PvX Partners Pte. Ltd. (“PvX”, “we”, “us” or “our”) is committed to protecting personal data collected, used and disclosed through its business activities.

This Privacy Policy explains how we handle personal data in accordance with applicable data protection legislation, including Singapore's Personal Data Protection Act 2012 (“PDPA”), the European Union General Data Protection Regulation (“EU GDPR”), the United Kingdom General Data Protection Regulation (“UK GDPR”), each as amended and applicable, and other relevant privacy laws.

1. Scope

This Privacy Policy applies to personal data collected or processed by PvX through its websites, platforms, applications, products, services and business operations, including:

• Financing: User acquisition financing, credit facilities, funding assessments, underwriting, financing administration and related financial services.
• Cards and Payments: Card programmes, payment-related services, customer onboarding, transaction administration and associated activities undertaken with financial institutions and programme partners.
• Predictive Analytics: Financial modelling, revenue forecasting, return on advertising spend (ROAS) analysis, cohort analytics, benchmarking, risk assessments, business intelligence and related analytical services, whether used internally or provided to customers through platforms, applications, APIs or software services.
• Business Operations: Customer and partner relationships, regulatory compliance, marketing, security, support, employment and business administration.

This Policy also applies where personal data is processed in connection with services provided by other PvX group entities. The relevant entity responsible for a specific financial product, card programme or other service may be identified in the corresponding agreement or privacy notice.

Depending on the processing activity, PvX may act as an independent data controller or as a data processor acting on behalf of a customer. Where PvX processes personal data on a customer's behalf, the applicable agreement and Data Processing Addendum (DPA) govern the relevant processing arrangements.

This Policy describes:

• What personal data we collect and how we collect it;

• How we use and disclose personal data;

• Who may access personal data;

• How personal data is protected and retained; and

• The rights available to individuals.

2. Definitions

• Personal Data: Any data, whether true or not, about an individual who can be identified from that data alone or together with other information to which the organisation has, or is likely to have, access, as defined under the Singapore PDPA. The term also includes information relating to an identified or identifiable natural person under applicable EU GDPR, UK GDPR and other privacy laws.
• PDPA: The Personal Data Protection Act 2012 of Singapore, including amendments.
• EU GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council.
• UK GDPR: The UK General Data Protection Regulation as incorporated into and amended under UK law.
• Customer Data: Information provided or made available to PvX in connection with its services, including financial, transactional, operational, advertising and analytical information.
• Anonymised Data: Information processed such that individuals are no longer identifiable, directly or indirectly, using means reasonably likely to be employed. Where applicable to confidential customer datasets, anonymisation also takes account of indirect identification of the originating customer or application.
• Pseudonymised Data: Information processed to reduce direct identification but which may still be attributed to individuals using additional information. Such information remains personal data where identification is reasonably possible.

3. Personal Data We Collect

Depending on your relationship with PvX and the services involved, we may collect:

• Contact Information: Names, email addresses, telephone numbers, mailing addresses, business contact details and authorised representatives.

• Account Details: Usernames, authentication credentials, profile information, account preferences, user permissions and access records.

• Financial and Transaction Data: Banking information, payment methods, billing details, financing applications, financial statements, revenue information, funding requirements, repayment records and related financial information.

• Card and Payment Information: Cardholder and account details, transaction records, merchant information, payment activity, disputes and other information required for authorised card or payment services.

• Compliance Information: Identity-verification records, KYC/KYB documentation, beneficial ownership information, identification documents, sanctions screening, AML/CFT information and regulatory due-diligence records.

• Analytics and Performance Data: Advertising expenditure, attribution information, ROAS, cohort performance, user-retention metrics, revenue forecasts, app and platform performance, and related business or analytical information.

• Technical Data: IP addresses, browser types, operating systems, device information, browsing behaviour, login records, security events and application usage data.

• User-Generated Content: Information submitted or uploaded through our websites or services, including text, documents, images, videos, datasets and other materials that may contain personal data.

• Cookies and Tracking Data: Information collected through cookies, web beacons and similar technologies.

• Communications and Business Records: Enquiries, customer-support correspondence, contractual communications, and relevant employment or business administration records.

Not all information collected or processed by PvX constitutes personal data. Business information, aggregated statistics and genuinely anonymised datasets may fall outside the scope of personal data protection legislation.

The information collected depends on the services used, the nature of the relationship and applicable legal or regulatory requirements.

4. How We Collect Personal Data

We may collect personal data through:

• Direct Collection: Information provided when submitting forms, applying for financing, requesting card services, registering an account, entering into agreements, communicating with us or requesting support.

• Customer-Provided Information: Data submitted through our platforms, APIs, integrations, data feeds, uploads and other authorised channels.

• Automated Means: Cookies, web beacons, application logs, authentication systems and similar technologies used to collect technical and usage information.

• Third-Party Sources: Information obtained from financial institutions, card issuers, payment processors, identity-verification providers, analytics platforms, advertising networks, social media platforms, professional advisers and other sources where authorised by you or otherwise permitted by applicable law.

• Publicly Available and Regulatory Sources: Information obtained from company registries, sanctions databases, regulatory records and other lawful sources necessary for due diligence, financial assessment, compliance or business operations.

Where required by applicable law, we provide appropriate collection notices and obtain the necessary authorisation or consent.

5. Purpose of Collection, Use & Disclosure

We collect, use and disclose personal data for the following purposes:

• Service Provision: To provide, operate, maintain, support and improve our websites, financing services, card programmes, payment-related services, analytics platforms and other products or services.

• Account Management: To register customers, authenticate users, administer accounts, manage billing and provide customer support.

• Financing and Risk Assessment: To evaluate funding applications, conduct underwriting and due diligence, assess business and credit risks, determine financing eligibility and administer financing arrangements.

• Predictive Analytics and Data Science: To analyse business performance, train and improve analytical models, evaluate advertising efficiency, forecast revenue and ROAS, develop underwriting methodologies, and generate scores, recommendations and insights.

• Benchmarking and Product Development: To develop aggregated and anonymised datasets, statistical benchmarks, analytical products, artificial intelligence and machine-learning models, and new or improved commercial services.

• Card and Payment Operations: To support onboarding, card issuance arrangements, programme administration, transaction processing, fraud monitoring, dispute management and related services.

• Marketing and Promotions: To communicate product updates, promotional materials, service announcements and commercial opportunities, and to conduct marketing, advertising and business-development activities.

• Regulatory Compliance: To comply with KYC/KYB, AML/CFT, sanctions, regulatory reporting, audit, tax, accounting and other legal requirements.

• Security and Fraud Prevention: To safeguard our systems, users, information and business operations, and to detect, prevent and investigate unauthorised or unlawful activity.

• Business Administration: To manage commercial relationships, contracts, investments, corporate transactions, professional engagements and internal operations.

Customer Data and Commercial Use

Our applicable Terms and Conditions provide PvX with a perpetual, irrevocable, non-exclusive, royalty-free, worldwide licence to use customer-submitted content and data for lawful business and commercial purposes, including analytics, predictive modelling, artificial intelligence development, benchmarking, research, product development and marketing.

PvX may create and commercialise anonymised or aggregated information derived from customer-provided data. Properly anonymised information may be retained and used indefinitely for these purposes, including after the original customer relationship has ended.

Legal Basis for Processing

Where the EU GDPR or UK GDPR applies, our processing is based on one or more applicable lawful grounds, including:

• Contractual necessity: Providing services and fulfilling contractual obligations where processing is necessary for a contract with the individual.

• Legal obligations: Meeting statutory, financial-crime, regulatory, tax, accounting and other legal requirements.

• Legitimate interests: Operating and improving our services, assessing commercial and financing opportunities, performing appropriate business analytics, preventing fraud, maintaining security and conducting lawful business activities, where those interests are not overridden by applicable individual rights.

• Consent: Where required for marketing, tracking technologies or other processing activities.

• Other legally recognised grounds: Where relevant to the particular processing activity and permitted by applicable legislation.

Where personal data is processed for automated profiling or decisions producing legal or similarly significant effects on individuals, PvX applies the notices, lawful grounds and safeguards required by the applicable legislation. Relevant assessments may use financial performance, transaction history, advertising expenditure, revenue patterns and other information to determine risk or financing eligibility.

Under Singapore's PDPA, we will seek express or deemed consent before collecting, using or disclosing personal data unless a statutory exception or other lawful basis applies.

Where required, consent may be withdrawn in accordance with applicable law.

6. Who can access your data?

We do not sell your personal data.

• PvX Group Entities: Where necessary for authorised business, financial, analytical, operational and compliance activities.

• Service Providers: Third-party vendors assisting us with hosting, technology infrastructure, security, analytics, communications, payments, customer support and other business operations, subject to appropriate confidentiality and data-protection obligations.

• Financial and Card Programme Partners: Lenders, financial institutions, issuing banks, BIN sponsors, payment processors, card networks and programme administrators, where expressly authorised under the relevant financing, card-programme, payment or other service agreements.

• Professional Advisers: Auditors, legal advisers, consultants, insurers and other professional service providers acting in their authorised capacities.

• Legal and Regulatory Authorities: Where required or permitted by law, court order, regulatory process or governmental request, or where necessary to establish, exercise or protect legal rights.

• Business Transfers: Where information is transferred as part of a merger, acquisition, joint venture, investment, restructuring or sale of business assets, subject to appropriate confidentiality and data-protection arrangements.

Sharing of customer-provided data with external parties will be consistent with the applicable Terms and Conditions and relevant service agreements.

We will take appropriate steps to ensure that third parties receiving personal data implement standards of protection comparable to those required under the PDPA and other applicable data protection legislation.

7. Overseas Transfers of Personal Data

PvX operates internationally, and personal data may be stored, processed or accessed in Singapore and other jurisdictions where our group entities, customers, infrastructure providers or authorised partners operate.

Where personal data is transferred outside Singapore, we will ensure that it receives a standard of protection comparable to that required under the PDPA, using appropriate safeguards, including contractual or other legally recognised protections.

Where the EU GDPR or UK GDPR applies, international transfers will be undertaken using the applicable transfer mechanisms, including:

• Adequacy decisions or regulations;

• Standard Contractual Clauses;

• The UK International Data Transfer Agreement or UK Addendum, where applicable;

• Other recognised contractual, organisational or legal safeguards.

The applicable arrangements depend on the jurisdictions and processing activities involved.

8. Cookies and Tracking Technologies

We use cookies, web beacons and similar technologies to:

• Remember user preferences and settings;

• Authenticate users and maintain website and platform functionality;

• Analyse site usage, performance and user interactions;

• Improve our websites and services; and

• Deliver personalised advertisements, marketing or content, where applicable.

You may configure your browser to reject or restrict cookies, although doing so may affect certain website or service features.

Where required by applicable law, we provide appropriate notices and consent choices for non-essential cookies and tracking technologies.

9. Protection of Personal Data

We have implemented reasonable administrative, technical and physical security measures to safeguard personal data against unauthorised access, use, disclosure, modification, loss or destruction.

These measures include, as appropriate:

• Access controls and authentication;

• Encryption and secure data transmission;

• Infrastructure and network security;

• Security logging and monitoring;

• Vulnerability management and incident-response procedures;

• Third-party security and risk management; and

• Internal information-security and privacy governance.

We apply appropriate security controls to personal data processed on behalf of customers and to personal data processed for our own business purposes.

However, no method of electronic storage or transmission over the Internet is completely secure, and we cannot guarantee absolute security.

10. Retention of Personal Data

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or as required or permitted by applicable law.

Retention periods depend on the nature of the information, applicable contracts and the legal or regulatory requirements of the relevant jurisdiction.

In particular:

• Customer and Account Data: Retained during the business relationship and for an appropriate period thereafter for legitimate business, contractual or legal purposes.

• Financing and Transaction Records: Retained as necessary for financing administration, accounting, regulatory compliance, audit, dispute resolution and applicable legal requirements.

• Card and Compliance Records: KYC, KYB, AML/CFT, sanctions, transaction-monitoring and related records are retained in accordance with the requirements applicable to the relevant programme and jurisdiction.

• Analytics and Operational Data: Retained in accordance with the relevant processing purposes, contractual arrangements and applicable legal requirements.

• Security and Support Records: Retained for appropriate operational, security, investigation, compliance and dispute-resolution purposes.

We will cease retaining personal data, or remove the means by which it can be associated with particular individuals, when it is no longer required for business or legal purposes.

Retention of Anonymised Information

Under EU GDPR Recital 26 and Singapore PDPA principles, genuinely anonymised information that no longer permits identification of individuals falls outside the respective general personal-data protection requirements.

PvX may therefore retain and commercially use properly anonymised and aggregated datasets indefinitely for predictive analytics, artificial intelligence and model development, benchmarking, research and other lawful business purposes.

Anonymisation is assessed against the risk of direct or indirect identification, taking into account reasonably accessible supplementary information, linkage possibilities and re-identification techniques. Data that remains reasonably re-identifiable is treated as personal data.

Retention or deletion of identifiable source records is managed separately in accordance with applicable legal and regulatory requirements.

11. Your Rights

Depending on applicable legislation and the processing activity, you may have the following rights:

• Access and Correction: Request access to personal data held about you and correction of inaccurate or incomplete information.

• Withdrawal of Consent: Withdraw consent to the collection, use or disclosure of your personal data where processing relies on consent. Withdrawal may affect our ability to provide certain services.

• Erasure: Request deletion of personal data where the right applies, subject to statutory retention obligations and other applicable exceptions.

• Restriction and Objection: Request restriction of, or object to, certain processing activities, including processing for direct marketing.

• Data Portability: Request the transfer of qualifying personal data in a commonly used, machine-readable format where applicable law provides this right.

• Automated Decision-Making: Exercise applicable rights relating to significant automated decisions, including requests for relevant information, human intervention or review where required by law.

• Regulatory Complaints: Lodge a complaint with the relevant data protection or supervisory authority.

To exercise these rights, please contact us using the details in Section 14.

We may request information to verify your identity before processing a request.

Where PvX processes personal data on behalf of a customer acting as the controller, we may refer the request to that customer or assist in responding in accordance with the applicable agreement and law.

We will respond within a reasonable timeframe and within any period required by applicable legislation, subject to relevant legal exceptions.

12. Links to Third-Party Websites

Our websites and platforms may contain links to or integrations with third-party websites, financial institutions, payment providers, analytics platforms and other external services.

We are not responsible for the privacy practices or content of these third-party websites or services.

We encourage users to review the applicable privacy policies and terms of these organisations before providing personal information.

13. Updates to this Privacy Policy

We reserve the right to amend or update this Privacy Policy at any time to reflect changes in our business operations, services, technology, data practices or legal and regulatory requirements.

The updated Privacy Policy will be published on our website with its effective date. We may notify users of material changes through email, website notifications, banners or other appropriate communication channels.

Your continued use of our websites or Services following the effective date of the revised Privacy Policy constitutes acknowledgement and acceptance of the updated Policy, to the extent permitted by applicable law.

Where changes introduce processing activities requiring additional consent or notification under applicable data protection laws, we will fulfil those requirements.

14. Contact Us

If you have questions or concerns about this Privacy Policy or the handling of your personal data, or wish to exercise any applicable privacy rights, please contact:

PvX Partners Pte. Ltd.

45 North Canal Road, #01-01

Lew Building

Singapore 059301

Data Protection Officer / Privacy Enquiries: [email protected]

Website: https://pvxpartners.com

We will make every effort to address your concerns and resolve complaints promptly and in accordance with applicable legal requirements.