Privacy Policy

Vortex Quantitative ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard information when you visit our website at vortexquant.com.

This policy covers the website. If you become a customer, the processing of data inside our products and services is governed by the written agreement we sign with you, not by this policy.

The data controller is Vortex Quantitative Software Inc., at the address given in the Contact Us section. We have not appointed a Data Protection Officer; privacy enquiries are handled at the contact address below.

This policy tells you what happens to your information. It is not a contract and you are not asked to agree to it — using a website is not consent to anything. Where we need a legal basis to process your information, the Legal Bases for Processing section says which one applies to each activity, and where we need your consent we ask for it separately and specifically.

This is an informational website. It has no user accounts, no sign-in, and it takes no payments. What we collect is limited to the following.

Information you give us

• Contact and enquiry forms: your name, email address, company, job title, and whatever you choose to write in the message field.
• Newsletter sign-up: your email address, and any other field you choose to complete.

Please do not send us passwords, customer financial information, or other confidential or sensitive information through a web form. If you need to share something sensitive, contact us first and we will arrange an appropriate channel.

Information collected automatically

• Analytics cookies, and only if you accept them: which pages you read and how you move through the site, and — where you also submit a form while they are active — which pages you read before getting in touch. These are set by HubSpot and are listed individually in our Cookie Policy.
• Aggregate visitor measurement, which uses no cookie and no identifier: page counts and load performance only, never linked to an individual.
• Server and security logs generated when your browser requests a page, including IP address, browser user agent and the time of the request.
• The record of the cookie choice you made, which is stored in your browser's local storage rather than as a cookie.

We do not collect special category data or sensitive personal information, we do not ask for it, and we ask you not to send it.

We use the information described above to:

• Respond to your enquiry and manage the business relationship that follows from it
• Send you the newsletter if you asked for it, and let you unsubscribe from it
• Understand how the website is used so that we can improve it
• Where you accepted analytics cookies and then contacted us, understand what you were looking at beforehand so that our reply is relevant
• Keep the website available, and detect and prevent automated abuse of our forms
• Meet our legal obligations, including the obligation to keep a record of the cookie choice you made

We do not advertise to you, we set no advertising cookies, and we do not build profiles about you.

Accepting analytics cookies does not subscribe you to anything. Newsletter subscription is a separate choice that you have to make yourself.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we must have a legal basis for each thing we do with your personal information. This is what we rely on:

Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms and recorded that assessment. You can ask us for a summary of it using the contact details below, and you can object to that processing at any time — see the Your Rights and Choices section.

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect processing we carried out before you withdrew it.

We do not make decisions about you by solely automated means, and we do not carry out profiling that has legal effects for you or that otherwise significantly affects you.

Article 13(2)(f) of the GDPR requires us to tell you this. We would state it anyway: we build analytics software, and we would rather be explicit about what we do not do with your data on our own website.

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following situations:

• With your consent or at your direction
• With service providers who assist in our operations
• To comply with legal obligations or valid legal processes
• To protect the rights, property, and safety of Vortex Quantitative and our users
• In connection with a merger, acquisition, or sale of assets

The service providers who process personal information on our behalf, and only on our instructions, are:

Analytics cookies set by HubSpot are placed only if you accept them via our cookie banner, and you can withdraw that consent at any time using the "Cookie Settings" link in our footer.

The Cloudflare services set no cookies, store nothing on your device, and do not identify you or track you across websites. The measurement is aggregate only and is not linked to any individual.

We are established in the United States, and so are all of the service providers listed in the Information Sharing and Disclosure section. If you are in the European Economic Area, the United Kingdom, or Switzerland, the personal information you give us is therefore processed in the United States, a country whose data protection laws differ from those in your own.

For the transfers to our service providers, we rely on the following safeguards:

• HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework, together with its UK Extension and the Swiss-U.S. Data Privacy Framework. Standard Contractual Clauses approved by the European Commission are also incorporated into our data processing agreement with them, and apply as a fallback.
• Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework and its UK Extension, with Standard Contractual Clauses in our data processing agreement as a fallback.
• Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework, with Standard Contractual Clauses incorporated into its terms as a fallback.

Each of these providers is bound by a data processing agreement that permits them to use your information only to provide the service to us, and not for their own purposes.

You can request a copy of the safeguards that apply to these transfers by emailing privacy@vortexquant.com.

We take technical and organisational measures to protect information against unauthorised access, alteration, disclosure and destruction. These are the measures that apply to this website and the systems behind it:

• Traffic to the website and to our content management system is encrypted in transit using TLS, and plain HTTP requests are redirected to HTTPS.
• Data held by our hosting and database providers is encrypted at rest.
• Credentials are kept in a managed secrets store rather than in source code or configuration files, and application access to our database is granted by managed identity rather than a shared password.
• Administrative access to the content management system requires authentication and is limited to named accounts with role-based permissions.
• Database schema changes and write activity are logged.
• The public website is a set of static files. It holds no visitor database, so on the public side there is no store of visitor data to compromise.

We are still formalising the wider security programme — documented incident response, a recorded staff training cycle, and a regular independent assessment cadence. We would rather tell you that plainly than claim a maturity we have not reached, and we will update this section as each piece is in place.

No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

We keep information only for as long as we need it. These are the criteria we apply to each category:

• Enquiries, and the correspondence that follows them — kept while we are in contact with you about your enquiry, and afterwards for as long as we may reasonably need to pick the conversation back up or to show what was discussed. Deleted or anonymised once neither applies, unless a longer period is required by law, or the enquiry has become part of a customer relationship — in which case the agreement with that customer governs.
• Newsletter subscription — until you unsubscribe. After that we keep only the minimum needed to make sure we do not email you again.
• Analytics cookies — each cookie expires on the schedule set out in our Cookie Policy. The associated records held by HubSpot on our behalf are kept under the retention period configured in that platform, which we review periodically.
• Aggregate visitor measurement — retained in aggregate form only. It contains no identifier and cannot be traced back to a person at any point, so there is nothing in it to expire.
• Server and security logs — kept for the short period needed to investigate faults and abuse, then deleted.
• The record of your cookie choice — held in your browser until you clear it. We keep our own record of consent for as long as we rely on it, plus a period sufficient to demonstrate that it was given, which Article 7(1) of the GDPR requires us to be able to do.

When we no longer need personal information, we delete it or irreversibly anonymise it.

You have certain rights regarding your personal information:

• Access and receive a copy of your personal information
• Correct or update inaccurate information
• Request deletion of your personal information
• Object to or restrict certain processing
• Receive your information in a portable format
• Opt-out of marketing communications
• Withdraw consent where processing is based on consent

To exercise any of these rights, email privacy@vortexquant.com. We will respond within the time the law allows — one month if you are in the European Economic Area, the United Kingdom or Switzerland, and 45 days for requests made under US state privacy laws. We do not charge for this, and we will not treat you differently for asking.

Where we rely on legitimate interests — answering your enquiry, keeping the site secure, and aggregate visitor measurement — you can object at any time by emailing privacy@vortexquant.com with "Objection" in the subject line, and we will stop unless we have compelling grounds not to. For the aggregate measurement, which is the one thing here that observes you without asking first, we will simply exclude you. You can also stop it immediately without contacting us: any privacy extension or blocklist that blocks static.cloudflareinsights.com prevents the measurement from happening at all.

One honest limitation. The aggregate measurement described above involves no cookie, no identifier, and nothing that links one page view to another or to you. That is what makes it unintrusive, but it also means we cannot find you inside it. We therefore cannot give you access to that particular data or delete you from it, because we have no way of telling which records are yours — and we are not required to collect extra information about you purely to make that possible. Every other category of information described in this policy is fully accessible to you on request.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to lodge a complaint with your national data protection authority — in the country where you live, where you work, or where you believe the problem occurred. In the United Kingdom this is the Information Commissioner's Office. We would rather you came to us first, but you do not have to.

If you live in California, Colorado, Connecticut, Virginia, Texas, or another US state with a comprehensive privacy law, this section explains your rights and how we handle the questions those laws ask.

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising. "Sell" and "share" have the meanings given to them by the California Consumer Privacy Act. We run no advertising cookies and no advertising networks on this website, so there is no sale or sharing for you to opt out of.

We honour Global Privacy Control. If your browser or an extension sends a GPC signal, we record it as a refusal of optional cookies and set none. Because we do not sell or share personal information and do not carry out targeted advertising, there is no further processing for that signal to switch off.

The categories of personal information we collect are set out in Information We Collect, the purposes in How We Use Your Information, the categories of recipient in Information Sharing and Disclosure, and how long we keep each category in Data Retention. We collect it from you directly, and from your browser when it requests a page. We do not collect sensitive personal information as those laws define it, so there is no use of it for you to limit.

Subject to the conditions in the statute that applies to you, you may ask us to:

• Confirm whether we process personal information about you, and give you access to it
• Correct personal information that is inaccurate
• Delete personal information we hold about you
• Provide a copy in a portable, machine-readable format
• Opt out of any sale, sharing, or targeted advertising — which, as set out above, we do not carry out

Email privacy@vortexquant.com to make a request. You may use an authorised agent, in which case we will need written proof of their authority and may confirm the request with you directly. We will not discriminate against you for exercising these rights: we will not deny you service, charge a different price, or provide a lower quality of service.

If we decline your request, you may appeal by replying to our decision. We will review the appeal and respond within the period the applicable state law allows.

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Vortex Quantitative Software Inc.

Email: privacy@vortexquant.com

Phone: +1 212 521 4046

Address: 1325 Avenue of the Americas, 28th Floor, New York, NY 10019