Privacy Policy

URVALON International Holdings Ltd. (“URVALON”, “we”, “us” or “our”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share and safeguard personal data when you visit urvalon.com (the “Site”), contact us, or receive investor communications from us.

We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”), the Maltese Data Protection Act (Cap. 586), and applicable implementing legislation.

The data controller responsible for the processing of your personal data is:

We may collect and process the following categories of personal data:

• Identification & contact data — name, professional title, company, country, email address and phone number, where you submit them through the investor contact form or by emailing us.
• Investor information — investor classification, ticket size, areas of interest and any context you voluntarily provide in connection with an investment inquiry.
• Technical & log data — IP address, device and browser type, operating system, referring URL, pages visited, timestamps and approximate (country-level) location. This data is generated automatically by our hosting infrastructure.
• Communications — the content of correspondence you exchange with us by email or via the Site.

We do not knowingly collect special categories of personal data (Art. 9 GDPR) or data relating to children under 16.

We process personal data only where we have a valid legal basis under Art. 6 GDPR:

• Performance of pre-contractual measures (Art. 6(1)(b)) — to respond to investor inquiries, evaluate potential cooperation and prepare agreements at your request.
• Legitimate interests (Art. 6(1)(f)) — to operate and secure the Site, prevent abuse, maintain investor relations, measure aggregated usage and protect our rights. Our legitimate interest is in running a secure, professional and effective corporate presence.
• Consent (Art. 6(1)(a)) — where you have explicitly opted in (e.g. to receive non-mandatory communications or non-essential cookies). You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, AML/KYC, and other statutory obligations applicable to a Maltese private limited company.

The Site uses only strictly necessary cookies and local storage required to operate the application, remember UI preferences and protect form submissions. These do not require consent under Art. 5(3) of the ePrivacy Directive.

We do not currently use third-party advertising, tracking or profiling cookies. If we introduce non-essential cookies in the future, we will request your prior consent via a cookie banner and update this Policy accordingly.

We share personal data only with carefully selected processors that act on our documented instructions under Art. 28 GDPR. Categories of recipients include:

• Cloud hosting and database providers operating within the EU/EEA.
• Email and communication providers used to respond to inquiries.
• Professional advisors (lawyers, auditors, tax consultants) where strictly necessary.
• Competent public authorities where required by law.

We do not sell personal data and do not disclose it to third parties for their own marketing purposes.

Where personal data is transferred to a country outside the EU/EEA, such transfers take place only on the basis of an adequacy decision of the European Commission, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), or another transfer mechanism permitted under Chapter V GDPR. A copy of the safeguards applied is available on request.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements:

• Investor inquiries: up to 36 months after the last meaningful interaction, unless a relationship is established.
• Contractual and accounting records: 10 years, as required by Maltese commercial and tax law.
• Server and security logs: typically up to 90 days.
• Marketing-related data: until you withdraw consent or object.

Subject to the conditions of the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15).
• Request rectification of inaccurate or incomplete data (Art. 16).
• Request erasure where one of the grounds in Art. 17 applies.
• Restrict processing (Art. 18) or object to processing based on legitimate interests (Art. 21).
• Receive your personal data in a portable format (Art. 20).
• Withdraw consent at any time, without affecting the lawfulness of prior processing.
• Lodge a complaint with a supervisory authority — for Malta, the Information and Data Protection Commissioner (idpc.org.mt).

To exercise your rights, please contact us at privacy@urvalon.com. We will respond within one month, as required by Art. 12(3) GDPR.

We apply appropriate technical and organisational measures (Art. 32 GDPR) to protect personal data against unauthorised access, loss, alteration or disclosure, including TLS encryption in transit, hardened access controls, principle-of-least-privilege, role-based authorisation, encrypted data stores and routine security reviews.

We do not subject visitors or investors to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects (Art. 22 GDPR).

We may update this Policy from time to time to reflect changes in law, technology or our practices. Material changes will be communicated by updating the “Last updated” date above and, where appropriate, by a notice on the Site.

Questions about this Policy or about how we handle your personal data should be directed to privacy@urvalon.com.