Privacy Policy

Regulatory Alignment

This Policy is aligned with the following data protection and industry frameworks applicable to Quinfy's operations.

1. Introduction & Who We Are

Quinfy Technology Private Limited and Quinfy Inc. (collectively "Quinfy", "we", "our", or "us") operate as a background verification (BGV) and HR technology organization. We provide identity verification, employment checks, education verification, criminal record checks, and related services to corporate clients through our platforms at www.quinfy.com, www.quinplus.co, and www.bgv.world.

In providing these services, Quinfy collects and processes significant volumes of personal data about candidates, clients, and platform users. We take our responsibility as a Data Fiduciary seriously and are committed to handling all personal data lawfully, transparently, and with respect for the privacy rights of every individual.

This Privacy Policy explains:

• What personal data we collect and why
• The lawful basis on which we process it
• How long we retain it and how we protect it
• Who we share it with and under what safeguards
• Your rights as a Data Principal / Data Subject and how to exercise them
• How to contact our Grievance Officer or Data Protection Officer

By using our platforms or services, you acknowledge that you have read and understood this Privacy Policy. Where processing is based on consent, your continued use of the service after this Policy is published constitutes acknowledgement; however, we will always seek explicit consent before processing SPDI or initiating a BGV check.

2. Scope of this Policy

This Privacy Policy applies to:

• Candidates: Individuals who are the subject of a background verification check initiated by a client organisation through the Quinplus platform
• Client Users: Employees and representatives of corporate client organisations who use the Quinplus platform to manage BGV workflows
• Website Visitors: Individuals who visit www.quinfy.com, www.quinplus.co, or www.bgv.world
• Platform Users: Any registered user of Quinfy’s services, including job applicants who access the self-service portal

This Policy applies to processing of personal data regardless of whether it is carried out by Quinfy directly or by an authorised third-party data processor acting on our instructions.

Where Quinfy acts as a Data Processor on behalf of a client organisation (the Data Fiduciary), the client's privacy notice governs the processing of that data. Quinfy's obligations in that capacity are set out in the relevant Data Processing Agreement (DPA).

3. Personal Data We Collect

We collect only the personal data that is necessary, adequate, and relevant to the specific purpose for which it is collected (data minimization principle). The categories of personal data we may collect are set out below.

Quinfy does not collect biometric data (fingerprints, facial recognition) unless explicitly required by a specific client mandate and separately consented to by the candidate. Children's data (individuals under 18) is not collected knowingly. If you believe we have inadvertently collected data about a person under 18, please contact grievanceofficer@quinfy.com immediately.

4. How We Collect Personal Data

5. Lawful Basis for Processing

Quinfy processes personal data only where we have a valid lawful basis to do so. The table below sets out the lawful basis for each principal processing activity.

Where we rely on consent as the lawful basis, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal does not entitle you to destruction of data that Quinfy is legally required to retain.

6. Background Verification: Special Processing Provisions

As a background verification organisation, Quinfy is subject to specific obligations that go beyond general data protection requirements. This section sets out those BGV-specific provisions.

7. Your Privacy Rights

Quinfy recognises and upholds the privacy rights of all Data Principals (candidates, users, and website visitors). Your rights are set out in the table below.

To exercise any of the above rights, please contact our Grievance Officer at grievanceofficer@quinfy.com. We will acknowledge your request within 48 hours and respond substantively within the timeframes stated above. Identity verification will be required before we can act on a request.

If you are dissatisfied with our response, you have the right to escalate your complaint to the Data Protection Board of India (for Indian residents) or the relevant supervisory authority in your jurisdiction.

8. Data Retention

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, to comply with legal obligations, resolve disputes, and enforce our agreements. The retention schedule below applies:

Upon expiry of the applicable retention period, personal data will be securely deleted or destroyed using industry-standard methods. Where data must be retained for regulatory reasons beyond the stated period, we will notify you where required by law.

9. Disclosure & Third-Party Data Sharing

Quinfy does not sell, rent, or trade personal data. We share personal data only in the circumstances described below, and always subject to appropriate contractual safeguards.

10. Cookies & Tracking Technologies

Quinfy uses cookies and similar tracking technologies on our websites to provide core functionality, improve user experience, and (with your explicit consent) for analytics and marketing. A cookie preference centre is available on all Quinfy websites, allowing you to manage your consent.

You may update your cookie preferences at any time via the cookie preference centre accessible from the footer of our websites. You can also configure your browser to block or delete cookies; however, disabling strictly necessary cookies will impair your ability to use the platform.

11. International Data Transfers

Quinfy's primary data processing infrastructure is located in India. However, the nature of our BGV services and cloud infrastructure means that personal data may be transferred to and processed in other countries. All international transfers are carried out in accordance with the applicable legal requirements.

We will never transfer personal data to a country that does not provide adequate protection unless appropriate legal mechanisms (such as Standard Contractual Clauses) are in place. Candidates whose data may be subject to cross-border transfer will be informed of this in the consent notice presented before their BGV check.

12. Security of Personal Data

Quinfy implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Encryption of all personal data at rest (AES-256) and in transit (TLS 1.3)
• Role-based access controls (RBAC) and multi-factor authentication (MFA) on all systems handling Confidential or Restricted data
• Regular penetration testing and vulnerability assessments
• Data Loss Prevention (DLP) controls to prevent unauthorised exfiltration of PII/SPDI
• Comprehensive audit logging of all access to personal data, retained for 12 months
• ISO 27001:2022 certified Information Security Management System
• SOC 2 Type II assurance covering security, availability, and confidentiality

While we implement industry-leading security practices, no method of electronic transmission or storage is 100% secure. In the event of a personal data breach that is likely to result in risk to your rights, we will notify you and the relevant regulatory authority within 72 hours of becoming aware of the breach, as required by the DPDP Act 2023.

13. Personal Data Breach Notification

In the event of a personal data breach, Quinfy will:

1. Contain the breach and assess its scope and impact within the first 4 hours of detection
2. Notify the Data Protection Board of India (and any other applicable supervisory authority) within 72 hours of becoming aware of the breach, where required by law
3. Notify affected Data Principals without undue delay where the breach is likely to result in high risk to their rights and freedoms. The notification will include: the nature of the breach; categories and approximate number of records affected; likely consequences; measures taken or proposed to address the breach; contact details for further information
4. Document all breaches in the Incident Register regardless of whether notification is required
5. Conduct a post-breach review within 14 days and implement corrective actions to prevent recurrence

14. Children's Privacy

Quinfy’s services are not directed at or intended for use by individuals under the age of 18 ("minors"). We do not knowingly collect personal data from minors.

If we become aware that we have inadvertently collected personal data from a minor without verifiable parental or guardian consent, we will:

• Immediately suspend any processing of that data
• Notify the parent or guardian where contact information is available
• Securely delete the data unless legal obligations require otherwise

If you believe Quinfy has collected data from a minor, please contact grievanceofficer@quinfy.com immediately.

15. Automated Decision-Making & Profiling

Quinfy does not make solely automated decisions that produce legal or similarly significant effects on candidates. All BGV reports involve human review before being delivered to the client organisation.

Where algorithmic tools are used to assist in data matching, fraud detection, or document verification, these tools support (and do not replace) human judgement. A human reviewer is always responsible for the final verification outcome.

16. Payment Data

Quinfy uses PCI-DSS compliant third-party payment processors for all payment transactions. We do not store, process, or transmit raw payment card data on our servers. Payment processors receive only the information necessary to complete the transaction, governed by their own privacy policies and PCI-DSS obligations.

Tokenised payment references may be retained for billing reconciliation purposes for a period of 7 years in compliance with Indian financial regulations.

17. Links to Third-Party Websites

Our websites and platform may contain links to third-party websites, services, or resources not operated by Quinfy. This Privacy Policy does not apply to those third-party sites. We strongly encourage you to review the privacy policy of every site you visit. Quinfy accepts no responsibility for the privacy practices or content of third-party websites.

18. Grievance Officer & Contact Details

Quinfy has appointed a Grievance Officer to handle all privacy-related inquiries, data subject requests, and complaints. If you have any questions about this Privacy Policy, wish to exercise your rights, or wish to raise a concern, please contact:

For BGV report disputes (PBSA BSAAP), candidates may also use the dispute form available within the Quinplus portal under "My Reports → Raise a Dispute".

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. When we make material changes, we will:

• Update the "Effective Date" at the top of this Policy
• Notify registered users via email at least 14 days before the changes take effect
• Post a prominent notice on our websites
• Where the change affects the lawful basis for processing or introduces new categories of processing, seek fresh consent where required

We encourage you to review this Privacy Policy periodically. Your continued use of our services after the effective date of an updated Policy constitutes acknowledgement of the changes, subject always to the requirement for fresh consent where applicable law demands it.

20. Definitions

This Privacy Policy is reviewed annually by Quinfy's Information Security and Legal teams, or earlier in response to significant changes in applicable data protection law, Quinfy's data processing activities, or following any material personal data breach.

© 2026 Quinfy Technology Pvt. Ltd. & Quinfy Inc. | All Rights Reserved.