Privacy Policy.

01Introduction

This Privacy Policy explains how Rava Solutions ("Rava," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit www.ravasolutions.io (the "Site") or interact with us through the Site's forms, chat features, or other communications channels.

Rava is an Illinois corporation, not domiciled in Bermuda, and so is an "Overseas Third Party" as defined in the Bermuda Personal Information Protection Act 2016 (PIPA), Part 1, Section 2. Rava provides a cloud-native human resources and payroll platform purpose-built for organizations operating in Bermuda. Those organizations that are Rava customers (employers) in Bermuda input personal information about their employees (or the employees do so themselves) needed complete process payroll, for example. As such, Rava customers in Bermuda are responsible for ensuring compliance with PIPA pursuant to PIPA Part 2, Sections 5(3) and 15(1).

Please read this Policy carefully. By using the Site or submitting information to us through the Site, you acknowledge that you have read and understood this Policy.

02Who we are

The data controller responsible for the personal information described in this Policy is:

For privacy-related inquiries, please contact us at info@ravasolutions.io.

03Information collected through the Site

Information you provide to us

When you interact with the Site (not the Rava software), you may provide us with personal information directly. Categories include:

• Contact information: your name, email address, phone number, employer name, and job role, submitted through our contact form, First Wave reservation form, or other Site forms.
• Organizational information: your organization's industry, approximate employee count, current payroll system, and target go-live window, submitted through our First Wave reservation form.
• Communications: the content of any messages, questions, or feedback you send to us by email, form submission, or (if enabled in future) chat.
• Marketing preferences: your preferences regarding marketing communications, where you have expressed them.

Information we collect automatically

When you visit the Site, we and our service providers may automatically collect certain information about your device and how you interact with the Site. Categories include:

• Device and browser information: IP address, browser type and version, device type, operating system, and referring URL.
• Usage information: pages viewed, features used, time spent, and navigation patterns.
• Server logs: standard web server logs generated by our infrastructure provider for security, diagnostic, and performance purposes.

See our Cookie Policy for details on cookies and similar tracking technologies.

Information from third parties

We may receive information about you from third-party sources, such as business intelligence providers, our channel partners (including Emergence), or from publicly available sources. We only use this information consistent with the purposes described in this Policy.

04How we use your information

We use personal information for the following purposes:

• To respond to inquiries submitted through the Site's forms or by email.
• To administer the First Wave pre-general-availability program, including confirming reservations, sending program updates, and preparing your onboarding when your industry opens.
• To provide you with information about Rava's products, services, and events where you have opted in or where we have a legitimate business interest in doing so.
• To improve the Site, our marketing materials, and our understanding of the Bermuda payroll and HR market.
• To protect the Site and our systems from fraud, abuse, and security threats.
• To comply with legal obligations, including record-keeping requirements and lawful requests from public authorities.

We do not sell your personal information to third parties. We do not use your personal information for automated decision-making that produces legal or similarly significant effects about you.

05Legal bases for processing

Where the laws of Bermuda, the European Union, or the United Kingdom apply to our processing of your personal information, we rely on the following legal bases:

• Consent: where you have provided your consent, such as when you submit an inquiry form or opt in to marketing communications.
• Contract or steps to enter a contract: where processing is necessary to respond to a request that could lead to a business relationship with Rava.
• Legitimate interests: where processing is in our legitimate business interests, such as marketing Rava to business prospects in our target industries, provided those interests are not overridden by your rights and freedoms.
• Legal obligation: where processing is necessary to comply with a legal requirement to which we are subject.

06How we share your information

We share personal information only in limited circumstances and only with parties who are contractually bound to protect it. Categories of recipients include:

• Service providers: vendors that host, secure, monitor, or otherwise support the Site and our business operations. Current key providers include:
  • Microsoft Azure (infrastructure hosting and databases, in the Canada Central region).
  • Microsoft (Graph and related productivity services) for internal communications and record-keeping.
  • [CRM provider to be named, e.g., Microsoft Dynamics 365 or Salesforce] for prospect and customer relationship management.
  • [Email delivery provider to be named] for transactional and marketing email delivery.
• AI service providers (for future AI features, currently not active on this Site): Azure OpenAI Service and Anthropic. These providers process query payloads for the sole purpose of generating AI responses on our behalf and do not retain content for their own model training.
• Professional advisors: our lawyers, accountants, auditors, insurers, and other advisors, where necessary and subject to appropriate confidentiality obligations.
• Business partners: where you engage with us through a co-selling arrangement (for example, with our channel partner Emergence), we may share your information with that partner solely to coordinate your inquiry.
• Government and law enforcement: where required by applicable law, court order, or lawful government request, or where necessary to protect the rights, property, or safety of Rava, our customers, or others.
• Corporate transactions: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to standard confidentiality safeguards.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

07International data transfers

Rava operates from the United States, hosts data primarily in Microsoft Azure's Canada Central region, and may transfer your personal information to service providers in the United States, Canada, and other jurisdictions.

Where personal information originating in Bermuda is transferred outside Bermuda, we take steps designed to ensure a comparable level of protection to that provided under PIPA. Where personal information originating in the European Economic Area, the United Kingdom, or Switzerland is transferred, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses or adequacy decisions where available.

08Data retention

We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, tax, and reporting requirements. Retention periods depend on the type of information and the context of collection:

• Contact form and First Wave reservation submissions: retained for the duration of our business relationship or, if no relationship results, for up to [X] months after the last interaction, unless a longer retention period is required by law.
• Marketing communications data: retained until you withdraw your consent or otherwise opt out, subject to a reasonable period to process your request.
• Server logs and security data: retained for the periods necessary for security monitoring and incident investigation, typically [X] days.
• Records required by law: retained for the period required by the applicable law (for example, records related to tax, contracts, or regulatory compliance).

09How we protect your information

We take reasonable and appropriate administrative, technical, and physical safeguards to protect personal information against loss, misuse, unauthorized access, disclosure, alteration, and destruction. These safeguards include:

• Encryption of data at rest using AES-256 (via Microsoft Azure Transparent Data Encryption) and encryption of data in transit using TLS 1.2 or higher.
• Role-based access controls with the principle of least privilege applied to internal systems.
• Secrets management using Microsoft Azure Key Vault.
• Password hashing using BCrypt (for any future authenticated experiences).
• Regular vulnerability scanning, monitoring, and logging of security events.
• A security incident response process that includes assessment, containment, notification, and remediation.

No method of transmission over the internet and no method of electronic storage is completely secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee its absolute security.

10Cookies and tracking

The Site uses cookies and similar technologies. For details, please see our Cookie Policy.

11AI features

Rava is developing AI-powered features for use on the Site and inside the product. When AI features are active on the Site, we will process your questions and inputs through the AI providers named in Section 6 (Azure OpenAI Service and Anthropic) solely for the purpose of generating a response on our behalf. AI providers do not retain your inputs for their own model training. AI feature logs may be retained by us for quality monitoring, safety, and product improvement, consistent with the retention periods described in Section 8.

As of the effective date of this Policy, AI concierge features on this Site are not active. This section will apply when they are enabled.

12Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the "Last updated" date at the top of this Policy and, where required by law, by additional notice. Your continued use of the Site after a change takes effect constitutes your acknowledgment of the updated Policy.

13Contact us

If you have questions, comments, or requests about this Privacy Policy or how we handle your personal information, please contact: