Regional privacy

Effective date: 9 November 2026. Last updated: 9 November 2026.

1. How to use these notices

1.1 Relationship with the Privacy Policy

These notices supplement our Privacy Policy, and refer to its numbered sections. The notice for the place where you live adds what your local law requires. Where it differs from the Privacy Policy, the notice prevails for residents of that jurisdiction, to the extent of the difference. Capitalised terms have the meaning given in the Terms of Service or the Privacy Policy; terms defined by a particular law, such as "controller" or "business", have the meaning given by that law.

1.2 Which SwiftSafe company is responsible

As section 1.2 of the Privacy Policy explains, SwiftSafe LLC, our United States office, a Wyoming limited liability company, is responsible where you, or the Customer whose account you use, are based in the Americas (the United States, Canada, Mexico, Central and South America, and the Caribbean). SwiftSafe Cybersecurity Technologies India Pvt Ltd, our headquarters in India ("SwiftSafe India"), is responsible everywhere else, including India. For a Customer's account, billing and contract data, it is the company named in the Order Form. In each notice below, "we" means the responsible company. The privacy team at privacy@prava.dev and the Grievance Officer at grievance@prava.dev act for both.

1.3 When the Customer is responsible instead

For Customer Data, such as Telemetry, email content, forensic evidence and threat-intelligence results about a Customer, the Customer is generally the controller (or local equivalent) and we act as its processor (Privacy Policy, section 1.3). The Customer must give its employees, contractors and end users notice of monitoring and obtain any consent local law requires. The legal grounds below apply to data we control. Your rights and complaint routes apply in both cases, but we will pass requests about Customer Data to the Customer and help it respond.

1.4 Common commitments

• In-region processing. We store and process your data only in data centres in your own region: the Customer's region set at onboarding or in the Order Form, or an individual's home region. Data leaves the region only in the cases in section 9.2 of the Privacy Policy, chiefly limited, logged, time-bound support access under transfer safeguards. Only non-personal security artefacts (indicators of compromise, hashes, signatures and malicious infrastructure, stripped of Personal Data and Customer Confidential Information) and anonymised, aggregated model parameters are used across regions. Locations and sub-processors: [Sub-processor list].
• No sale. We do not sell Personal Data or share it for cross-context behavioural advertising.
• Certifications. SwiftSafe holds no formal security or privacy certification or attestation. Our controls are designed to align with recognised frameworks, as our Compliance page explains, and we will publish any certification there when it is issued.
• No waiver. Nothing in these notices, the Terms or an Order Form removes a right your local law gives you.

We will update these notices as laws change, as described in section 17 of the Privacy Policy. Other documents are in the Legal centre.

2. India

This notice is given under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), which come into force in phases. We describe our commitments as they apply once in force, and apply them now wherever practicable.

2.1 Who is responsible

SwiftSafe India is the Data Fiduciary for the data listed in section 1.2 of the Privacy Policy. If you use the Platform through a Customer in the Americas, that account data is handled by SwiftSafe LLC, which processes Personal Data in accordance with the DPDP Act where it applies to it. For Customer Data, the Customer is the Data Fiduciary and we are its Data Processor.

2.2 Notice contents

This notice and the Privacy Policy together form our notice under section 5 of the DPDP Act and the DPDP Rules:

• Personal Data processed: itemised in section 3 of the Privacy Policy.
• Specified purposes and grounds: listed purpose by purpose in section 4.1 of the Privacy Policy.
• Services enabled: the Prava AI Platform, Modules, Agents and our support and professional services (Module Terms).
• Withdrawing consent: through Platform settings, the unsubscribe link in our emails or privacy@prava.dev, as easily as you gave it (Privacy Policy, section 4.2).
• Exercising rights and grievances: sections 2.4 to 2.6 below.
• Complaining to the Data Protection Board of India: section 2.8 below.

You may ask for this notice in English or any Eighth Schedule language at privacy@prava.dev.

2.3 Grounds for processing

We process Personal Data with your consent under section 6 or for a legitimate use under section 7, as set out in section 4.1 of the Privacy Policy. By accepting the Terms, creating an account, installing an Agent or using the Services, you agree to real-time processing of Customer Data and Telemetry, usage analytics, and the use of Service Data to operate, secure, improve and develop Prava AI, including training, fine-tuning and evaluating its models with de-identified, pseudonymised or aggregated data where reasonably possible. That consent is limited to the data needed for those purposes. Withdrawing it does not affect earlier processing, but features that depend on it may stop working.

2.4 Your rights and consent managers

You have the rights in section 13.1 of the Privacy Policy: access to a summary of your data, our processing and the Data Fiduciaries and Data Processors we have shared it with (section 11); correction, completion, updating and erasure (section 12); grievance redressal (section 13); nomination (section 14); and withdrawal of consent (section 6(4)). Write to privacy@prava.dev or use Platform settings. You may also give, review and withdraw consent through a consent manager registered with the Board. Once registered consent managers operate and we can connect to them, we will accept consents and withdrawals made through the one you choose and name them in section 15 of the Privacy Policy. Using one is optional.

2.5 Grievance redressal within 90 days

Our Grievance Officer, at grievance@prava.dev, handles grievances about our processing and about how we handled a rights request. We acknowledge promptly and resolve each grievance within 90 days of receipt, sooner where we can, and tell you how to approach the Board if you are not satisfied. Grievances about Customer Data are passed to the Customer, which must resolve them in the same period with our help.

2.6 Nominee

You may nominate one or more individuals to exercise your rights if you die or become incapable through unsoundness of mind or infirmity of body. Write to grievance@prava.dev from your account email with the nominee's name, contact details and relationship to you; we confirm in writing. Before acting for a nominee, we ask for proof of identity and of the event.

2.7 Children and persons with disabilities

A child is a person under 18. Our Services are not intended for children (Privacy Policy, section 7). If we ever process a child's data as Data Fiduciary, we will first obtain verifiable consent from a parent or lawful guardian, checking that they are an identifiable adult by a method the DPDP Rules allow. For a person with a disability who has a lawful guardian, we obtain the guardian's consent and verify their appointment by a court, designated authority or local level committee. We do not track, monitor or target advertising at children. Where a Customer such as a school uses Prava AI on devices used by children, it must obtain verifiable parental consent or rely on an exemption in the DPDP Rules, within that exemption's limits, and tell us in writing first. We never use identifiable children's data for model training.

2.8 Representative, regulator and complaints

No representative is needed: SwiftSafe India is established in India. The regulator is the Data Protection Board of India. Under section 13(3) you must first use our grievance process. If unresolved, or not resolved within 90 days, you may complain to the Board through its digital platform. Board orders may be appealed to the Telecom Disputes Settlement and Appellate Tribunal. Section 15 requires you not to make false or frivolous complaints.

2.9 International transfers

Data of Customers and individuals whose region is India is stored and processed in India. It leaves India only in the cases in section 9.2 of the Privacy Policy, never to a country restricted under section 16 of the DPDP Act, and subject to any DPDP Rules conditions and sectoral localisation rules a Customer tells us apply, such as Reserve Bank of India payment data directions.

2.10 Breach notification

For data we control, we inform the Board without delay, send a detailed report within 72 hours (or any longer period the Board allows) and inform affected Data Principals without delay (Privacy Policy, section 12.1). We report incidents covered by the CERT-In Directions of 28 April 2022 to CERT-In within 6 hours.

2.11 Specific disclosures

• Inactivity erasure: we give at least 48 hours' notice before erasure where the DPDP Rules require.
• Information Technology Act: until replaced, we also follow section 43A of the Information Technology Act, 2000 and the 2011 Rules.

3. European Union and European Economic Area

This notice gives, with the Privacy Policy, the information required by Articles 13 and 14 of the General Data Protection Regulation ("GDPR") for individuals in the EU, Iceland, Liechtenstein and Norway.

3.1 Who is responsible

The controller is SwiftSafe India, or SwiftSafe LLC for account data of a Customer in the Americas. Neither has an EU or EEA establishment; the GDPR applies under Article 3(2). Contact: privacy@prava.dev, which reaches our data protection officer function. For Customer Data, the Customer is controller and we are processor under the Data Processing Addendum.

3.2 Legal bases

This expands section 4.3 of the Privacy Policy.

• Account and Services: contract, Article 6(1)(b), where you are the contracting party; for Authorised Users of a Customer, legitimate interests, Article 6(1)(f), in providing what the Customer ordered.
• Billing, tax and accounting: contract and legal obligation, Article 6(1)(b) and (c).
• Usage analytics: legitimate interests in understanding use, fixing faults and improving features.
• Model training, fine-tuning and evaluation: legitimate interests in improving the accuracy and safety of Prava AI and in collective defence. We have balanced these against your interests and apply the safeguards in section 6 of the Privacy Policy and the AI and Data Use Policy: de-identification, pseudonymisation or aggregation where reasonably possible, in-region training, controls against reproduction of Personal Data, and no disclosure of identifiable data to other customers. Acceptance of the Terms is not relied on as GDPR consent for this; you may object (section 3.3).
• Security of our systems and fraud prevention: legitimate interests and, where required, legal obligation.
• Enquiries: pre-contractual steps or legitimate interests.
• Marketing: consent, Article 6(1)(a), where national ePrivacy rules require it; otherwise legitimate interests, with an opt-out in every message.
• Recruiting: pre-contractual steps and legitimate interests; criminal records only where authorised by Union or Member State law (Article 10).
• Threat intelligence source material: to the extent we decide how open, deep and dark-web material is collected and screened before it is matched to a Customer, legitimate interests in protecting Customers and the public from cybercrime, with minimisation and redaction or hashing of credentials (Privacy Policy, section 3.6), and criminal-offence data only as Article 10 permits.
• Legal claims and regulatory requests: legal obligation and legitimate interests; Article 9(2)(f) for special category data.

3.3 Your rights

You have the rights in section 13.2 of the Privacy Policy: access, rectification, erasure, restriction, portability and withdrawal of consent. In particular:

• Objection to legitimate interests (Article 21(1)). You may object at any time, on grounds relating to your situation, including to analytics, model training and profiling. We stop unless we show compelling legitimate grounds that override your interests or need the data for legal claims. If you object to model training, we exclude your data from future training datasets; what is already incorporated into model weights in de-identified or aggregated form cannot be extracted (Privacy Policy, section 10).
• Objection to direct marketing. Absolute; we stop on request.
• Automated decisions and autonomous containment (Article 22). You have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you, unless an exception applies. Autonomous containment (Privacy Policy, section 5.2) is configured by the Customer as controller. Its actions, such as isolating a device or quarantining an email, are protective, logged and reversible, and we do not consider them on their own to be such decisions, but each Customer must assess its own use and must not base employment or disciplinary decisions solely on Outputs or risk scores. Where Article 22 applies, you may obtain human intervention, express your view and contest the decision, through the Customer's security team or through privacy@prava.dev, which we pass on. We make no Article 22 decisions in processing we control.
• Timing. We respond within one month, extendable by two months for complex requests, telling you within the first month.

3.4 Sources (Article 14)

Data not collected from you comes from the sources in section 3.7 of the Privacy Policy,. Where notifying people named in threat-intelligence material individually would be impossible, need disproportionate effort or seriously impair the purpose of fighting cybercrime, we rely on Article 14(5)(b) and publish this notice instead.

3.5 International transfers

Data of Customers and individuals whose region is the EU or EEA is stored and processed there. It leaves only in the cases in section 9.2 of the Privacy Policy, mainly time-bound, logged remote support from India or the United States, with data viewed in place where possible. Those transfers use the European Commission's Standard Contractual Clauses, including in our intra-group agreement, with transfer risk assessments and supplementary measures such as encryption and access logging. You may request a copy of the safeguards at privacy@prava.dev.

3.6 Breach notification

As controller, we notify the competent supervisory authority without undue delay and where feasible within 72 hours, unless the breach is unlikely to result in a risk, and tell you without undue delay where there is a high risk (Articles 33 and 34). As processor, we notify the Customer without undue delay under the Data Processing Addendum.

3.7 Representative, regulator and complaints

• EU representative (Article 27): [EU representative under Article 27]. You and supervisory authorities may contact the representative on any issue relating to our processing.
• No lead supervisory authority. Because we have no EU establishment, the one-stop-shop mechanism does not apply and each supervisory authority is competent for processing affecting people in its Member State.
• Right to complain (Article 77). You may complain to any supervisory authority, in particular in the Member State where you live, work or where the alleged infringement occurred. You need not contact us first, and you may also seek a judicial remedy.

3.8 Specific disclosures

• Retention and recipients: sections 10 and 8 of the Privacy Policy.
• Cookies: the website sets none; the Platform uses only necessary storage (Cookie Policy). We will ask for consent before using any non-essential technology.

4. United Kingdom

This notice is given under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Section 3 applies to UK residents, reading "GDPR" as "UK GDPR", with these changes.

4.1 Who is responsible and legal bases

The controller is SwiftSafe India, or SwiftSafe LLC for account data of a Customer in the Americas; neither has a UK establishment. We rely on the bases in section 3.2, and may rely on recognised legitimate interests, such as crime prevention, for disclosures to authorities. Criminal offence data is processed only under a condition in Schedule 1 to the Data Protection Act 2018.

4.2 Your rights

• The rights in section 3.3, responded to within one month, extendable by two months, with time running from receipt of any verification we need.
• Automated decisions: significant decisions based solely on automated processing carry safeguards: you are told, can make representations, obtain human intervention and contest the decision, with stricter limits for special category data.
• Complaints to us: write to privacy@prava.dev or grievance@prava.dev. We acknowledge within 30 days and respond without undue delay.

4.3 International transfers

Data is held in the region set for you. Any transfer outside the UK, including support access from India or the United States, relies on UK adequacy regulations or the International Data Transfer Agreement or UK Addendum, with a transfer risk assessment.

4.4 Breach notification

As controller, we report notifiable breaches to the ICO without undue delay and where feasible within 72 hours, and tell you without undue delay where there is a high risk.

4.5 Representative, regulator and complaints

• UK representative (Article 27 UK GDPR): [UK representative under Article 27 UK GDPR].
• Regulator: the Information Commissioner's Office (ICO). The ICO generally expects you to complain to us first, but you may contact it directly, and you may seek a court remedy.

5. Switzerland

This notice is given under the revised Federal Act on Data Protection ("FADP") and the Data Protection Ordinance.

5.1 Who is responsible

The controller is SwiftSafe India, or SwiftSafe LLC for account data of a Customer in the Americas. Neither has a Swiss establishment. For Customer Data, the Customer is controller.

5.2 Grounds for processing

The FADP does not require a legal basis for each activity, but processing must follow its principles of lawfulness, good faith, proportionality, purpose limitation and transparency. Where processing would otherwise unlawfully infringe your personality, we rely on a justification under Article 31: consent, an overriding private or public interest, or law. Our purposes and interests are those in section 3.2.

5.3 Your rights

• Access (Article 25), including purpose, retention, origin and recipients, within 30 days and normally free.
• Portability (Article 28), and rectification, erasure and objection, including to disclosure to third parties.
• Automated individual decisions (Article 21): if a decision based exclusively on automated processing has legal consequences for you or significantly affects you, you must be told and may state your position and ask for review by a person. The Customer gives this information for autonomous containment, as in section 3.3.

5.4 International transfers

Data is held in the region set at onboarding or in the Order Form. Where that is in the EEA, the countries are recognised as adequate in Annex 1 to the Data Protection Ordinance. Support access from India or the United States uses the Standard Contractual Clauses adapted for Swiss law.

5.5 Breach notification

We report breaches likely to lead to a high risk to the FDPIC as soon as possible, and inform you where needed for your protection or the FDPIC requests it (Article 24).

5.6 Representative, regulator and complaints

• Swiss representative (Article 14): required for a foreign controller that processes Swiss residents' data on a large scale, regularly and with high risk. Where this applies: [Swiss representative under Article 14 FADP, if required].
• Regulator: the Federal Data Protection and Information Commissioner (FDPIC). You may also bring civil claims in the Swiss courts.

5.7 Specific disclosures

Sensitive personal data under the FADP includes data on criminal and administrative proceedings, which forensic evidence and threat intelligence can contain. We process it only for the relevant engagement or alert.

6. United States

6.1 General

Who is responsible. For US residents, generally SwiftSafe LLC, our United States office, as a "business" or "controller" for the data in section 1.2 of the Privacy Policy and a "service provider" or "processor" for Customer Data. Where your data is held for a Customer outside the Americas, SwiftSafe India is responsible and the same rights apply.

In-region processing. Data whose region is the United States is stored and processed there, leaving only as section 9.2 of the Privacy Policy allows.

Breach notification. Where we control data affected by a breach that triggers state breach notification laws, we notify affected residents, and state attorneys general or agencies where required, in the most expedient time possible and within any fixed state deadline. As a service provider, we notify the Customer.

6.2 California: scope and notice at collection

This part is our notice under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations ("CCPA"), expanding section 13.3 of the Privacy Policy. It covers job applicants and business contacts, whose data has been fully within the CCPA since 1 January 2023. It is also our notice at collection, linked where we collect personal information, including our forms and careers pages.

6.3 California: categories collected in the last 12 months

• Identifiers: name, work email, username, IP address, device identifiers.
• Customer records (Civil Code section 1798.80(e)): name, address, phone, employment and education history, billing details.
• Commercial information: plans, invoices, payment history.
• Internet or network activity: server, security and audit logs; sign-in events; product usage analytics.
• Geolocation: approximate location from IP address only.
• Audio, electronic or visual information: screenshots and files shared with support; call recordings only where you are told.
• Professional or employment information, including applicant CVs, interview notes and references.
• Education information applicants give us.
• Inferences: security risk scores.
• Sensitive personal information: account log-in credentials and, for applicants, identifiers needed for right-to-work checks.

As a service provider we also process Customer Data, which may contain other categories, such as email content, under the Customer's notice.

6.4 California: sources, purposes and disclosures

• Sources: you; your browser, device and Platform use; your organisation; single sign-on, integration and payment providers; public and threat-intelligence sources; event partners and resellers; recruiters and referees (Privacy Policy, sections 3.1, 3.2 and 3.7).
• Purposes: providing and supporting the Services, real-time security processing, billing, security and debugging, analytics and improving the Services including model training with de-identified, pseudonymised or aggregated data where reasonably possible, enquiries, business marketing, events, recruiting and legal compliance (Privacy Policy, section 4).
• Disclosures for a business purpose: each category above, to service providers and contractors (hosting, email, payment, support and analytics), to SwiftSafe India as our affiliate, to professional advisers, and to authorities where law requires (Privacy Policy, section 8). Customer workspace administrators see their Authorised Users' identifiers and activity.

6.5 California: no sale or sharing; sensitive personal information

We do not sell personal information or share it for cross-context behavioural advertising, have not done so in the last 12 months, and have no actual knowledge of doing so for consumers under 16. Improving our own models with de-identified or aggregated data is neither. We keep de-identified data de-identified, do not try to re-identify it, and require recipients to do the same. We use sensitive personal information only for the purposes permitted by section 7027(m) of the CCPA regulations, such as providing the Services and security, and not to infer characteristics about you, so the right to limit does not change our processing; you may still ask and we will confirm.

6.6 California: retention

We keep each category for the periods in section 10 of the Privacy Policy, for example account data for the life of the account and up to 90 days after, enquiries for 24 months from last contact, support records for 3 years and applicant data for 12 months after the process ends.

6.7 California: your rights

• Know and access: the categories and specific pieces of personal information, sources, purposes and recipient categories.
• Delete personal information we collected from you, subject to CCPA exceptions such as security and legal obligations.
• Correct inaccurate personal information.
• Opt out of sale or sharing and limit sensitive personal information, as described in section 6.5.
• Non-discrimination: we will not deny service, change price or quality, or retaliate against an employee, applicant or contractor for exercising rights.

Requests. Write to privacy@prava.dev. We confirm receipt within 10 business days and respond within 45 days, extendable by 45 days. We verify by matching information we hold, usually control of your account email, with stricter checks for specific pieces of information. Authorised agents must provide your signed permission or a power of attorney, and we may ask you to verify your identity and confirm the permission directly. Requests about Customer Data are referred to the Customer, with our help.

6.8 California: Global Privacy Control

We treat a Global Privacy Control signal as a valid opt-out of sale and sharing for that browser and, if you are signed in, your account. As we neither sell nor share, it does not change our processing, but we record and honour it. The website sets no cookies and loads no third-party advertising or analytics scripts (Cookie Policy).

6.9 California: B2B and employee data

• Business contacts and Authorised Users have the rights above for data about them in their professional capacity. The Customer's administrators can see workspace data and may also handle requests.
• Applicants: this is your notice at collection. California employees of SwiftSafe LLC receive a separate personnel notice.
• Customers' employees: where your employer monitors you with Prava AI, it is the business responsible for your notice at collection and requests; we are its service provider.

6.10 California: other disclosures

We do not use automated decision-making technology to make significant decisions about consumers, such as on employment, credit, housing or essential services, for our own purposes. We will meet the CCPA regulations on automated decision-making technology, risk assessments and cybersecurity audits where they apply. We do not disclose personal information to third parties for their direct marketing ("Shine the Light").

6.11 Other states

Consumer privacy laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states mostly exclude data about people acting in a commercial or employment context, so they mainly cover website visitors acting personally. Where they apply:

• you may confirm, access, correct, delete and obtain a portable copy of your personal data, and opt out of targeted advertising, sale and profiling with legal or similarly significant effects, none of which we do;
• we process sensitive data only with consent where these laws require it;
• we honour universal opt-out signals such as Global Privacy Control where required;
• we respond within 45 days, extendable once by 45 days. If we decline, you may appeal by writing to privacy@prava.dev with "Appeal" in the subject. We decide appeals within your state's deadline, and you may then contact your state attorney general; and
• we do not sell covered information under Nevada law.

6.12 HIPAA

SwiftSafe is not a HIPAA covered entity and holds no HIPAA attestation or certification. A Customer that is a covered entity or business associate must tell us before using Prava AI with systems holding protected health information, and a business associate agreement must be signed first; we then process that information only as a business associate under it. The compliance Module maps controls to the HIPAA Security Rule and supports Customers' own compliance, but does not make them compliant (Module Terms, section 11).

7. Canada

This notice is given under the Personal Information Protection and Electronic Documents Act ("PIPEDA") and, where they apply, the private-sector laws of Alberta, British Columbia and Quebec, including Quebec's Law 25.

7.1 Who is responsible

Generally SwiftSafe LLC, as Canada is in the Americas; SwiftSafe India where your data is held for a Customer outside the Americas. For Customer Data, the Customer is responsible.

7.2 Grounds for processing

We collect, use and disclose personal information with your knowledge and consent, except where law permits otherwise. We obtain express consent for marketing under Canada's Anti-Spam Legislation and for sensitive information we handle for our own purposes. Consent may be implied for expected purposes such as providing the Services and real-time security processing. We use de-identified data to improve our models under the safeguards in section 6 of the Privacy Policy. You may withdraw consent on reasonable notice, and we will explain the consequences.

7.3 Your rights

You may access your personal information and challenge its accuracy and completeness; we respond within 30 days, extendable where the law allows. Quebec residents may also be informed of any technology used to identify, locate or profile them (switched off by default in our own processing), request de-indexation where the law allows, and receive computerised information they provided in a structured, commonly used format.

7.4 Automated decisions (Quebec)

If we make a decision about a Quebec resident based exclusively on automated processing, we will tell you no later than when we inform you of the decision and, on request, tell you the personal information used, the reasons and principal factors and parameters, and your right to correct the information, and let you submit observations to a staff member who can review the decision. We make no such decisions in our own processing. Where a Customer uses autonomous containment or risk scoring to decide about its workers or users, the Customer gives this information, with our help.

7.5 Person in charge of the protection of personal information

Our person in charge of the protection of personal information under Quebec law, who is also accountable for PIPEDA compliance, can be reached at privacy@prava.dev.

7.6 International transfers and privacy impact assessments

Data is held in the region set at onboarding or in the Order Form. Where personal information is held or accessed outside your province or Canada, including support access from the United States or India, it may be accessible to authorities there. Before communicating a Quebec resident's personal information outside Quebec, we carry out a privacy impact assessment covering its sensitivity, purpose, protection measures and the destination's legal framework, transfer only if it will be adequately protected, and put a written agreement in place.

7.7 Breach notification

Where a breach creates a real risk of significant harm, we report it to the OPC and notify affected individuals as soon as feasible, and keep breach records for 24 months. For Quebec, where a confidentiality incident presents a risk of serious injury, we promptly notify the CAI and affected persons and keep an incident register. Alberta also requires notice to its Commissioner.

7.8 Representative, regulator and complaints

No representative is required. Please raise concerns with us first at privacy@prava.dev or grievance@prava.dev. You may complain to the Office of the Privacy Commissioner of Canada (OPC), the Commission d'accès à l'information du Québec (CAI), or the Information and Privacy Commissioner of Alberta or British Columbia.

7.9 Specific disclosures

Quebec residents may request this notice in French.

8. Australia

This notice is given under the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"), to the extent they apply to us.

8.1 Who is responsible

SwiftSafe India, or SwiftSafe LLC for account data of a Customer in the Americas. For Customer Data, the Customer is responsible.

8.2 Grounds for processing

We collect personal information only where reasonably necessary for our functions, lawfully and fairly, and directly from you where practicable (APP 3), and sensitive information only with consent or as the APPs permit. We use and disclose it for the purposes in section 4 of the Privacy Policy, related purposes you would expect, or as the APPs permit (APP 6). You may deal with us anonymously or by pseudonym for general enquiries, but not for an account (APP 2).

8.3 Your rights

• Access and correction (APPs 12 and 13), within 30 days, with written reasons for any refusal.
• Direct marketing: opt out at any time and ask for the source of your information (APP 7); we comply with the Spam Act 2003.
• Automated decisions: from 10 December 2026, where a computer program substantially makes a decision that could significantly affect your rights or interests, we will describe the kinds of information used and decisions made. We make no such decisions for our own purposes; Customers using autonomous containment that way are responsible for this disclosure.

8.4 Cross-border disclosure (APP 8)

Data is held in the region set at onboarding or in the Order Form. Overseas disclosure happens only as section 9.2 of the Privacy Policy allows; recipients are likely to be in India and the United States, for limited, logged support. We take reasonable steps, through our intra-group agreement and provider contracts, to ensure recipients comply with the APPs, and we remain accountable for their handling.

8.5 Breach notification (NDB scheme)

We assess suspected eligible data breaches promptly and within 30 days. Where unauthorised access, disclosure or loss is likely to result in serious harm that remedial action has not prevented, we notify the OAIC and affected individuals as soon as practicable, coordinating with the Customer where we hold data for it.

8.6 Representative, regulator and complaints

No representative is required. Complain to us first at grievance@prava.dev; we aim to respond within 30 days. You may then complain to the Office of the Australian Information Commissioner (OAIC). The statutory tort for serious invasions of privacy may also apply.

9. New Zealand

This notice is given under the Privacy Act 2020 and its Information Privacy Principles ("IPPs").

9.1 Who is responsible

SwiftSafe India, or SwiftSafe LLC for account data of a Customer in the Americas; the Act applies to overseas agencies carrying on business in New Zealand. For Customer Data, the Customer is responsible.

9.2 Grounds for processing

We collect personal information only for lawful purposes connected with our functions and where necessary (IPP 1), as in section 4 of the Privacy Policy. Where we collect it from others, such as your employer or threat-intelligence sources, we take reasonable steps to make you aware, as IPP 3A requires, unless an exception applies; this notice is one of those steps.

9.3 Your rights

You may request access (IPP 6) and correction (IPP 7). We respond within 20 working days. If we do not correct, you may ask us to attach a statement of the correction sought.

9.4 International transfers

Data is held in the region set for you. We disclose it outside New Zealand only as section 9.2 of the Privacy Policy allows and where IPP 12 permits, for example under comparable contractual safeguards. Providers that only store or process data for us are not disclosures, and we remain responsible for them.

9.5 Breach notification

We notify the Privacy Commissioner and affected individuals as soon as practicable after becoming aware of a privacy breach that has caused or is likely to cause serious harm.

9.6 Representative, regulator and complaints

No representative is required. Contact us first; you may then complain to the Office of the Privacy Commissioner.

10. Japan

This notice is given under the Act on the Protection of Personal Information ("APPI").

10.1 Who is responsible

The business operator is SwiftSafe India, or SwiftSafe LLC for account data of a Customer in the Americas. For Customer Data, the Customer is the business operator and has entrusted handling to us; this is not provision to a third party.

10.2 Purpose of use

We use personal information only for the purposes in section 4 of the Privacy Policy: providing the Services and accounts, real-time security processing, billing, security, analytics and improving the Services including model training with pseudonymised, anonymised or aggregated data where reasonably possible, enquiries, marketing, events and recruiting. We will not go beyond them without consent unless the APPI permits. Where we create pseudonymously or anonymously processed information, we follow the APPI rules on its creation, security and publication.

10.3 Third-party provision

We do not provide personal data to third parties without prior consent, except as the APPI permits, such as by law, entrustment to service providers or business succession, and we keep the required records.

10.4 Foreign transfers

Data is held in the region set for you. Support access under section 9.2 of the Privacy Policy may involve SwiftSafe India in India or SwiftSafe LLC in the United States. Through our intra-group agreement and provider contracts, we require recipients to take measures equivalent to the APPI, and monitor them. On request, we provide details of those measures, of how we check them and of the destination countries' systems.

10.5 Your rights

You may request disclosure of retained personal data (including electronically) and of third-party provision records; correction, addition or deletion of untrue content; cessation of use or erasure where data is used outside its purpose, obtained improperly, no longer needed, involved in a reportable breach or otherwise harms your rights; and cessation of third-party provision. Write to privacy@prava.dev. We may charge a reasonable disclosure fee, notified in advance. Security control measures are described in section 11 of the Privacy Policy, and more detail is available on request.

10.6 Breach notification

For reportable incidents, such as those involving sensitive personal information, possible financial loss, a possible unlawful purpose or more than 1,000 people, we submit a preliminary report to the PPC promptly (normally within three to five days) and a final report within 30 days (60 days for incidents possibly committed for an unlawful purpose), and notify affected individuals.

10.7 Representative, regulator and complaints

No representative is required. Contact us first; the regulator is the Personal Information Protection Commission (PPC), which also runs a consultation service.

11. China (mainland)

This notice is given under the Personal Information Protection Law ("PIPL"), the Cybersecurity Law and the Data Security Law, for individuals in mainland China.

11.1 Availability

We offer the Services to mainland China residents and organisations only where in-country hosting is available, so that their data is stored and processed in mainland China, and only where any approvals, certifications or filings needed for the relevant Modules are in place. Otherwise we do not offer them there.

11.2 Who is responsible

The personal information handler is SwiftSafe India, at privacy@prava.dev. For Customer Data, the Customer is the handler and we process under an entrustment agreement.

11.3 Legal bases and separate consent

We rely on Article 13 PIPL: consent; necessity to conclude or perform a contract with you; human resources management under lawful rules; legal duties; emergencies; and other bases provided by law. We obtain separate consent before processing sensitive personal information, providing your information to another handler, publicly disclosing it, or transferring it outside mainland China. You may withdraw consent at any time without affecting earlier processing, and we will not refuse service for that unless the processing is necessary for the service.

11.4 Sensitive personal information

This includes biometrics, religious beliefs, specific identity, health, financial accounts, location tracking and information of minors under 14. We process it only for a specific purpose, where sufficiently necessary, with strict protection and separate consent, and tell you why it is needed and how it affects you. For minors under 14 we obtain a parent's or guardian's consent. Sensitive information in Customer forensic evidence or Telemetry is the Customer's responsibility as handler.

11.5 Cross-border rules and localisation

Personal information collected or generated in mainland China stays there. We will not transfer it out, or allow remote access from outside mainland China, unless we have told you the recipient's identity and contact details, purpose, method, data types and how to exercise your rights against it; obtained separate consent; completed a personal information protection impact assessment; and used a lawful mechanism: a CAC security assessment, the filed standard contract, certification, or an exemption under the Provisions on Promoting and Regulating Cross-Border Data Flows. Stricter localisation applies to critical information infrastructure operators and important data. Cross-region use of non-personal security artefacts (section 1.4) is subject to Chinese rules on important data and on security vulnerabilities, and we will not export artefacts where those rules restrict it.

11.6 Your rights

Under Articles 44 to 50 PIPL you may know, decide on, restrict or refuse processing; access and copy your information; request transfer to another handler where conditions are met; correct, supplement and delete it; and ask us to explain our rules. You may ask for an explanation of automated decisions that significantly affect you and refuse decisions made solely by automated means. Close relatives of a deceased person may exercise these rights for their own lawful interests. Write to privacy@prava.dev. If we refuse, we give reasons, and you may sue in a People's Court.

11.7 Breach notification

If personal information is or may be leaked, tampered with or lost, we immediately take remedial measures and notify the competent authorities and affected individuals (Article 57), and report network security incidents within the time limits of the applicable reporting measures.

11.8 Representative, regulator and complaints

• Representative (Article 53): as a handler outside mainland China, SwiftSafe India must establish a dedicated entity or designate a representative there and report it to the authorities: [PIPL representative or dedicated entity under Article 53].
• Regulator: the Cyberspace Administration of China (CAC), with other departments with protection duties, to which you may complain.

12. Singapore

This notice is given under the Personal Data Protection Act 2012 ("PDPA").

12.1 Who is responsible

SwiftSafe India, or SwiftSafe LLC for account data of a Customer in the Americas. For Customer Data, the Customer is responsible and we are its data intermediary, bound by the PDPA's protection, retention and breach-notification duties.

12.2 Grounds for processing

We process personal data with consent, including deemed consent where you volunteer data or do not opt out after notification, or under an exception. We rely on the business improvement exception and, after assessing adverse effects, the legitimate interests exception for analytics and model improvement using de-identified, pseudonymised or aggregated data where reasonably possible. You may withdraw consent on reasonable notice, and we explain the consequences.

12.3 Your rights

You may request access to your data and how it was used or disclosed in the past year, and correction. We respond within 30 days or tell you when we will. We may charge a reasonable access fee, notified in advance. We comply with the Do Not Call provisions.

12.4 International transfers

Data is held in the region set for you. Any transfer outside Singapore under section 9.2 of the Privacy Policy is made only where the recipient is bound, including by our intra-group agreement, to a comparable standard of protection.

12.5 Breach notification

We assess suspected breaches within 30 days. Where a breach causes or is likely to cause significant harm, or affects 500 or more people, we notify the PDPC within 3 calendar days of determining it is notifiable, and affected individuals where there is significant harm. As data intermediary, we notify the Customer without undue delay.

12.6 DPO, regulator and complaints

Our data protection officer can be contacted by email at privacy@prava.dev. The regulator is the Personal Data Protection Commission (PDPC); please contact us first.

12.7 Specific disclosures

Under the Cybersecurity Act 2018, penetration testing and managed security operations centre monitoring services may be provided in Singapore only by licensed providers. We provide them there only where we, or a partner we engage, hold any required licence.

13. South Korea

This notice is given under the Personal Information Protection Act ("PIPA").

13.1 Who is responsible

The controller is SwiftSafe India, or SwiftSafe LLC for account data of a Customer in the Americas. For Customer Data, the Customer is the controller and has outsourced processing to us.

13.2 Grounds for processing

We rely on consent or another basis in Article 15 PIPA, such as contract, legal obligation, or legitimate interests that clearly override your rights within a reasonable scope. We obtain separate consent for sensitive or unique identification information, third-party provision and new purposes. You may withdraw consent at any time.

13.3 Items, retention and outsourcing

Items and purposes are in sections 3 and 4 of the Privacy Policy, and retention in section 10. At the end of retention we destroy electronic files irrecoverably and shred or incinerate paper, unless law requires us to keep them, in which case we store them separately. Outsourced processors are listed in our [Sub-processor list].

13.4 Your rights

You may request access, correction, deletion and suspension of processing, withdraw consent, refuse or seek an explanation of fully automated decisions that significantly affect your rights, and, where in force, request transmission of your information. A legal representative or authorised person may act for you. Write to privacy@prava.dev; we respond within 10 days.

13.5 International transfers

Data is held in the region set for you. Support access under section 9.2 of the Privacy Policy relies on consent or another basis in Article 28-8, such as necessity for a contract with you with disclosure here: items, those needed for the support task; countries, India and the United States; timing and method, when a support request or incident needs it, by encrypted remote access; recipients, SwiftSafe India and SwiftSafe LLC, at privacy@prava.dev; purpose, support and incident response; retention, viewed in place and not kept beyond the task where possible. You may refuse by writing to privacy@prava.dev, which may limit support.

13.6 Breach notification

We notify affected individuals within 72 hours of becoming aware of a leak, and the PIPC or the Korea Internet and Security Agency within 72 hours where it involves 1,000 or more people, sensitive or unique identification information, or unauthorised external access.

13.7 Representative, regulator and complaints

• Privacy officer: privacy@prava.dev.
• Domestic agent: required for controllers without an address in Korea that meet legal thresholds. Where this applies: [Domestic agent under PIPA Article 31-2, if required].
• Regulator: the Personal Information Protection Commission (PIPC). You may also contact the Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee.

14. United Arab Emirates

The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 ("PDPL"), applies outside financial free zones; the Dubai International Financial Centre ("DIFC") has Data Protection Law No. 5 of 2020; Abu Dhabi Global Market ("ADGM") has its Data Protection Regulations 2021.

14.1 Who is responsible

SwiftSafe India, or SwiftSafe LLC for account data of a Customer in the Americas. For Customer Data, the Customer is controller.

14.2 Legal bases

Under the PDPL, consent or an exception such as contract, legal obligation or protection of the data subject's interests, applied as its executive regulations require once in effect. In the DIFC and ADGM, the bases in section 3.2.

14.3 Your rights

Information and access, correction, erasure, restriction, objection and withdrawal of consent under all three regimes; portability and rights about automated decisions in the DIFC and ADGM; and under the PDPL, objection to automated processing with legal or seriously harmful effects. Autonomous containment is treated as in section 3.3. Write to privacy@prava.dev.

14.4 International transfers

Data is held in the region set for you. Transfers under section 9.2 of the Privacy Policy use a mechanism available under the applicable law, such as contracts with appropriate safeguards, including DIFC or ADGM standard clauses where relevant.

14.5 Breach notification

We notify the UAE Data Office promptly, the DIFC Commissioner of Data Protection as soon as practicable and the ADGM Office of Data Protection within 72 hours where required, and affected individuals where the law requires.

14.6 Representative, regulator and complaints

Contact us first. The regulators are the UAE Data Office (federal), the DIFC Commissioner of Data Protection and the ADGM Office of Data Protection.

15. Saudi Arabia

This notice is given under the Personal Data Protection Law ("PDPL"), its Implementing Regulations and its Transfer Regulations.

15.1 Who is responsible

SwiftSafe India, or SwiftSafe LLC for account data of a Customer in the Americas. For Customer Data, the Customer is controller.

15.2 Legal bases

Consent, or performance of an agreement with you, legal obligation, vital interests, or legitimate interests (not for sensitive data) that we have assessed do not prejudice your rights. You may withdraw consent at any time.

15.3 Your rights

To be informed of the legal basis and purpose; to access and obtain a copy in a clear format; to correction, completion and updating; to destruction of data no longer needed; and to withdraw consent. Write to privacy@prava.dev; we respond within 30 days, extendable where the regulations allow.

15.4 International transfers

Data is held in the region set for you. Transfers under section 9.2 of the Privacy Policy rely on a ground in the Transfer Regulations, such as standard contractual clauses, with a risk assessment where required.

15.5 Breach notification

We notify SDAIA within 72 hours of becoming aware of a breach that may harm individuals, and affected individuals without undue delay where it may cause them damage.

15.6 Representative, regulator and complaints

• Representative: where the Implementing Regulations require a controller outside the Kingdom to appoint one: [Representative in the Kingdom under the PDPL Implementing Regulations, if required].
• Regulator: the Saudi Data and AI Authority (SDAIA). Contact us first; you may complain to SDAIA within the period the regulations set.

16. Brazil

This notice is given under the General Personal Data Protection Law, Law No. 13,709 of 2018 ("LGPD").

16.1 Who is responsible

Generally SwiftSafe LLC, as Brazil is in the Americas; SwiftSafe India where your data is held for a Customer outside the Americas. For Customer Data, the Customer is controller and we are its operator.

16.2 Legal bases

• Account and Services: contract or preliminary procedures (Article 7, V).
• Billing and tax: contract and legal obligation (Article 7, II and V).
• Analytics, security, fraud prevention and model improvement: legitimate interests (Article 7, IX), with the safeguards in section 6 of the Privacy Policy and respect for your legitimate expectations.
• Marketing: consent, or legitimate interests for business contacts, with an opt-out.
• Legal claims: regular exercise of rights (Article 7, VI).
• Sensitive data: specific, highlighted consent or an Article 11 basis such as fraud prevention and security.

16.3 Your rights

Under Article 18: confirmation of processing; access; correction; anonymisation, blocking or deletion of unnecessary, excessive or unlawful data; portability; deletion of consent-based data; information on sharing and on refusing consent; withdrawal of consent; and opposition to non-compliant processing. Under Article 20 you may request review of decisions made solely by automated processing that affect your interests, and information on the criteria used; for autonomous containment the Customer handles review with our help. We confirm processing and give access in simplified form immediately, or in full within 15 days.

16.4 International transfers

Data is held in the region set at onboarding or in the Order Form. Transfers outside Brazil, including under section 9.2 of the Privacy Policy, rely on Article 33, such as ANPD-approved standard contractual clauses in our intra-group agreement and provider contracts.

16.5 Breach notification

Where an incident may create relevant risk or damage, we notify the ANPD and affected individuals within 3 working days of learning it affected personal data, and keep incident records for at least five years.

16.6 Encarregado, regulator and complaints

Our encarregado (data protection officer) can be contacted by email at privacy@prava.dev. The regulator is the National Data Protection Authority (ANPD). Please submit requests to us first; if unresolved, you may petition the ANPD or consumer protection bodies.

17. South Africa

This notice is given under the Protection of Personal Information Act, 2013 ("POPIA").

17.1 Who is responsible

The responsible party is SwiftSafe India, or SwiftSafe LLC for account data of a Customer in the Americas; POPIA applies where a foreign responsible party uses means in South Africa. For Customer Data, the Customer is responsible party and we are its operator.

17.2 Grounds for processing

We follow POPIA's eight conditions and rely on a section 11 justification: consent, contract, legal obligation, your legitimate interest, or our legitimate interests or those of a third party receiving the information. Special personal information, including about criminal behaviour, is processed only where POPIA allows. You may withdraw consent or object to legitimate-interest processing at any time.

17.3 Your rights

To be notified of collection; to access, correct, destroy or delete; to object on reasonable grounds and to direct marketing; not to receive unsolicited electronic marketing without consent; not to be subject to solely automated decisions with legal or substantial effects, subject to section 71; to complain to the Information Regulator; and to bring civil proceedings. Write to privacy@prava.dev.

17.4 International transfers

Data is held in the region set for you. Transfers under section 9.2 of the Privacy Policy are made only where section 72 allows, such as under a binding agreement giving adequate protection, including our intra-group agreement.

17.5 Breach notification

Where there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person, we notify the Information Regulator and affected individuals as soon as reasonably possible, in the manner the Regulator prescribes, unless law enforcement says it would impede an investigation.

17.6 Information officer, regulator and complaints

Our information officer can be contacted by email at privacy@prava.dev. The regulator is the Information Regulator; please contact us first.

18. Other countries

If you live elsewhere, the Privacy Policy applies in full. SwiftSafe India is responsible unless you or your Customer are in the Americas, when SwiftSafe LLC is. Your data is stored and processed in your own region (Privacy Policy, section 9). We honour the rights your local law gives you, such as access, correction, deletion, objection and complaint to your data protection authority, even if not described here, and we meet local requirements to appoint a representative, register, notify breaches or give further information. Contact privacy@prava.dev or grievance@prava.dev.