vendors, or restaurant guests. For that data, our client is the data controller and FINCOR IT acts only as a data processor (service provider) on the client's instructions. If you are a customer of one of our clients, please refer to that organisation's privacy notice and direct your requests to it. How we safeguard client data is described in our Data Protection Policy.

2. Information We Collect

Information you provide to us

• Contact and demo requests: name, job title, company name, business email address, phone number, country, the products or services you are interested in, and the content of your message.
• Client and partner relationship data: names and contact details of authorised representatives, billing contacts, contract information, invoices, payment records and correspondence.
• Support interactions: support tickets, call notes, screenshots, log files and other information you share to help us resolve an issue.
• Platform accounts: where we provide user accounts (for example, admin or client portal accounts), your name, email address, role and login credentials (stored in hashed form).
• Recruitment: CVs, cover letters, educational and employment history, references and other information submitted with a job application.

Information collected automatically

• Technical data: IP address, browser type and version, device type, operating system, referring URL, pages visited, and date and time of access.
• Security and audit data: login attempts, session identifiers and activity logs used to protect our website and systems from abuse.
• Cookies: as described in our Cookie Policy.

Information from other sources

We may receive business contact information from event organisers, referral partners, resellers, and publicly available professional sources such as company websites and professional networking platforms.

We do not intentionally collect sensitive personal data (such as health, religious or biometric data) through our website. Please do not submit such information through our forms.

3. How We Use Your Information

We use personal information to:

• respond to enquiries and arrange product demonstrations, proposals and quotations;
• negotiate, enter into and perform contracts with our clients, partners and suppliers;
• deliver, implement, maintain and support our software and services;
• manage invoicing, payments, accounting and tax obligations;
• send service notifications, security alerts, release notes and administrative messages;
• send relevant business communications about our products, events and insights, where permitted by law;
• operate, secure, monitor and improve our website and services, and prevent fraud, abuse and security incidents;
• assess job applications and manage recruitment;
• comply with legal, regulatory, tax and audit requirements, and respond to lawful requests from authorities; and
• establish, exercise or defend legal claims.

We do not sell personal information, and we do not use client data processed in our software for our own marketing purposes.

4. Legal Basis for Processing

We process personal information in accordance with the laws of Bangladesh and, where applicable, international data protection laws such as the EU and UK General Data Protection Regulation (GDPR). Depending on the context, we rely on the following legal bases:

• Contract: where processing is necessary to enter into or perform a contract with you or your organisation.
• Legitimate interests: to run and grow our business, respond to enquiries, maintain client relationships, secure our systems and improve our services, provided these interests are not overridden by your rights.
• Consent: for certain marketing communications and non-essential cookies. You may withdraw consent at any time.
• Legal obligation: where we must process information to comply with applicable laws, regulations or orders of competent authorities.

5. How We Share Information

We share personal information only where necessary and with appropriate safeguards, including with:

• Service providers: trusted vendors that support our operations, such as cloud hosting and data centre providers, email and communication services, CRM and helpdesk tools, payment and accounting services, and professional advisers. They may only use the information to provide services to us and are bound by confidentiality and data protection obligations.
• Implementation and reseller partners: where a partner is involved in delivering or supporting your project, and only to the extent necessary.
• Authorities: regulators, law enforcement agencies, courts or government bodies where required by law or to protect our rights, property or safety, or the rights, property or safety of others.
• Corporate transactions: a prospective or actual buyer, investor or successor in connection with a merger, acquisition, restructuring or sale of assets, subject to confidentiality obligations.

6. International Data Transfers

FINCOR IT is based in Bangladesh and serves clients in Bangladesh and international markets. Your information may be stored or processed in Bangladesh or in other countries where we or our service providers operate. Where we transfer personal information across borders, we take steps to ensure it receives an adequate level of protection, such as contractual safeguards (including standard contractual clauses where required), and we comply with any data localisation requirements that apply to us or our clients under applicable law.

7. Data Retention

We keep personal information only for as long as necessary for the purposes described in this policy, including to meet legal, accounting, tax and reporting requirements. As a general guide:

• Enquiry and demo request data is kept for up to twenty-four (24) months after our last interaction, unless a business relationship develops.
• Client contract, billing and correspondence records are kept for the duration of the relationship and for the period required by applicable tax, company and commercial laws thereafter.
• Security and access logs are kept for up to twelve (12) months, unless needed to investigate an incident.
• Unsuccessful job applications are kept for up to twelve (12) months, unless you ask us to delete them sooner.

When information is no longer needed, we securely delete or anonymise it.

8. How We Protect Information

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration and disclosure. These include encryption in transit (HTTPS/TLS), role-based access controls, strong authentication, secure password hashing, network protection, regular backups, activity logging, vulnerability management, staff confidentiality agreements and security awareness training. Further details are set out in our Data Protection Policy.

No method of transmission over the internet or electronic storage is completely secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities where required by law.

9. Cookies

Our website uses cookies that are necessary for it to function securely, such as session and security (CSRF) cookies. For more information, including how to manage cookies, please read our Cookie Policy.

10. Your Rights and Choices

Subject to applicable law, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct inaccurate or incomplete information;
• delete your information where it is no longer needed or was processed unlawfully;
• restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
• data portability, i.e. receive your information in a structured, commonly used format;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a competent data protection or regulatory authority.

To exercise any of these rights, contact us using the details below. We may need to verify your identity before responding. We aim to respond within thirty (30) days. If your request concerns data held in a client's system that we process on their behalf, we will forward it to the relevant client and assist them in responding.

11. Marketing Communications

We may send business-related communications about our products, services, events and industry insights to business contacts where permitted by law. You can unsubscribe at any time by using the unsubscribe link in our emails or by contacting us. We will continue to send essential service and administrative messages to active clients.

12. Children's Privacy

Our website and services are intended for businesses and are not directed to children under the age of eighteen (18). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services or legal requirements. The updated version will be posted on this page with a revised effective date. Where changes are significant, we will take reasonable steps to notify you.

14. Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or our handling of personal information, please contact our Data Protection Officer:

Data Protection Officer, FINCOR IT
Flat-4A, Road-10, House-11, Block-G, Aftabnogor, Badda, Dhaka
Email: info@fincorit.com
Phone: +880 1700-000000