VALO Tech holds a short list of things about the people who read its investor reporting. This page says what, why, how long, and what you can ask us for.
What we hold, and why
- Your name and email address, so a named person can be given access to company reporting.
- Your role and the state of your account, so the hall knows what you may read.
- Your last sign-in and your open sessions, so you and an administrator can see them and end them.
- Which documents you have opened, and when, so the hall can show you what is new and record which version of a deck you were shown. An administrator sees when you last opened each deck granted to you by name and, before deleting your account, how many of these records it holds. The file that answers a request for a copy of your data carries all of them. They are never totalled across people or reported as analytics, and they go when your account goes.
- Whether we have recorded you as having invested or as still deciding, so the hall can put first what you came for. It orders the page and never changes which documents you may read.
- If you ask for investor access, when you asked, so somebody at the company can answer. It is cleared when your role changes or the company declines the request.
- The language you read in, so the mail about your account and the unsubscribe line of our other mail reach you in it. It is recorded when your account is made, if a language is given then, and changes when you choose a language in the hall.
- When you last used a link we sent to your email address, such as an invitation or a password reset, so that our mail, apart from the messages that let you in, goes only to an address shown to be yours. It is cleared when your address is corrected, until you use a link sent to the new one.
Your name and email address, and your role and the state of your account, rest on your consent, given when you accepted your invitation or created an account yourself. Your last sign-in and your open sessions, the documents you have opened, and whether we have recorded you as having invested rest on our legitimate interest in keeping your account secure, the hall accurate, and what it shows you worth your time.
How long we keep it
As long as you have access. Deleting an account is a real deletion: the rows go, not a flag on them.
Encrypted backups are kept for about twelve months, and longer where a month passes without one, so somebody deleted today can still appear in a backup taken before that. Those backups are opened only to recover from data loss or to rehearse that recovery, never to look a person up.
Where it is held
VALO Tech is a Singapore company, and your data is ours to look after. It passes through others on its way: Amazon Web Services, which runs our servers and delivers our email; Cloudflare, which carries every request between your browser and the hall, runs the check our sign-in, registration and reset forms can ask for, and receives the mail sent to our address; the provider of the mailbox that mail is forwarded to; and your own email provider, which receives what we send you.
So it may rest in a country other than the one you are in. Wherever it rests, it goes nowhere without a written agreement binding whoever receives it to the protection it has here: standard contractual clauses, in the ordinary case.
If something goes wrong
If your data is lost or exposed in a way that could affect you, we tell you within seventy-two hours of learning of it. That is a limit and not a schedule: if we understand what happened on the first morning, you hear from us that morning. One clock, for everybody, wherever you are.
What you can ask for
- A copy of what we hold about you.
- Your data as a file a machine can read, if you want to take it elsewhere. We send you the file itself, never a link to fetch it.
- A correction, if something is wrong.
- To tell us to stop recording what you open. We stop, and we delete what is already there; your account keeps working, but the hall can no longer mark what is new, so everything looks unread.
- To withdraw your consent, which means deleting your account, because access is the only thing your data is here for.
- Deletion.
We answer as soon as we reasonably can. If we cannot answer within thirty days, we will write to tell you when we will.
Who to write to
Write to Tess Pham, tess.pham@valotech.org.