Privacy Notice

VINCIT QSV · Last updated 12 June 2026

Who we are

VINCIT QSV (60 Regent Street, Richmond VIC 3121, Australia) provides a stewardship and governance analysis platform to listed companies and their advisers. For data our clients load into the platform (their company information and director details) we act as a processoron the client’s instructions; for platform account data we act as the controller. Contact: maxwell.k.purcell@gmail.com.

What we process, and why

• Platform accounts — names and email addresses of authorised users, authentication events, and task assignments. Basis: performance of contract.
• Director governance data— names, role, gender, tenure, attendance, committee memberships and external positions of client-company directors, sourced from public corporate disclosures and client input, processed solely to analyse the client’s governance profile against published investor expectations. Basis: client instruction; underlying basis legitimate interest in corporate-governance analysis of public-role information. No special categories of personal data are processed.
• Investor policy corpus — verbatim extracts of publicly published institutional voting policies. This is institutional, not personal, data.

Where data lives

The primary database is hosted in Australia (AWS Sydney, ap-southeast-2). Limited data transits US-based sub-processors under Standard Contractual Clauses: Vercel (hosting), Clerk (sign-in), Resend (notification email) and — only when AI features are enabled — Anthropic (document analysis; contractually barred from training models on customer content). Supabase (database) operates under an executed Data Processing Addendum. A current sub-processor list is available on request.

Retention & deletion

Client data is retained for the life of the engagement and deleted within 90 days of offboarding (or within 30 days of a deletion request). Uploaded documents are processed transiently and not retained as files. Operational logs follow our providers’ standard short retention windows.

Your rights

Where GDPR or comparable law applies, data subjects may request access, rectification, erasure, restriction, or portability, and may object to processing. Requests to the contact above are answered within one month. Individuals whose data is processed on a client’s instruction may also contact that client (the controller) directly. You may lodge a complaint with your supervisory authority; in Australia, the OAIC.

Security

Data is encrypted in transit and at rest; database access is deny-by-default with server-enforced tenant isolation; access to client workspaces is restricted to verified members of the client’s organisation. Details of our security programme are available under NDA for client due diligence.