This Finoserv privacy policy explains how Finoserv ("Finoserv", "we", "us") collects and uses personal data through finoserv.com, and through business contact with prospective clients and partners. It also explains your rights and how to use them.
Finoserv designs, builds, integrates and runs fintech solutions to order for clients, under their own brand, through licensed partners in each country. When we process personal data inside a solution we build or run for a client, we usually act for that client as a processor or service provider, and the client's own privacy notice applies. This policy covers our website and our own business contacts.
Who we are
The controller of your personal data is Finoserv, a company incorporated in Delaware, USA. Our headquarters is in Delaware, our development center is in India, and we also operate in the UAE, the United Kingdom and Canada.
Under India's Digital Personal Data Protection Act, 2023, we are the "data fiduciary". Under U.S. state privacy laws, we are the "business" or "controller".
You can reach us about privacy at [email protected]. Our privacy contact is [email protected]. For general questions, write to [email protected].
The data we collect
We keep the data we collect to what we need to run the website and reply to you.
| Category | What it includes | Where it comes from |
|---|---|---|
| Enquiry data | Name, work email, company, country, your message, and whether you ticked the optional consent box | You, through the contact form |
| Correspondence | Emails and replies exchanged with us, including any details you choose to share | You |
| Technical and log data | IP address, browser and device type, requested page, referring page, date and time, response status, request identifiers, and approximate location derived from the IP address | Your browser, recorded by our hosting and content delivery network |
| Security signals | IP address, TLS and browser characteristics, user agent, and a bot score used to block automated abuse | Your browser, processed by our security provider when you load pages or submit the form |
| Theme preference | Your light or dark theme choice | Stored in your own browser only |
| Analytics data (only with your consent) | Pages viewed, clicks and events, device and browser type, approximate location (city or country), referral source, and a pseudonymous browser identifier | Analytics cookies, only after you agree |
| Marketing data (only with your consent, if enabled) | Page visits and form submissions linked to a pseudonymous identifier, used for campaign measurement and audiences on a professional network | Marketing tags, only after you agree |
We do not ask for sensitive personal data, payment card data or government identifiers on this website. Please do not include them in your message.
Why we use your data and our legal bases
Where the GDPR, the UK GDPR or a similar law applies, we rely on the legal bases below. Under the DPDP Act, we rely on your consent, or on a "legitimate use" where the Act allows one, such as data you provide voluntarily for a specified purpose.
| Purpose | Data used | Legal basis (GDPR and UK GDPR) |
|---|---|---|
| Reply to your enquiry and discuss a possible engagement | Enquiry data, correspondence | Legitimate interests (responding to people who contact us), and steps you ask for before a contract |
| Send occasional updates, if you ticked the optional box | Name, work email, consent record | Consent, which you can withdraw at any time |
| Deliver the website and keep it working | Technical and log data, necessary cookies | Legitimate interests (operating a reliable website) |
| Protect the website and the form from spam, fraud and attacks | Security signals, technical and log data | Legitimate interests (security), and legal obligation where security is required by law |
| Understand how the website is used | Analytics data | Consent |
| Measure campaigns and reach similar audiences | Marketing data | Consent |
| Keep business records and meet legal duties | Enquiry data, correspondence, consent records | Legal obligation |
| Establish, exercise or defend legal claims | Relevant records | Legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that balance and you can object at any time.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
How long we keep data
We keep personal data only as long as we need it for the purposes above, then delete or anonymize it.
| Data | Retention period |
|---|---|
| Enquiries and correspondence that do not lead to an engagement | Up to 24 months after our last contact with you |
| Enquiries that lead to an engagement | For the length of the business relationship and the period required by law afterward |
| Marketing consent records | While your consent is active, and for up to 3 years after you withdraw it, so we can show how and when consent was given |
Cookie consent choice (fs_consent) |
12 months, then we ask again |
| Server and CDN logs | A short period set by our hosting provider, generally no longer than 30 days, unless we need them to investigate a security incident |
| Analytics data | Event-level data is kept for 14 months in our analytics tool; aggregated reports may be kept longer |
| Marketing tag data | As set by the marketing platform; we receive aggregated reports only |
| Security incident records | As long as needed to investigate and resolve the incident and meet legal duties |
Who we share data with
We do not sell personal data for money. We share personal data only with the types of recipients below, and only as needed.
| Recipient type | Why |
|---|---|
| Our group companies, including our development center in India | To answer enquiries, support and run our services, under intra-group agreements |
| Hosting, content delivery and security providers | To serve the website, keep logs and block automated abuse |
| Email, form handling and customer relationship management providers | To receive and manage enquiries and correspondence |
| Analytics providers (with your consent) | To produce usage statistics |
| Advertising and professional network providers (with your consent, if enabled) | To measure campaigns and build audiences |
| Professional advisers, such as lawyers, auditors and insurers | To get advice and protect our rights |
| Licensed partners, only with your agreement | If you ask us to introduce you to a bank, EMI, card issuer, custodian or other license holder |
| Authorities, courts and regulators | Where the law requires it or to protect rights, safety and security |
| A buyer or successor | If our business is reorganized, merged or sold, under confidentiality terms |
Our service providers act on our instructions under written contracts that require confidentiality and security. Some providers, such as the professional network behind our marketing tag, may act as independent or joint controllers for part of the processing, and their own privacy notices apply to that part. The cookie policy names the providers that set cookies on this website.
International transfers
We are based in the United States, our development center is in India, and our providers may process data in other countries. Your data may be transferred to and accessed from countries other than your own, including the United States and India.
When we transfer personal data, we use the safeguards required by the law that applies to you:
- From the EU and EEA: an adequacy decision of the European Commission where one exists (for example for the United Kingdom and Canada, and for U.S. recipients certified under the EU-U.S. Data Privacy Framework), or the European Commission's Standard Contractual Clauses, together with supplementary measures where needed.
- From the United Kingdom: UK adequacy regulations where they exist (including the UK Extension to the EU-U.S. Data Privacy Framework for certified U.S. recipients), or the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses.
- From Switzerland: the Swiss-U.S. Data Privacy Framework for certified recipients, or Standard Contractual Clauses adapted for Swiss law.
- From India: transfers are allowed under the DPDP Act except to countries that the Government of India restricts by notification, and we will follow any such restriction.
- From the UAE: transfers to countries with adequate protection, or under contractual or other safeguards permitted by Federal Decree-Law No. 45 of 2021.
- From Canada: contracts and other measures that give comparable protection, and, for Quebec residents, an assessment before personal information is communicated outside Quebec, as Law 25 requires.
India does not currently have an adequacy decision from the European Commission or the United Kingdom, so transfers from Europe or the UK to India rely on Standard Contractual Clauses or the UK equivalents. You can ask us for a copy of the relevant safeguards at [email protected].
Your rights
Your rights depend on where you live. You can use them free of charge in most cases. We may need to confirm your identity before we act, and we will tell you if we cannot comply and why.
United Kingdom, EU and EEA
Under the UK GDPR and the GDPR you have the right to:
- access your personal data and get a copy
- correct inaccurate or incomplete data
- erase your data in certain cases
- restrict how we use your data in certain cases
- object to processing based on legitimate interests, and to direct marketing at any time
- receive your data in a portable format, and have it sent to another controller where technically possible
- withdraw consent at any time, without affecting earlier processing
- complain to a supervisory authority
We reply within one month. For complex or numerous requests, we may extend this by up to two further months and will tell you why.
India
Under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, you have the right to:
- get a summary of the personal data we process and the processing activities
- correct, complete, update and erase your personal data
- withdraw consent as easily as you gave it
- have your grievances redressed by us
- nominate another person to exercise your rights if you die or become unable to do so
The Rules were notified on November 13, 2025 and commence in phases. Most obligations of data fiduciaries and most of these rights apply from May 2027. We already handle requests from India on the basis described here. We respond to grievances within the period set by the Rules. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
United Arab Emirates
Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you have the right to obtain information about the processing of your data, to request access, transfer, correction and erasure, to restrict and stop processing in certain cases, and to object to decisions based solely on automated processing. If you deal with us through the Dubai International Financial Centre or Abu Dhabi Global Market, the data protection law of that free zone may apply instead.
Canada
Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, you have the right to access your personal information, to challenge its accuracy and have it corrected, and to withdraw consent, subject to legal and contractual limits. We reply within 30 days unless the law allows an extension.
If you live in Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, also gives you the right to have your personal information communicated to you, or to a person or body you choose, in a structured, commonly used technological format, to ask that we stop disseminating it or de-index links in certain cases, and to be informed when information is used to make a decision based exclusively on automated processing.
United States
Depending on your state of residence, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, you may have the right to:
- know what personal information we collect, use and disclose, and access it
- correct inaccurate personal information
- delete personal information
- receive a portable copy
- opt out of the sale of personal information, the "sharing" of it for cross-context behavioral advertising, targeted advertising, and certain profiling
- appeal our decision on your request, where your state law provides an appeal
- not be discriminated against for using your rights
You may use an authorized agent. We will ask the agent for proof of authority and may ask you to verify your identity directly. We reply within 45 days and may extend once by a further 45 days where the law allows. If we deny an appeal, we will tell you how to contact your state attorney general.
Information for California residents
In the past 12 months we collected these categories of personal information, for the business purposes described in this policy: identifiers (such as name, email address, IP address and online identifiers); professional or employment-related information (such as company); internet or other electronic network activity (such as pages viewed and interactions); and approximate geolocation derived from IP address. We collect these from you, your browser and our service providers. We disclose them to the recipient types listed above. We do not collect sensitive personal information for the purpose of inferring characteristics about you. We do not knowingly sell or share the personal information of consumers under 16.
We do not sell personal information for money. If you allow marketing cookies, our use of a marketing tag may count as "sharing" for cross-context behavioral advertising under California law. You can opt out at any time as described below.
Do not sell or share, and Global Privacy Control
To opt out of the sale or sharing of your personal information, and of targeted advertising:
- use the "Cookie preferences" link in the footer of any page and switch off analytics and marketing, or
- turn on Global Privacy Control (GPC) in a browser or extension that supports it, or
- email [email protected] with the subject "Do not sell or share".
We treat a GPC signal as a valid request to opt out for that browser. When we detect GPC, we do not load marketing tags or analytics, and the cookie banner shows that the signal was honored. Because GPC works per browser, please turn it on in each browser you use.
How to exercise your rights
Email [email protected] and tell us which right you want to use and which edition of the website you use. To protect your data, we may ask for information to confirm your identity, usually by replying from the email address you used with us. We will not ask for more information than we need.
You can withdraw consent to marketing emails by using the unsubscribe link in any message or by emailing us. You can change cookie choices at any time through "Cookie preferences" in the footer.
Children
This website is intended for business users. It is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact [email protected] and we will delete it.
How we protect your data
We use technical and organizational measures suited to the risk, including encryption in transit, access controls based on need to know, multi-factor authentication for our systems, logging and monitoring, vendor security reviews, and staff confidentiality obligations. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the relevant authorities where the law requires.
To report a security issue, see our responsible disclosure policy.
Complaints
We would like the chance to resolve your concern first, so please contact [email protected]. You also have the right to complain to a data protection authority:
| Where you are | Authority |
|---|---|
| United Kingdom | Information Commissioner's Office (ICO), ico.org.uk |
| EU and EEA | The data protection authority in your country of residence, work or the place of the alleged infringement; a list is at edpb.europa.eu |
| India | Data Protection Board of India |
| United Arab Emirates | The federal data protection regulator under Federal Decree-Law No. 45 of 2021 (originally the UAE Data Office, whose functions are being transferred to the Federal Authority for Artificial Intelligence and Data), or the Commissioner of Data Protection in the DIFC or ADGM where that free zone's law applies |
| Canada | Office of the Privacy Commissioner of Canada, priv.gc.ca; in Quebec, the Commission d'accès à l'information, cai.gouv.qc.ca |
| California | California Privacy Protection Agency, privacy.ca.gov |
| Other U.S. states | The attorney general of your state |
Changes to this policy
We may update this policy when our practices or the law change. We will post the new version on this page with a new version number and "updated" date. If a change is significant, we will give notice on the website or by email where appropriate before it takes effect.
Contact us
Finoserv Privacy requests: [email protected] Privacy contact: [email protected] General enquiries: [email protected]