1. About this Privacy Policy

1.1. Immersive Finance Ltd ("we", "us", or "our") is committed to protecting your privacy and safeguarding your personal information. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our software and related services (collectively, the "Service"), including our website and our WebApp, and otherwise during our business activities. This Privacy Policy does not apply to personal information collected about our employees, applicants, or other personnel.

1.2. We process your personal data in accordance with this Privacy Policy and applicable data protection legislation, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. Please read this Privacy Policy carefully. If you do not agree with how your personal data is handled as described herein, you should discontinue use of our Service.

1.3. Our Services may contain links to other websites or services; the information practices and content of such external sites are governed by their respective privacy statements.

1.4. Immersive Finance Ltd is registered as a data controller with the Information Commissioner's Office ("ICO") under registration number ZC114209.

2. Information We Collect

2.1. Information You Provide: We may collect personal information that you voluntarily provide to us, such as your name, business email address, professional contact details, billing information, and any communications you submit when using our Service.

2.2. Automatically Collected Information: When you access the Service, we automatically collect technical information, including your IP address, device identifiers, browser type, operating system, access timestamps, and usage analytics.

2.3. Cookies and Tracking Technologies: We use essential cookies necessary for the operation and security of our Service, as well as analytics cookies (such as Google Analytics with IP anonymisation enabled) to understand platform engagement. Non-essential cookies are placed only with your prior consent, which you may grant, modify, or withdraw at any time through our Cookie Preference Centre. For complete details, please review our Cookie Policy.

3. How We Use Your Information and Lawful Bases

3.1. We process your personal data under the following lawful bases pursuant to the UK GDPR:

• 3.1.1. Legitimate Interests (Art. 6(1)(f)): To monitor network security, diagnose technical issues, optimise application features, analyse aggregate usage trends, and manage customer service operations.
• 3.1.2. Legal Obligation (Art. 6(1)(c)): To comply with applicable statutory, tax, regulatory, and anti-financial crime obligations.
• 3.1.3. Consent (Art. 6(1)(a)): Where you have provided clear, affirmative consent, such as for non-essential cookies or direct marketing communications.

3.2. Specific Third-Party Processing:

• 3.2.1. Analytics: We track user behavior and API endpoint interactions to optimise system performance using Google Analytics with anonymised IP features. Google's processing is subject to the Google Privacy Policy.
• 3.2.2. Customer Support: When you submit support tickets, we retain inquiry logs to resolve technical issues and enhance platform reliability.
• 3.2.3. Direct Marketing: We may send promotional updates regarding Immersive Finance products. You may opt out at any time by selecting the unsubscribe link in any marketing email or by emailing info@immersive-finance.com. Opt-out requests are processed promptly and within two (2) business days.
• 3.2.4. Identity and Authentication: User authentication and API access credentials are encrypted and managed via the Auth0 identity platform (Auth0 Privacy Policy). Platform logs and server data are hosted across secure cloud infrastructure providers, including Amazon Web Services (AWS), OVHcloud, and Microsoft Azure.
• 3.2.5. Sub-processors: All third-party vendors process personal data strictly under written data processing agreements compliant with Art. 28 UK GDPR.

4. International Data Transfers

4.1. Where personal data is transferred to or accessed from countries outside the United Kingdom, we ensure adequate safeguards are implemented in accordance with Chapter V of the UK GDPR.

4.2. Transfers are protected by relying on UK Adequacy Regulations, the UK International Data Transfer Agreement ("IDTA"), or the UK Addendum to the European Commission's Standard Contractual Clauses, supplemented by transfer risk assessments where required.

5. Data Security and Retention

5.1. Data Security: We implement appropriate technical and organisational security measures, including end-to-end encryption in transit (TLS 1.3), encryption at rest (AES-256), strict role-based access controls, and regular vulnerability scanning to prevent unauthorised access, loss, or disclosure. While electronic transmissions are subject to inherent internet risks, we maintain rigorous defensive controls.

5.2. Data Retention: We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered, or as mandated by law:

• 5.2.1. Account and Subscription Records: Retained for the active duration of the Customer relationship, plus six (6) years following contract termination to satisfy statutory limitation and accounting obligations.
• 5.2.2. Usage and Analytics Logs: Retained in identifiable form for twenty-four (24) months, after which logs are permanently anonymised or purged.
• 5.2.3. Customer Support Inquiries: Retained for three (3) years from the date of ticket resolution.

6. Sharing Your Information

6.1. We do not sell your personal data. We disclose personal data only:

• 6.1.1. To corporate group entities, subsidiaries, or affiliates where necessary for Service provision;
• 6.1.2. To authorised third-party vendors, processors, and infrastructure partners performing operational tasks on our behalf;
• 6.1.3. In connection with a corporate sale, merger, reorganization, or transfer of business assets, subject to confidentiality protections; or
• 6.1.4. Where required by law, regulatory directive, court order, or to assist with fraud prevention and financial crime compliance.

6.2. We may publish aggregated, anonymised statistics that cannot identify any individual.

7. Your Data Subject Rights

7.1. Under the UK GDPR and Data Protection Act 2018, you have the following rights:

• 7.1.1. Right of Access: The right to request a copy of the personal data held about you (a Subject Access Request).
• 7.1.2. Right to Rectification: The right to request correction of inaccurate or incomplete data.
• 7.1.3. Right to Erasure ("Right to be Forgotten"): The right to request deletion of your personal data where retention is no longer legally justified.
• 7.1.4. Right to Restriction: The right to limit data processing under certain statutory circumstances.
• 7.1.5. Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
• 7.1.6. Right to Object: The right to object to processing based on legitimate interests or direct marketing.
• 7.1.7. Right to Withdraw Consent: The right to withdraw consent at any time where processing was grounded exclusively on consent.

7.2. To exercise any of these rights, please email info@immersive-finance.com. We respond to verified requests within one (1) calendar month without fee, unless a request is manifestly unfounded or excessive.

8. Regulatory Supervision and Complaints

8.1. You have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office ("ICO"):

• Website: https://www.ico.org.uk
• Telephone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

8.2. We welcome the opportunity to resolve any data privacy concerns directly before you contact the ICO. Please contact us in the first instance at info@immersive-finance.com.