Privacy notice.

Version 1.0 | Effective from 10 October 2026 | Last updated 10 October 2026

This notice is given under section 5 of the Digital Personal Data Protection Act 2023 and rule 3 of the Digital Personal Data Protection Rules 2025. Section 12 applies to visitors from the United Kingdom.

1. Who we are

1.1 Pramanex is a trading name of Finversal Capital Services Private Limited (CIN U66190OD2025PTC049940), registered office C/o Chandra Devi Singh, Bepari Sahi, Buxi Bazar, Cuttack 753001, Odisha, India ("we", "us").

1.2 For the personal data described in this notice we are the data fiduciary under the Digital Personal Data Protection Act 2023 (the "DPDP Act"). For personal data contained in documents our clients give us to review (for example the names and pay of a company's directors), we act as a data processor on the client's instructions, and the client's own privacy notice applies to that data.

1.3 Contact for this notice: the Grievance Officer of Finversal Capital Services Private Limited, email hello@pramanex.com, phone or WhatsApp +91 90110 04765, postal address as above. This person can answer your questions about the personal data we process.

2. Definitions

2.1 "Data principal" means you, the individual to whom personal data relates.

2.2 "Personal data" means any data about an individual who is identifiable by or in relation to that data.

2.3 "Processing" means any operation on personal data, including collection, storage, use, sharing and erasure.

2.4 "Board" means the Data Protection Board of India.

3. What personal data we collect, and why

This is the itemised description required by the DPDP Act.

3.2 We do not knowingly collect personal data of children (persons under 18). Our services are for businesses.

3.3 We do not collect data for behavioural monitoring or targeted advertising to children, and we do not sell personal data.

4. Consent and how to withdraw it

4.1 Where we rely on your consent (marketing, non-essential cookies), the consent is a free, specific, informed and unambiguous act, given through a tick-box or setting that you choose. We do not make a service conditional on consent that the service does not need.

4.2 You may withdraw consent at any time, as easily as you gave it: by the unsubscribe link in any marketing email, by the cookie settings link in the website footer, or by writing to hello@pramanex.com or calling +91 90110 04765. Withdrawal does not affect processing done before withdrawal, and we may still process data under another basis (for example to keep legal records).

4.3 If you withdraw consent for a purpose, we will stop processing for that purpose within a reasonable time and in any event within 30 days.

4.4 You may give, manage or withdraw consent through a consent manager registered with the Board, once such services are available, by telling us the consent manager you use.

5. Who we share personal data with

5.1 Our processors, who act on our instructions under written contracts: our cloud hosting provider (data centre in India); our AI model provider, which processes documents under enterprise terms that do not permit training on customer data; our payment gateway (which receives payment details directly from you under its own notice; we do not see card numbers); our email and customer-relationship system; and our licensed registry-data provider. The current list of processors is published on the website.

5.2 Clients: if you are a reviewer, your name and identifier are given to the client for its structured digital database or insider list, as the law requires.

5.3 Regulators, exchanges, courts and law enforcement, when the law requires or permits.

5.4 A buyer of our business, if the Pramanex business is sold, under a duty of confidence and on notice to you.

5.5 We do not share personal data with any other vertical of the Company. Our Information Barrier Policy applies.

6. Marketing

6.1 We send marketing emails about our services only if you have ticked the marketing box or have asked for our publications. Each email carries an unsubscribe link. We do not send marketing by telephone or text message.

6.2 If you are a client contact, we may send you service messages (status updates, invoices, legal notices). These are not marketing and you cannot opt out of them while the contract runs.

7. Cookies

7.1 Essential cookies keep the site working (session, security, cookie preferences). They do not need consent.

7.2 Analytics cookies tell us how the site is used. We set them only if you accept them on the cookie banner. You can change your choice in the footer link at any time.

7.3 We do not use advertising or tracking cookies.

8. Where data is stored, and transfers outside India

8.1 Website enquiries and booking requests are stored in a database hosted in Mumbai, India, and are processed by our hosting provider's servers in Mumbai. They may pass through servers outside India in transit. Review documents for Indian clients are handled as agreed in the engagement letter.

8.2 Some of our processors (the AI model provider, the email system) may process data on servers outside India. We transfer personal data outside India only to countries not restricted by the Central Government under section 16 of the DPDP Act, and only under contracts that require the processor to protect it to the standard of this notice.

8.3 For United Kingdom visitors and clients, see section 12.

9. How long we keep personal data

9.2 When the purpose is served and no law requires retention, we erase the data or make it anonymous. Where the DPDP Rules require us to give you notice before erasing data on the ground that you have not used the service, we will give that notice at least 48 hours before erasure.

10. Security and breaches

10.1 We protect personal data with encryption in storage and in transfer, access limited to authorised people using multi-factor authentication, and contractual obligations on our processors (website hosting and database), as rule 6 of the DPDP Rules requires. Review documents are kept apart for each client and deleted as described in the Privacy page.

10.2 If a personal data breach occurs that affects you, we will tell you without delay, in plain language, through your registered email address or another channel you have given us, describing: what happened; the likely consequences for you; what we are doing about it; what you can do to protect yourself; and how to contact the person in clause 1.3.

10.3 We will also notify the Board without delay on becoming aware of the breach, and will send the Board the full report required by rule 7 of the DPDP Rules within 72 hours (or such longer period as the Board allows).

10.4 We keep a record of every breach and of the steps taken.

11. Your rights under the DPDP Act, and how to use them

11.1 Access (section 11). You may ask for a summary of the personal data we process about you, the processing activities, and the identities of the persons with whom it has been shared.

11.2 Correction, completion, updating and erasure (section 12). You may ask us to correct inaccurate or misleading data, complete it, update it, or erase it, unless we must keep it to comply with a law.

11.3 Grievance redressal (section 13). You may raise a grievance with the person in clause 1.3. We will acknowledge within 2 working days and respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India after using our grievance process.

11.4 Nomination (section 14). You may nominate another individual to exercise your rights if you die or become incapacitated. Write to us with the nominee's name and contact details.

11.5 How to make a request. Email hello@pramanex.com from the address we hold for you, call +91 90110 04765, or write to the registered office, stating what you want. We may ask you to confirm your identity. Requests are free, unless they are repeated and clearly excessive.

11.6 Your duties (section 15). You must not impersonate another person, suppress material information when giving data for a document or identity proof, or make a false or frivolous grievance or complaint.

12. United Kingdom visitors and clients

This section applies if you are in the United Kingdom. It applies in addition to the rest of this notice, and where they differ, this section governs your UK GDPR rights.

12.1 Controller. Finversal Capital Services Private Limited is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We have no establishment in the United Kingdom. Our UK representative under Article 27 UK GDPR is a UK representative, to be appointed before any UK engagement begins.

12.2 Lawful bases. We process your data: to perform a contract with you or take steps at your request before a contract (Article 6(1)(b)); to comply with a legal obligation, including UK MAR insider list duties (Article 6(1)(c)); for our legitimate interests in running and securing the website, responding to enquiries and managing client relationships, where your interests do not override ours (Article 6(1)(f)); and with your consent for marketing and non-essential cookies (Article 6(1)(a)). Marketing emails to individuals are sent only with consent under the Privacy and Electronic Communications Regulations 2003.

12.3 International transfers. Your data is transferred to and stored in India, which is not covered by UK adequacy regulations. We rely on the International Data Transfer Agreement, or the Addendum to the EU Standard Contractual Clauses, issued by the Information Commissioner, together with the security measures in clause 10. You may ask for a copy of the transfer agreement.

12.4 Your rights. You may: ask for access to your data; have it rectified; have it erased; restrict or object to processing; receive the data you gave us in a portable form; withdraw consent at any time; and not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (we make no such decisions). To exercise a right, email hello@pramanex.com, phone or WhatsApp +91 90110 04765. We respond within one month.

12.5 Insider lists. If you are placed on an insider list for a UK issuer we are acting for, we collect your full name, birth surname, professional and personal telephone numbers, company name and address, function, date and time of access, date of birth, national identification number (where applicable) and personal address, because Article 18 of UK MAR requires it. We keep this for five years.

12.6 Complaints. You may complain to the Information Commissioner's Office at ico.org.uk or by telephone on 0303 123 1113. We would welcome the chance to deal with your concern first.

12.7 Retention is as in section 9, unless UK law requires a different period.

13. Changes to this notice

13.1 We may update this notice. The date at the top shows the current version. If a change affects how we use data you have already given us, we will tell you by email or by a notice on the website before the change takes effect.

14. Complaints to the Data Protection Board of India

14.1 If we have not resolved your grievance within the time in clause 11.3, you may complain to the Data Protection Board of India through the channel the Board publishes.

15. Visitors and clients in other countries, including the United States

15.1 If you contact us from outside India and the United Kingdom, the details you give are stored in our database in Mumbai, India, and used only to respond to you and, if you become a client, to deliver the engagement. We do not sell personal data or use it for advertising.

15.2 You may ask us to access, correct or delete the personal data we hold about you by writing to hello@pramanex.com or calling +91 90110 04765. We respond within one month.

15.3 For an engagement, where documents are stored and processed is agreed in the engagement letter before anything is shared. With the Enterprise option, documents stay in your own cloud account.

Pramanex is a brand of Finversal Capital Services Private Limited, a company incorporated in India. CIN U66190OD2025PTC049940. Registered office: C/o Chandra Devi Singh, Bepari Sahi, Buxi Bazar, Cuttack 753001, Odisha, India.