Privacy-Policy

Privacy Policy

Effective March 01, 2021

Your Privacy Matters

Elphinstone’s number one priority is your trust. Your privacy is essential to earning and keeping that trust. This tenet drives all of the decisions we make, as well as how we gather, use and store any information we acquire from you.

We created this Privacy Policy to be as clear and direct as possible about how we gather and use your non- public personal information and other types of personal information (“Personal Information”) and to assist you in exercising your privacy rights.

Introduction

Elphinstone, Inc. and/or its affiliates (“Elphinstone”, “we”, “us” and/or “our”) currently offer a cash product, financial planning software and portfolio management services, and may offer additional products and services in the future (collectively, the “Services”), through Elphinstone’s website, smartrupee.pk (“Site”) and our mobile applications (“App”). This Privacy Policy describes how Elphinstone treats your Personal Information when you use or evaluate our Site, App and/or Services.

For the purpose of this Privacy Policy, a “User” is an individual who creates an account on our Site or App to use our free financial planning software and/or to understand or evaluate our Services; and a “Client” is an individual who signs our Client Agreement that entitles the Client to maintain a Cash Account, and/or has their investment portfolio managed by Elphinstone.

Our Privacy Policy, Terms and Conditions, and, where applicable, Client Agreement, collectively govern your use or evaluation of our Site, App and Services.

Information Collection

The categories of information we collect depend on whether you are a current or former User, and/or Client. Examples of instances when we collect Personal Information include:

when you answer questions on the Site or in the App to determine what kind of portfolio we might recommend if you were to become a Client,
when you register to open an account either as a User or a Client,
when you contact our client service organization with questions, or
when you become a Client.
Wherever Elphinstone collects Personal Information, we endeavor to provide a link to this Privacy Policy and other relevant terms, such as our Terms and Conditions.
Information We Collect from Users
We collect Personal Information from Users, including but not limited to your:
name, e-mail address, telephone number, zip code, Internet Protocol address, birth date;
investable assets, income information and other financial planning information about your household; and
link to our Services (bank or brokerage), any challenge and/or security questions associated with those accounts and any information contained in those accounts Note: Elphinstone does not store login credentials used to link Account Information (as defined below). If you choose to link to our Services, we use a third-party service provider to aggregate, access and retrieve your Account Information. Any Account Information that is stored at a third-party service provider is read-only and cannot be altered by Elphinstone or the third-party service provider. Any Account Information transmitted to a third-party service provider is transmitted via end-to-end encryption, and any credentials transmitted to the third party service provider are encrypted at rest.
Information We Collect from Clients
In addition to the information we collect from Users as described above, Clients must provide us additional Personal Information, including but not limited to:
your and your beneficiaries’ full legal name, contact information, address, birth date, Social Security Number, citizenship, marital status; and
your investment objectives, approximate net worth, tax information and other regulatory information that may be necessary and required by federal and certain statutory laws such as employment information and stock restrictions (see our Client Agreement);

Information We Collect when Acting As a User’s or Client’s Authorized Agent

Many of Elphinstone’s Users and Clients choose to aggregate information from accounts at other financial institutions onto their dashboard on our Site or in our App; in enabling this functionality, Elphinstone acts as an agent to retrieve the User or Client account information maintained by such third-party financial institutions with which the User or Client has a legally-binding customer relationship (“Account Information”). This Account Information may include account balances, transactions and holdings from the linked financial institutions.

By choosing to use our Services to aggregate and analyze your Account Information, you expressly authorize and direct Elphinstone, on your behalf, to electronically retrieve all Account Information associated with the username and password that you use to link the account. Elphinstone does not store login credentials used to link Account Information. Rather, Elphinstone works with one or more third-party service providers to access and retrieve your Account Information. Any Account Information that Elphinstone receives is read-only and cannot be altered by Elphinstone or the third-party service provider we use to access and retrieve your Account Information. Any Account Information transmitted from a third- party financial service provider is transmitted via end-to-end encryption, and any credentials you provide are encrypted at rest.

Information We Collect via the Referral Program

Elphinstone manages a referral program called “The Elphinstone Invite Program.” The program allows our Clients to lower their annual advisory fee in exchange for referring a person who becomes a client. Participation in our referral program is free and voluntary for our Clients. By participating, you are asked to provide us with the name and e-mail address of the person to whom you refer our Service. We treat this information like all our other Personal Information.

Information Regarding Children

Due to the nature of our business, our Services are not made available to minors. Except for beneficiary information as described above, Elphinstone does not knowingly solicit Personal Information directly from or about persons under the age of 18.

If you are under the age of 18, please do not submit any Personal Information to Elphinstone.

Other Ways We Collect Information

Other means by which we collect Personal Information include the following:

Automatic Data Collection. We may collect certain information when you use our Services. This information may include your Internet protocol (“IP”) address, cookie identifiers, mobile carrier, mobile advertising and other unique identifiers, details about your browser, operating system or device, location information, Internet service provider, pages that you visit before, during and after using the Services, information about the links you click, and other information about how you use the Services. Information we collect may be associated with accounts and other devices.
Anonymized or Aggregated Information. Elphinstone’s Site and App record certain anonymized or aggregated information about your use or evaluation of our Services. Anonymized or aggregated information is used for a variety of functions, including the measurement of Users’ and Clients' interest in and use of various portions or features of the Site and App. Anonymized or aggregated information is not Personal Information, and we may use such information in a number of ways, including internal analysis and research. We may share this information with third-parties for our purposes in an anonymized or aggregated form that is designed to prevent anyone from identifying you.
Cookies and Pixels. Similar to other consumer internet services, Elphinstone uses cookies, a small piece of computer code that enables our Web servers to “identify” Users and Clients, each time they initiate a session on our Site. A cookie is set in order to identify you and tailor the Site to you. Cookies do not store any of the Personal Information that you provided to us; they are simply identifiers. You may delete cookie files from your hard drive at any time through your browser settings. However, cookies may be necessary to provide access to much of the content and many of the features of the Site.
Pixel Tags. Along with cookies, we may use “pixel tags,” also known as “web beacons,” which are small graphic files that allow us to monitor the use of our Sites. A pixel tag can collect information such as the IP address of the computer that downloaded the page on which the tag appears; the URL of the page on which the pixel tag appears; the time the page containing the pixel tag was viewed; the type of browser that fetched the pixel tag; and the identification number of any cookie on the computer previously placed by that server.
Site and App Activity. Elphinstone may also use third-party tracking technology, such as Google Analytics, to record similar information regarding you and your activity on our Site and App.
“Do Not Track” Technology. We do not collect Personal Information about your online activities over time and across different websites or online services. Therefore, our Site does not respond to Do Not Track (“DNT”) signals. We do not knowingly authorize third-parties to collect Personal Information about your online activities over time and across different websites or online services.
Surveys. We may contact you to participate in surveys. If you decide to participate, you may be asked to provide certain information which may include Personal Information.

How we use Information

No Renting, Selling or Trading Out List

We will never rent, sell or trade your Personal Information to anyone. Ever.

User Personal Information

We use your Personal Information for a variety of business purposes, such as to help you evaluate our Services, offer you new products or services, enhance our Services, and for research and internal analysis.

Client Personal Information

Elphinstone stores, processes, and maintains Personal Information related to you for a variety of business reasons such as to provide client support, analyze and improve our Services, offer new products or services and provide our Services to Clients in accordance with the rules of regulatory bodies such as the Securities and Exchange Commission and Financial Industry Regulatory Authority. As a User, you may choose not to provide such information to us, but if you choose not to provide such information, you will not be able to become a Client.

Cross-Device Tracking

Your browsing activity may be tracked across different websites and different devices or apps. For example, we may attempt to match your browsing activity on your mobile device with your browsing activity on your computer. To do this, we may analyze your browsing patterns, geo-location and device identifiers to match the information of the browser and devices that appear to be used by the same person.

Social Media and Links to Other Websites and Applications

This Privacy Policy and these terms apply only to Elphinstone operated Services and applications. Please note that our Site and Apps may contain links to other websites, applications, social media accounts, and information for your convenience that are not operated or controlled by Elphinstone. Elphinstone does not control Linked Third-Party websites or their privacy practices, which may differ from those set out in this Privacy Policy. Elphinstone does not endorse or make any representations about Linked Third-Party information. Any Personal Information you choose to give to Linked Third-Parties is not covered by this Privacy Policy. We encourage you to review the privacy policy of any company or website before submitting your Personal Information. Some third-parties may choose to share their users’ Personal Information with us; that sharing is governed by that company’s privacy policy, not this Privacy Policy.

Mobile Computing

Elphinstone provides websites and online resources that are specifically designed to be compatible for use with mobile computing devices. Mobile versions of our website are governed by the provisions hereunder related to the Site and may require that you log in with an account. In such cases, information about the use of each mobile version of the website may be associated with your accounts. In addition, we may enable individuals to download tools, such as an application, widget or another tool, that can be used on mobile or other computing devices. Some of these tools may store information on mobile or other devices. These tools may transmit Personal Information to Elphinstone to enable you to access your account information and to enable us to track the use of these tools. Some of these tools may enable users to e- mail reports and other information from the tool. We may use Personal Information or non-identifiable information transmitted to us to enhance these tools, to develop new tools, for quality improvement and as otherwise described in this Privacy Policy or in other notices we provide.

Promotional Activity

We may run sweepstakes and contests. The contact information you provide may be used to reach you about the sweepstakes or contest and for other Elphinstone promotional or marketing purposes. In some jurisdictions, we are required to publicly share some winner information.

Information Sharing and Onward Transfer

We will not share or disclose your Personal Information (whether you are a current or former User or Client) to any nonaffiliated third-parties except:

To Protect Ourselves or Others. We may share your Personal Information as required by law, such as when we reasonably believe it is necessary or appropriate to investigate, prevent, or take action regarding illegal activities, suspected fraud, front running or scalping, situations involving potential threats to the

personal safety of any person, if we believe doing so is required or appropriate to: comply with law enforcement or national security requests and legal process, such as a court order or subpoena; to protect your, our or others’ rights, property, or safety; enforce our policies or contracts; or collect amounts owed to us.

Affiliates. Elphinstone may share your Personal Information among affiliated Elphinstone entities in connection with the provision of Services to Clients and Users.

Service Providers. There are certain circumstances in which we may share your Personal Information with non-affiliated third-party service providers, including to perform certain business and technology related functions and to support the provision of the Services. We may share your Personal Information with non- affiliated third-party service providers for the provision of services, which includes but is not limited to the following: mailing information; trade settlement and clearing; data processing and storage; payment processing; identification verification and fraud detection; customer support; and marketing.

Business Partners. We may provide Personal Information to business partners with whom we jointly offer products or services. For example, we may share the information required to become a Client with our brokerage partner(s) solely to allow our brokerage partner(s) to provide and facilitate the provision of Services to you.

Disclosure in the Event of Merger, Sale, or Other Asset Transfers. If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, then your Personal Information may be transferred as part of such a transaction, as permitted by law and/or contract.

Your Choices and Opting-Out

General. You have certain choices about the use and disclosures of your Personal Information, as set out in this Privacy Policy.

You may decline to provide Personal Information to Elphinstone. Declining to provide Personal Information may disqualify you from using Elphinstone Services, Site, and App features that require certain Personal Information.

Opting-Out – Obtaining and Withdrawing Consent

Where you have consented to Elphinstone’s use of your Personal Information, you may withdraw that consent at any time and opt-out by contacting us by email, phone or physical mail via the contacts indicated under the “Questions and Contacting Us” section below. Clients and Users cannot opt-out of providing Elphinstone Personal Information and continue to use the Services. Clients and Users must close their account(s) in order to opt-out of further providing Elphinstone with Personal Information. Additionally, before we use Personal Information for any new purpose we will provide information regarding the new purpose. Even if you opt-out, we may still collect and use non-personal information regarding your activities on our Services and for other legal and regulatory purposes as described above.

Email and Telephone Communications.

Elphinstone may use your Personal Information to communicate with you regarding our Services or to tell you about blog posts or Services that we believe will be of interest to you. Please note that you cannot opt- out of administrative communications such as regulatory, billing or service notifications, or updates to our Terms or this Privacy Policy

We process requests to be placed on do-not-mail, do-not-phone and do-not-contact lists as required by applicable law.

Mobile Devices.

We may send you push notifications through our mobile application. You may at any time opt-out from receiving these types of communications by changing the settings on your mobile device. We may also collect location-based information if you use our mobile applications. You may opt-out of this collection by changing the settings on your mobile device.

Retention and Deletion

Elphinstone retains the Personal Information we receive as described in this Privacy Policy for as long as you use our Site, App, or Services or as necessary to fulfill the purpose(s) for which it was collected, to provide our Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, or as otherwise required to comply with contracts and comply with all applicable laws.

Security

Elphinstone takes reasonable steps, endeavoring to use appropriate technical or organizational measures, to protect your Personal Information from loss, misuse, unauthorized access, alteration, disclosure, or destruction. However, no Internet, email, or electronic operating system that enables the transmission of data is ever fully secure or error-free; therefore, we cannot ensure or warrant the security of any information you transmit to us.

Other Important Information California Privacy Rights

California law permits Users and Clients who are residents of California to request and obtain from us once a year, free of charge, a list of the third-parties to whom we have disclosed their Personal Information (if any) for the third-parties’ direct marketing purposes in the prior calendar year, as well as the type of Personal Information disclosed to those parties. However, this disclosure requirement only applies if we share Personal Information with third parties for those third-parties to directly market their own products to those consumers, and Elphinstone does not share Personal Information with third-parties for those third- parties to directly market their own products to Users or Clients.

The California Consumer Privacy Act permits certain Users (users of our financial planning services who have shown no indication of becoming a Client) who are California residents to request and obtain from us twice a year, free of charge, information related to Personal Information we have collected in the 12 months preceding the request. The California Consumer Privacy Act also gives Users the right to request the permanent deletion of Personal Information. Users can request information related to Personal Information we have collected about them and/or request deletion of their Personal Information by following the “Retention and Deletion” procedure above.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time as we deem necessary at our sole discretion. If there are any material changes to this Privacy Policy, we will notify you as required by applicable law.

Elphinstone encourages you to review this Privacy Policy periodically to be informed regarding how we are using and protecting your information and to be aware of any policy changes. Your continued relationship with Elphinstone after the posting or notice of any amended Privacy Policy shall constitute your agreement to be bound by any such changes. Any changes to this Privacy Policy will take effect immediately after being posted or otherwise provided by us. Each version of this Privacy Policy will be identified on this page by its effective date.

This document constitutes Elphinstone’s complete Privacy Policy for Elphinstone and its affiliates and the Services, Site and App.