Privacy Policy

Veloziq ("we", "us", "our", or "Platform") is committed to protecting your personal privacy and safeguarding your data. This Privacy Policy ("Policy") details how we collect, process, store, disclose, and protect your information when you visit our website (https://www.veloziq.com) or use our SaaS Lending Lifecycle Platform.

1. Scope and Roles: Controller vs. Processor

Please distinguish between our operational roles under applicable data privacy frameworks:

As a Data Controller: When you register an administrative account on behalf of your company, pay for subscriptions, or contact our support and sales teams, Veloziq acts as the Data Controller of your professional contact and billing information.

As a Data Processor: When our enterprise clients use the Veloziq Platform to process loan applications, credit scores, and financial records of their end-borrowers, the client is the Data Controller, and Veloziq acts strictly as a Data Processor performing services under the client's instructions. End-borrowers seeking access or deletion of their records must contact the lending institution directly.

2. Categories of Information We Collect

2.1 Information Provided Directly by You:

Account & Business Data: Name, company name, corporate email address, job title, phone number, and physical office address.

Billing Details: Payment card numbers, billing addresses, and transaction histories (processed securely via PCI-DSS compliant third-party gateways like Stripe).

Customer Support Records: Communications, support tickets, and feedback submitted to our team.

2.2 Borrower & Lending Data Processed on Behalf of Clients (Processor Role):

Personally Identifiable Information (PII) of loan applicants (e.g., full legal name, national ID/passport number, date of birth).

Financial and credit metrics (e.g., income statements, bank account statements, credit scores, repayment histories).

2.3 Automatically Collected Log and Telemetry Data:

IP address, browser type, device specifications, operating system, and geolocation data.

Access logs, API invocation metrics, timestamps, and error diagnostic logs.

Cookies and similar session-tracking technologies essential for platform security and UI preferences.

3. Purpose and Legal Bases for Processing

We process personal data only when substantiated by a lawful basis (e.g., contractual necessity, statutory obligations, legitimate business interests, or express consent):

Providing and Operating SaaS Services: User authentication, multi-tenant workspace management, API processing, and billing.

Platform Security and Integrity: Threat detection, fraud prevention, defense against cyberattacks, and system load balancing.

Customer Support & Communications: Issuing critical system updates, security patches, administrative notices, and technical assistance.

Regulatory Compliance: Meeting statutory requirements related to anti-money laundering (AML), taxation, accounting audits, and responding to judicial warrants.

4. Data Sharing and Third-Party Disclosures

We never sell personal data. We disclose information solely under the following limited conditions: 4.1 Third-Party Service Providers: Cloud hosting providers (e.g., AWS, Azure, GCP), cybersecurity partners (e.g., Cloudflare), and payment infrastructure providers. All vendors are bound by Data Processing Agreements (DPAs) and stringent confidentiality obligations.

4.2 Legal and Regulatory Mandates: Where required by judicial order, law enforcement subpoena, or administrative authorities, or to protect the vital interests and safety of Veloziq, its customers, or the public.

4.3 Business Transfers: In connection with any merger, acquisition, corporate reorganization, or sale of company assets, where customer data forms part of the transferred business assets.

5. Data Security Standards

We implement enterprise-grade security protocols tailored to financial SaaS environments:

Encryption Standards: Mandatory TLS 1.3 encryption in transit; AES-256 bit encryption for all databases and files at rest.

Logical Tenant Isolation: Strict architectural separation ensuring no cross-tenant data leakage.

Access Control & Auditing: Strict Principle of Least Privilege (PoLP), enforced Multi-Factor Authentication (MFA), and immutable audit trails for sensitive operations.

6. International Data Transfers & Retention

6.1 Cross-Border Transfers: Data may be processed on secure cloud servers located globally (e.g., Taiwan, Singapore, Japan, or the United States). For cross-border transfers from regulated jurisdictions, we implement Standard Contractual Clauses (SCCs) or equivalent adequacy safeguards.

6.2 Data Retention: We retain personal information for the duration of the subscription agreement. Following termination, records are purged or anonymized within established retention windows, save where statutory laws (such as financial audit, tax, or AML recordkeeping mandates) require extended retention (typically 5 to 7 years).

7. Your Statutory Rights

Subject to applicable data protection laws (such as the Taiwan Personal Data Protection Act, GDPR, or CCPA), you may exercise the following rights:

The right to access, inspect, and receive a copy of your personal data.

The right to request correction or updating of inaccurate records.

The right to request restriction, cessation of processing, or erasure of your data.

The right to data portability in a machine-readable format.

To exercise these rights, please contact our privacy office. (End-borrowers must submit requests directly to their loan provider).

8. Updates and Contact Information

We may amend this Privacy Policy periodically. Significant changes will be communicated via website banners or direct email notification.