We at The TIFIN Group LLC (together with its subsidiaries and affiliates and the respective businesses of each, collectively, the “Company Group” and each such company, a “Company”) value the privacy of individuals and companies who use the Company Group’s websites, platforms and services (collectively, “Services”). This privacy policy (this “Privacy Policy”) explains how the Company Group collects, uses and discloses personal information from users of Company Group Services (“you” or “your”). As used herein “personal information” or “Personal Information” means any information relating to an identified or identifiable individual. By using the Services, you agree to the collection, use, disclosure and procedures described in this Privacy Policy. Please note that your use of the Services is also subject to the Company Group Terms of Service (as may be from time to time supplemented or replaced by an individual Company).
The Company Group may collect a variety of Personal Information from or about you or your devices from various sources, as described below.
If you do not provide your Personal Information when requested, you may not be able to use Company Group Services if that information is necessary to provide you with Company Group Services or if the Company Group is legally required to collect it.
Registration and Profile Information: When you create an account to use Company Group Services, a Company may ask you for Personal Information such as your name, address, phone number, email address, DOB, SSN, company name and title.
Use of Our Services: When you use Company Group Services, the Company Group may collect and otherwise process any Personal Information you provide or make available to us via Company Group Services.
Communications: If you contact a Company directly, the Company Group may receive Personal Information about you. For example, when you contact a Company for more information about one of Company Group platforms, it may receive your name, email address, the contents of a message or attachments that you may send to it and other information you choose to provide.
Careers. If you decide that you wish to apply for a job with a Company, you may submit your contact information and your resume online. The Company Group will collect the information you choose to provide on your resume, such as your education and employment experience. You may also apply through a third-party platform, such as LinkedIn. If you do so, the Company Group will collect any information you make available to us via such platforms.
Location Information. When you use Company Group Services, it may infer your general location information, for example, by using your internet protocol (IP) address.
Device Information. The Company Group may receive information about the device and software you use to access Company Group Services, including IP address, web browser type, operating system version, and application installations.
Usage Information. To help us understand how you use Company Group Services and to help us improve them, the Company Group may automatically receive information about your interactions with Company Group Services like the pages or other content you view and the dates and times of your visits.
Information from Cookies and Similar Technologies. The Company Group and its third-party partners may collect Personal Information using cookies, which are small files of letters and numbers that are stored on your browser or the hard drive of your computer. They contain information that is transferred to your computer’s hard drive. The Company Group and its third-party partners may also use pixel tags and web beacons on Company Group Services. These are tiny graphic images placed on web pages or in Company Group emails that allow us to determine whether you have performed a specific action. The Company Group uses cookies, beacons, invisible tags, and similar technologies (collectively “Cookies”) to collect information about your browsing activities and to distinguish you from other users of Company Group Services. This aids your experience when you use Company Group Services and allows us to improve the functionality of Company Group Services. Cookies can be used for performance management (i.e., collecting information on how Company Group Services are being used for analytics purposes). The types of Cookies the Company Group and third parties may use to collect information include: (i) Strictly Necessary Cookies — some Cookies are strictly necessary to make Company Group Services available to you and (ii) Analytical or Performance Cookies — Cookies for website analytics purposes to operate, maintain and improve Company Group Services, either using our own analytics Cookies or those of third-party analytics providers. Please review your web browser’s “Help” file to learn how you may modify your cookie settings. Please note that if you delete or choose not to accept Cookies from Company Group Services, you may not be able to utilize the features of Company Group Services to their fullest potential.
Information We Receive from Third Parties. If you choose to link Company Group Services to a third-party account, the Company Group may receive information about you from such account, including without limitation your profile information, your photo, address, phone number, email address, employment/payment/benefit information, or financial or other information provided to such third-party account including your use of such third-party account.
The Company Group may use the Personal Information it collects as set forth below.
If you are located in the European Economic Area (“EEA”) or the United Kingdom (“UK”), the Company Group only processes your Personal Information when it has a valid “legal basis,” including as set forth below.
The Company Group does not disclose Personal Information it collects from or about you except as described below or otherwise disclosed to you at the time of collection.
You may exercise these rights by contacting us using the contact details at the end of this Privacy Policy. Before fulfilling your request, we may ask you to provide reasonable information to verify your identity. Please note that there are exceptions and limitations to each of these rights, and that while any changes you make will be reflected in active user databases instantly or within a reasonable period of time, the Company Group may retain information for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so.
Regulated Company Addendum
This Addendum is applicable to affiliate Companies that are investment advisors or broker dealers (“Regulated Companies”).
Financial institutions such as banks, broker-dealers, investment advisors and their vendors or services providers (collectively “Firms”), including certain of the Companies, are subject to Regulation S-P, which requires Firms to adopt policies and procedures to protect “nonpublic personal information” about consumers, and to provide customers, no later than the time a customer relationship is established, a clear and conspicuous notice that reflects (i) the policies and procedures adopted by the Firms to protect nonpublic personal information, (ii) the conditions under which nonpublic personal information about consumers will be disclosed to nonaffiliated third parties, and (iii) the methods available to consumers to prevent the sharing of such information with nonaffiliated third parties. Regulation S-P applies only non-public personal information about individuals (i.e. natural persons) who obtain financial products and services primarily for personal, family or household purposes. Regulation S-P does not apply to information about companies or about individuals who obtain financial products or services primarily for business, commercial or agricultural purposes
Regulation S-P requires an initial notice be delivered at the time a customer relationship is established and another notice be delivered annually during the continuation of the customer relationship. “Annually” means at least once in a period of 12 consecutive months.
A Firm must provide a right to “opt out” if the Firm reserves the right to disclose nonpublic personal information about the consumer to unaffiliated third parties, unless (i) the unaffiliated third party is performing servicing or marketing services for the Firm, (ii) the consumer consents to the disclosure or (iii) the disclosure is permitted or required by law.
A “consumer” is defined as an individual who obtains or has obtained a financial product or service from the Firm for personal, family or household purposes. This includes an individual who provides nonpublic personal information to a Firm, even if the individual ultimately does not open an account. An individual who provides only his or her name, address and general areas of investment interest in connection with a request for more information is not a consumer with respect to a Firm.
A “customer” is a consumer who has established a customer relationship with a Firm. A customer relationship is defined in Regulation S-P to mean a continuing relationship between the consumer and a Firm under which the Firm provides financial products and services to the consumer primarily for personal, family or household purposes. A customer relationship is established when a consumer establishes an investment advisory relationship with a Firm.
“Nonpublic personal information” includes nonpublic “personally identifiable financial information”, plus any list, description or grouping of customers that is derived from nonpublic personally identifiable financial information, in each case, in the custody of a Regulated Company.
“Personally identifiable financial information” means any information: (i) the consumer provides to a Firm to obtain financial products or services, (ii) about the consumer resulting from a transaction between the consumer and a Firm, or (iii) that a Firm otherwise obtains from the consumer in connection with providing financial products or services to the consumer. Such information may include information provided on an account application, account balances and transaction information, the fact that the consumer is or has been a customer of a Firm, information relating to services performed for or transactions entered on behalf of customers, and information from consumer reports and any data, list or analyses derived from such nonpublic personal information, in each case, in the custody of a Regulated Company.
Firms that possess consumer report information for business purposes are required to properly safeguard the information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal. “Consumer Report Information” means any record about an individual (e.g., name, social security number, phone number, email address, etc.), whether in paper, electronic or other form, that is a consumer report or is derived from a consumer report. The definition includes a compilation of such records but does not include information that does not identify individuals, such as aggregate information or blind data. “Consumer Report” is defined in the Fair Credit Reporting Act (“FCRA”), but generally means information from a consumer reporting agency bearing on a consumer’s creditworthiness, credit standing, reputation, etc., which is used for the purpose of establishing eligibility for credit, insurance or employment or used for other purposes permitted under the FCRA. A Firm is not required to ensure perfect destruction of consumer report information. Rather, Firms are required to take “reasonable measures” to protect against unauthorized access to or use of the information in connection with its disposal. The SEC has noted that it expects Firms in devising disposal methods to consider the sensitivity of the consumer report information, the nature and size of the entity’s operations, the costs and benefits of different disposal methods and relevant technological changes. The SEC also notes that “reasonable measures” are very likely to require elements such as the establishment of policies and procedures governing disposal, as well as appropriate employee training.
Finally, Regulation S-P requires written policies and procedures addressing administrative, technical and physical safeguards for the protection of customer records and information.
Regulated Companies do not share any nonpublic personal information with any nonaffiliated third parties, except in the following circumstances:
Regulated Company employees (“Employees”) are prohibited, either during or after termination of their employment, from disclosing nonpublic personal information to any person or entity outside the Company Group, except under the circumstances described above. Employees are permitted to disclose nonpublic personal information only to other Employees who need to have access to such information to deliver Company Group services to the client or authorized user.
Security of Information
The Company Group restricts access to nonpublic personal information to Employees who need to know such information to provide services to clients and/or authorized users. Any Employee who is authorized to have access to nonpublic personal information is required to keep such information in a secure, locked compartment on a daily basis as of the close of business each day. All electronic or computer files containing such information must be password secured and firewall protected from access by unauthorized persons. Any conversations involving nonpublic personal information, if appropriate at all, must be conducted by Employees in private and care must be taken to avoid any unauthorized persons overhearing or intercepting such conversations.
Delivery Requirements
A Company will provide each customer with an initial notice of the Company Group’s privacy policy (as may from time to time be supplemented or replaced by such Company) at the time an account is established. If, at any time, the Company adopts material changes to its privacy policy, the Company shall promptly provide each customer with a revised notice reflecting the new privacy policies.
Disposal of Nonpublic Personal Information
The Regulated Companies will shred, deliver to a document destruction firm, or otherwise render illegible hard copies of any customer or consumer nonpublic personal information in its possession when such Regulated Companies deem possession of the information to no longer be necessary.
Nonpublic personal information stored on disk, CD, tape, or other electronic media shall be cleared, purged, declassified, overwritten and/or encrypted in such a manner so that any information contained therein cannot be restored or decrypted. After the electronic media is cleared, purged, declassified, overwritten, or encrypted, the Chief Compliance Officer shall check that the original information is not backed-up or saved on a hard drive, recycle bin, or other memories.
The Chief Compliance Officer shall require that each third-party service provider engaged by the Regulated Companies that necessarily obtains access to customers’ nonpublic personal information during the course of their services on behalf of the Firm to adopt comparable policies and procedures relating to the secure disposal of nonpublic personal information.
External Threats
The Chief Compliance Officer has delegated the following responsibilities to the Chief Technology Officer:
Additional Procedures for Massachusetts Residents
For the purposes of the procedures in this subsection, “personal information” includes a Massachusetts resident’s first and last name and any of the following a) social security number; b) driver’s license number; or c) financial account number (e.g. bank, credit card, etc.). To the extent that a client or authorized user is a Massachusetts resident, the Regulated Companies will implement the following procedures:
Any personal information maintained or stored on a mobile device (e.g. laptop or smartphone) will be stored in an encrypted format;
To the extent technically feasible, any personal information transmitted wirelessly or across a public network will be transmitted in an encrypted format; and
The Company Group will take reasonable steps to ensure that its service providers who have access to the personal information of the Company Group’s clients and/or authorized users will implement and maintain appropriate security measures for the information.
* * *
—Updated as of May 3rd, 2024