Privacy statement

1Introduction

At TransVare Corporation (hereinafter referred to as ‘TransVare’ or ‘us’ or ‘we’), we value your privacy and are committed to upholding the highest standards of confidentiality in managing and processing your personal information. We tell customers what information we hold about them and allow them to opt out of specific engagements. We do not sell your personal information. We only share your personal information within TransVare and with trusted partners or service providers, and only as necessary to provide our services or comply with legal requirements.

For personal information relating to your account, your use of our website, and our business and marketing relationship with you, TransVare Corporation acts as the controller. Where our clients use TransVare products to process personal information contained within their own business records, our clients act as the controller and TransVare Corporation acts as a processor on their behalf, in accordance with their instructions and the terms of the applicable agreement between us. Our contact details are set out in the How to Contact Us section at the end of this document.

This privacy statement outlines how TransVare collects, processes, and shares personal information of its products and service users and other individuals and organizations with whom we have a business relationship. This privacy statement applies to TransVare’s website and its products, including AuditVare, ERMVare, ComplianceVare, GovernanceVare, InciVare, CyberVare and BCMVare.

2Personal Information We Collect, and How We Collect It

This section describes the types of information we collect as you use our products and services and how we collect it. It includes information relating to Your Account, the TransVare Website, TransVare Applications, Children, and Cookies.

TransVare gathers information about you only when necessary for legitimate purposes. We may possess information about you if (a) you have voluntarily provided the information, (b) the information has been automatically collected by TransVare, or (c) TransVare has acquired the information from a third party.

The main types of information we collect and use include profile details, webpage interactions, marketing preferences, data used to investigate malicious activity, recordings or transcripts of support-related conversations with us, and information used to improve our business operations.

2.1Your Account

When you create an account within any of TransVare’s products, it will provide TransVare with your name, email address, and country or region of residence. Your account may be necessary for certain services, such as accessing TransVare Applications and other Services. Additionally, we may store details from business contact information provided by you or collected from your organization.

2.1.1Purpose

Your account serves to uniquely identify you when using any of our products. It enables you to access TransVare Applications and facilitates the management of your account-related activities.

2.1.2Use of Your Account Information

We use your contact information, including your name and business contact details, to engage with you regarding business matters. Moreover, we may combine your business contact information with other relevant data, such as details about your professional education, skills, work experience, or publicly available information. This information allows us to tailor our interactions with you, such as in the sales process, to foster and sustain a relationship, and for post-contractual engagements.

2.2TransVare Website

Our website offers ways to communicate with you about us, our products, and services. Our TransVare website does not require any account information and you can explore our website without disclosing any personal information about yourself, but we may still collect information that is connected to your website visit. We collect information about your use of our websites, such as the internet protocol (IP) address, browser type, language preference, time zone, referring URL, date and time of access, operating system, and device information. We include these in our log files to understand more about visitors to our websites.

2.2.1Purpose

The information gathered on our website is used to grant you access to the site, manage its operation, enhance your browsing experience, and customize the presentation of information to suit your preferences.

2.2.2Use of Website Information

We use this information to provide you with access to the website, operate it effectively, and enhance your user experience. We also improve the information we provide on the TransVare website and our product websites based on your preferences and usage patterns.

We are not responsible for any content that you make available through your use of our products or services. Furthermore, we accept no responsibility for the content provided on third-party websites or applications, nor for their privacy practices.

Please note that our website is integrated with third-party applications. As such, we may receive information from and send information to these third-party applications as required. However, we do not have control over the content or privacy practices of these third-party applications.

2.3TransVare Applications

TransVare applications collect information about your use of these products including your account information, passwords, your settings within the product, IP address, browser type and organization details. In order to protect your personally identifiable information, we have implemented appropriate technical and organizational measures, such as using encryption for transmission of information, multi-factor authentication (MFA) and CAPTCHA to help us keep your information secure, accurate, current, and complete. We may record, analyze, and use your interactions with us, including email, telephone, and chat conversations with our sales and customer support professionals, for improving our interactions with you and other customers.

2.3.1Purpose

This information is collected to provide you with access to operate the service, to provide you support, to personalize and improve your experience of the service, to develop other services and technologies, and generate technical and market insights.

2.3.2Use of Application Information

The aforementioned application information is used to access the service, operate the service, provide support, personalize and enhance your service experience, develop other services and technologies, and generate technical and market insights. We use this information to understand how users use our products and services, monitor and mitigate issues, enhance our offerings, provide customer support, analyze and improve our interactions with customers, update and expand our records, identify potential customers, and deliver products and services that may be of interest to you.

2.4Children

Our products and services are not directed to individuals under 16. TransVare does not knowingly collect personal information from children under 16 years of age for its own purposes. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete such information. Because our products are used by organizations to manage their own records, our customers may, through their use of the products, provide us with information relating to individuals who may be children. Where the applicable minimum age in your country or region is higher than 16, that higher age applies. If you become aware that a child has provided us with personal information, please contact the TransVare support team at [email protected].

2.5Cookies

TransVare employs cookies to enhance your browsing experience on its website. A cookie is a small text file stored on your computer or other internet-connected device, serving to identify your browser, provide analytics, and remember information about you, such as your language preference or login details. Cookies cannot be used to run programs or deliver viruses to your device.

2.5.1Purpose

There are some cookies that are necessary for our website to function and cannot be switched off in our systems. They are essential in order to enable you to navigate around the website and use its features. Some cookies enable us to retain your preferences (such as your username or region) helping to deliver a personalized online experience. Analytics cookies aid us in enhancing the functionality of our websites by ensuring that users can easily find what they are seeking. They track information about website visits, enabling us to make improvements and report on our performance.

2.5.2Use of Cookies

Cookies are used to provide you with an exceptional browsing experience on our website, ensuring seamless navigation, personalized content, and improved functionality tailored to your preferences and needs. TransVare website allows you to select which categories of cookies you accept or reject. Essential cookies cannot be rejected as they are strictly necessary to provide you with services.

If you choose to reject cookies, you may still use our website though your access to some functionality and areas of our website may be restricted. You may also set or amend your web browser controls to accept or refuse cookies.

You can review and change your cookie preferences at any time using the cookie preference centre available on our website.

3Sharing, Storing and Using Personal Information

At TransVare, we may share your personal information internally and externally for legitimate business purposes, but only on a need-to-know basis. This section outlines how we share information and how we use your personal information, including the retention of your personal information.

3.1How We Share Personal Information

When sharing personal information, we implement appropriate checks and controls to ensure compliance with applicable laws. We may need to share your information with the following entities:

Employees and Independent Contractors

Employees and independent contractors of TransVare have access to the aforementioned information on a need-to-know basis. We mandate that all employees and independent contractors adhere to this Privacy Policy regarding the personal information shared with them.

Third-party Service Providers

We may share your personal information, as well as aggregated or de-identified information, with third-party service providers engaged by us, such as marketing and advertising partners, event organizers, web analytics providers, and payment processors. These service providers are authorized to use your personal information solely for the purpose of providing services to us and are not permitted to use it for their own purposes. Where we work with marketing or advertising partners, any use of cookies or similar technologies for targeted advertising is subject to your cookie preferences and, where required, to your consent.

Other Cases

We may share the same information covered in the Personal Information We Collect, and How We Collect It section of the privacy policy in other scenarios as outlined therein.

3.2How We Use Personal Information

TransVare may use your Personal Information to:

• Deliver our products and respond to your support requests.
• Process your payment when you purchase our products or services.
• Send communications to you about products and services available from TransVare, event announcements, marketing communications, important product notices including those announcing changes to our policies, promotional offers, and surveys.
• Facilitate the use of our website, products, and services.
• Advertise and market TransVare products, for example by delivering targeted advertisements on our website and other websites, analyzing the effectiveness of those advertisements, and determining whether you would be interested in receiving offers about new products or services.
• Administer, customize, personalize, analyze, and improve our products, services (including the content and advertisements on our website), technologies, communications, and relationship with you.
• Prevent fraud and other prohibited or illegal activities.

In addition to the above uses, TransVare’s administrators may have access to your personal information for the following purposes:

Support and Maintenance

To assist with technical support, troubleshoot issues, and ensure the smooth operation of TransVare websites, products and services.

Security Management

To monitor, detect, and respond to security incidents and ensure the integrity and security of our systems and data.

Compliance and Legal Requirements

To comply with applicable laws, regulations, and legal processes, including inspections and investigations.

Data Management

To perform data analysis, system updates, and maintenance activities necessary for the operation and enhancement of our services and systems.

Administrators are only granted access to personal data on a need-to-know basis and are required to adhere to strict confidentiality and security policies to protect your information.

3.3How We Store and Secure Your Personal Information

To protect your personal information from unauthorized access, use, and disclosure, we implement reasonable physical, administrative, and technical safeguards. These safeguards include:

Role-Based Access Controls

Access to personal information is restricted to authorized personnel who need it to perform their job duties.

Encryption

Personal information is encrypted both in transit and at rest to ensure it remains private and secure.

Administrative Safeguards

Policies and procedures are in place to ensure the secure handling of personal information, including regular training for employees on data protection practices.

By implementing these safeguards, we aim to ensure that your personal information is protected throughout its lifecycle, from collection to secure deletion or anonymization.

While no method of transmission or storage can be guaranteed to be completely secure, in the event of a personal data breach we will take prompt steps to investigate and contain the incident, mitigate its effects, and, where required by applicable law, notify the affected individuals and the relevant supervisory authority within the applicable timeframes.

3.4International Data Transfers

In some cases, your personal information may be transferred to and processed in a country other than the one in which it was collected. Whenever we transfer personal information across borders, we ensure that appropriate safeguards are in place to protect your information and to meet applicable data protection requirements. These safeguards may include:

• Obtaining the consent of the data subject.
• Ensuring that the receiving country provides an adequate level of protection for personal information.
• Implementing additional safeguards, if necessary. This may include binding corporate rules (BCRs) or standard contractual clauses (SCCs).
• Implementing appropriate security measures to protect the data in transit and at rest. This may include measures such as encryption, access control, and data breach prevention measures.
• Obtaining a written agreement from the receiving organization that sets out the security measures it will apply to protect the information.

3.5Retention of Your Personal Information

We retain the data we collect for as long as necessary to fulfill the purposes for which it is processed, or to comply with legal and regulatory retention requirements. Legal and regulatory retention requirements may include retaining information for:

• Accounting, tax and statutory record keeping purposes.
• Handling of disputes.
• Establishment, exercise, or defense of legal claims.

When personal information is no longer needed, we have processes in place to securely delete it or anonymize it, and in cases where we cannot delete or anonymize it (for example, where it has been stored in routine backups), it will be securely stored until it can be deleted or anonymized.

3.6Legal Bases for Processing Personal Information

Where data protection laws apply to our processing, we process your personal information only where we have a valid legal basis to do so. Depending on the context, the legal bases we rely on include:

Performance of a contract

where processing is necessary to provide the products and services that you or your organization have requested, or to take steps at your request before entering into a contract.

Legitimate interests

where processing is necessary for our legitimate business interests, such as securing our systems, preventing fraud, improving our products, and communicating with you about our services, provided that these interests are not overridden by your rights and freedoms.

Legal obligation

where processing is necessary to comply with a legal or regulatory obligation to which we are subject.

Consent

where you have given us your consent to process your personal information for a specific purpose, such as certain marketing communications or the use of non-essential cookies.

Where we rely on consent, you may withdraw it at any time; where we rely on legitimate interests, you may object to the processing. You can exercise these rights as described in the Your Rights section below.

3.7Automated Decision Making and Profiling

We do not make decisions based solely on automated processing that produce legal effects concerning you or that otherwise significantly affect you. Where TransVare products include automated scoring, ranking, sampling or analytical features, those features are configured and operated by our clients within their own environments, and any resulting decision remains subject to review by the client. If you believe that a decision affecting you has been taken on an automated basis, you may contact us using the details set out at the end of this document and request that the matter be reviewed.

4Deleting Your Personal Information

To delete your account and related personal information from our products, including our web applications, please contact TransVare administration at [email protected].

To start the process, we will ask you to verify your identity using a temporary verification code. This may require the same email address that is linked to your TransVare account to be active.

Once we have verified your identity, your account will be deactivated immediately. We will then complete the deletion of your personal information from our active systems within 30 days of the verified request. Because our services and products are designed to protect information from accidental or malicious deletion, residual copies may remain in routine backups for a limited period, and these will be removed within 90 days of the verified request. Where we are required to retain certain information in order to meet a legal or regulatory obligation, we will retain only what is necessary for that purpose and will delete or anonymize it once that obligation has been satisfied.

5Your Rights

You possess certain rights regarding the handling of your personal information. You can use the “Contact Us” form at transvare.com/contact to:

• Request access to the personal information we have concerning you.
• Request updates or corrections to your personal information to ensure it is accurate.
• Request the deletion of the personal information we hold about you.
• Opt-out of specific types of personal information processing, such as targeted advertising.
• Request the restriction of processing of your personal information under certain circumstances.
• Request data portability, which allows you to obtain and reuse your personal information for your own purposes across different services.
• Object to the processing of your personal information, especially where we rely on legitimate interests as the legal basis for processing.
• Withdraw consent at any time where we are relying on consent to process your personal information.
• Ask questions related to this Privacy Statement and our privacy practices.
• Lodge a complaint with TransVare if you are dissatisfied with how we process your personal information.

Your rights may be subject to limitations and exceptions resulting from applicable laws. For example, there may be situations where we cannot share certain information that you seek if disclosing this means disclosing information about others.

We will respond to any request relating to these rights within 30 days of receiving it and of verifying your identity. Where a request is particularly complex, or where we receive a number of requests from you, we may extend this period and will inform you of the extension and the reasons for it.

6Privacy Statement Updates

This privacy statement was last updated on 1 August 2026.

If you have any questions related to it or you want to discuss any of your rights, please send an email to [email protected].

Note that TransVare reserves the right to modify this Privacy Statement at any time. In the event of significant changes, we will notify users either via email or through our website. All modifications are effective as of the date they are posted on the TransVare Privacy Statement page.

7Governing Law

This Privacy Statement, and any matter arising from it or from our processing of your personal information, is governed by the laws of the State of Delaware, United States of America. This does not affect any mandatory rights that you may have under the laws of the country or region in which you reside.

8How to Contact Us

Questions, requests and complaints relating to this Privacy Statement or to our handling of your personal information should be addressed to our Privacy Office using the details below. Our Privacy Office is responsible for overseeing compliance with this Privacy Statement and for responding to requests relating to your rights.

Email us at: [email protected]