PRIVACY POLICY
[Last Updated: February 12, 2026]
1. INTRODUCTION & SCOPE OF THIS PRIVACY POLICY
This privacy policy (“Privacy Policy”) governs Optival LTD (“Company”, “we”, “our”, or “us”) Personal Data (as defined below) collection and privacy practices.
This Privacy Policy applies to the websites and other digital assets that we own and operate (including landing pages and advertisements, collectively, the “websites”). Through the websites, we provide information about, and comparisons between, business loan products and related financing services offered by third parties, and we may enable users to be redirected to such third parties’ websites or platforms (each, a “Business Partner” and a “Business Partner Website”) (collectively, the “Services”).
This Privacy Policy provides information regarding the types of Personal Data we collect from users when accessing, browsing or otherwise interacting with our websites and Services (including our landing pages, ads, etc.), how and why we collect and use such Personal Data, the categories of third parties with whom we may share it (and the purposes of such sharing), and your rights and choices regarding your Personal Data.
This Privacy Policy forms an integral part of our Terms of Use (“Terms”). Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the Terms.
You acknowledge that you are not under any statutory obligation to provide us with Personal Data. However, if you choose not to provide certain Personal Data, we may be unable to provide certain features of our Services (for example, we must obtain your email address if you contact us in order to respond). In addition, certain cookies on our websites are essential for the websites to work properly, while others are intended to improve our Services or support our promotional efforts and can be opted out of, as explained under this Privacy Policy. If you object to the collection of Personal Data that is necessary for a specific feature, you may choose not to use that feature or not to access or use our websites.
2. AMENDMENTS
We reserve the right to amend this Privacy Policy from time to time at our sole discretion. The most recent version will always be posted on the Website, with the update date reflected in the “Last Updated” heading. If changes are material, we will provide notice to you and, where required by applicable law, obtain your consent. Unless otherwise stated, any amendments to the current practices of Personal Data we hold will become effective within 7-days upon the display of the modified Policy. We recommend that you review this Privacy Policy periodically to stay informed about our current privacy practices.
3. DATA CONTROLLER & CONTACT INFORMATION
Optival LTD is the controller (as such term is defined under the GDPR, or an equivalent term under applicable data protection laws). This means we determine the purposes and means of processing the Personal Data we collect through your use of the websites and Services.
If you have any questions, concerns or complaints regarding this Privacy Policy, or if you wish to exercise your rights, please contact our privacy team at: legal@optival.com.
4. THE INFORMATION WE COLLECT & PURPOSE OF COLLECTION
You can find here information regarding the types of Personal Data we collect, the purposes for which we process your Personal Data, as well as the definitions of “personal” and “non-personal” data and how such data is processed.
Types of Information Collected and the Meaning of Personal Data
Under applicable data protection laws, “Personal Data” generally refers to information that identifies an individual or that could, with reasonable effort, identify an individual (for example, online identifiers such as an IP address or cookie identifier, as well as a name, email address, etc.). Personal Data may also include information related to your preferences and behavior (for example, inferences or profiles) where such information is associated with you or may be linked to you.
We may also collect “Non-Personal Data”, meaning information that does not identify a specific natural person and cannot reasonably be used to identify a specific natural person. This may include aggregated information regarding the use of the website and Services (for example, the number of users accessing our websites, click trends, territories, frequency, and time and date statistics), as well as technical information transmitted by your browser or device (for example, device type, browser type, and operating system). Such information is considered Non-Personal Data when collected on an aggregate basis or otherwise not combined with online identifiers or other information that can be used to identify an individual.
If we combine Personal Data with Non-Personal Data, we will treat the combined data as Personal Data.
Source of Personal Data
Depending on your interaction with our website and Services, we will collect certain information, as further detailed below. We may collect such information by one or more of the following means:
(i) Automatic means and tracking technologies (such as cookies, pixels and tags – see the “Cookies and Similar Technologies” section of this Privacy Policy) implemented by us or by third parties, such as our service providers, Business Partners, and other third-party marketing partners whose services we use (see the table below and the “Data Sharing – Categories of Recipients We Share Personal Data With” section of this Privacy Policy). This may also include “tracking links” implemented by us within Business Partner content displayed on our websites, which enable us and our Business Partners to know that a user (based on a unique online identifier) was directed from our website to a Business Partner’s website (as explained in the table below);
(ii) when you voluntarily provide us your information, for example, when you contact us; and
(iii) From our Business Partners, mainly where you engage with such Business Partners after being directed from our websites.
Personal Data Sets; Purpose and Use
The table below details the Personal Data sets collected, processing of Personal Data, the purpose, lawful basis, and processing operations:
DATA SET
PURPOSE AND OPERATIONS
Online Identifiers
When you access our website and interact with our Services, we collect online identifiers such as your IP address, user agent, and cookie ID. We may also assign a unique identifier (a random combination of letters and numbers) to each user who accesses our website. In addition, a unique identifier may be assigned when you interact with features that direct you to our Business Partner’s Websites through a tracking link (as explained in the “Source of Personal Data” paragraph above) (collectively, “Online Identifiers”).
Location Data
We may process your approximate location (for example, at the country level) derived from your IP address.
Device Information
We collect information transmitted from your device, such as the device type and model, device and application version, browser type, operating system, etc.
Usage Data
We collect information regarding your use of, and interactions with our website and Services. This may include the pages you access and the content you interact with (for example clicked on) as well as click stream data, access and interactions timestamp, session duration, etc. We may store this information together with Online Identifiers, in log files (collectively “Usage Data”).
***Where the data types listed above – including Location Data, Device Information and Usage Data are associated with Online Identifiers, we treat then as Personal Data, however we may also collect and use such information on an aggregated statistical basis, in which case it will not be considered Personal Data.
These data sets are processed for the following purposes:
· operating, maintaining and providing the functionality of our website and Services;
· ensuring security, preventing fraud and abuse, debugging, and resolving technical issues;
· analytics and measurement, including understanding how users interact with our website and Services and measuring the effectiveness of our content and advertising campaigns;
· improving and developing our Services (for example, to detect the applicable language); and
· marketing and advertising, including measuring marketing campaign performance and, where permitted by applicable law, conducting interest-based advertising and retargeting based on your visits to our website.
We may also use your unique ID or other Online Identifiers to track traffic flow from our website to our Business Partner’s website through tracking links, to manage our business engagement effectively, analyze performance metrics, monitor business transactions, and track conversions.
Business Partners’ Engagement Data
As explained above, when you click on a Business Partner’s offer on our website and directed to the Business Partner Websites, a tracking link may assign you a unique identifier. We will retain such action (i.e., the fact you have clicked and were directed to the Business Partner’s Website). In some cases, depending on our commercial arrangement with the relevant Business Partner, the Business Partner may share with us the information about your subsequent engagement with its offer. This may include, for example, whether you registered, made purchase, opened an account, and, where applicable, the amount paid or deposited.
We process these data sets to support our business operations. As explained in our Terms, we may receive advertising fees from our Business Partners when a user is redirected to a Business Partner’s Website and/or takes certain actions with the Business Partner. We therefore process this data primarily to calculate and attribute advertising fees and to maintain records for accounting, audit, and other legitimate business purposes.
We may also use these data sets on an aggregated basis to improve our content and campaigns and to generate insights about user satisfaction and the relative popularity of Business Partners’ offers (for example, where statistics show a high level of engagement with a particular Business Partner).
Advertising Campaigns Interactions
When we advertise our websites and the Services, we may use third-party providers or tools to manage and measure these campaigns. Through these tools, we collect information about the advertising interaction and subsequent activity, such as the ad or campaign you interacted with, the date and time of the interaction, the referring URL or sources, the pages you visit on our websites and whether you subsequently engaged with a Business Partner after being redirected from our website.
We collect and process these data sets to perform, facilitate and optimize our marketing campaigns, ad management and Services.
Contact Information & Communications
If you voluntarily contact us in connection with your interest in our website, support, or other inquiries, by email or through other means of communication, you may be required to provide us with certain information such as your full name, email address, and any additional information you choose to share with us. We will process and retain our correspondence and communications (collectively, “Contact Communications Data”).
We process Contact Communications Data for the purpose of contacting you and responding to your inquiries or providing you with the support or information you have requested.
Our correspondence with you may be processed and stored by us for record keeping purposes, to improve our Services, and where we reasonably determine it is needed for future assistance or to handle any dispute you might have with us.
In addition, we may process certain Personal Data to prevent potentially prohibited or illegal activities, fraud, misappropriation, infringements, identity theft, and any other misuse of the Services, and to enforce the Terms, as well as to protect the security and integrity of our databases and the Services, and to take precautions against legal liability.
5. COOKIES AND SIMILAR TRACKING TECHNOLOGIES
We use cookies (or similar tracking technologies such as pixels, tags, web beacons, etc.) when you access the website or interact with the Services. The use of cookies is a standard industry practice. These technologies are small pieces of text or code, or other information, that a website stores on your computer, device, or browser when you visit the website. These tracking technologies can be used for various purposes, including enabling you to navigate between pages efficiently, for analytics and statistical purposes, and for advertising purposes. You can find more information about cookies at: www.allaboutcookies.org.
In addition, please see our Cookie Settings page, which describes the cookies and similar technologies we use on our websites, and how you can manage your preferences.
Managing Cookies and Opting Out
Other than cookies classified as essential or strictly necessary for functionality purposes, you can configure your cookie preferences and opt out of the use of certain cookies (or all non-essential cookies) at any time, using the cookie preference management tool on our websites or through your browser settings. Please note that if you disable cookies, certain services, features, and functionality may not be available to you or may not work properly.
6. DATA SHARING – CATEGORIES OF RECIPIENTS WE SHARE PERSONAL DATA WITH
We share your data with third parties, including with trusted partners or service providers that help us provide and improve our Services:
CATEGORY OF RECIPIENT
DATA THAT WILL BE SHARED
PURPOSE OF SHARING
Business Partners
Unique ID, Online Identifiers
When you are directed to a Business Partner’s Website, we will share your unique identifier and may also, where necessary for fraud prevention, security compliance, etc., share your IP address or similar data. Please note that, we share this data only for the purpose of our business operation and tracking conversion.
Trusted agents and service providers
All data, as needed and applicable to the services provides.
We may disclose Personal Data to our trusted agents (such counsel and advisors) and service providers (including, but not limited to, cloud providers, CRM provider, security technologies providers, etc.) so that they can perform the requested services on our behalf. These providers are prohibited from using your Personal Data for any purposes other than providing us with requested services. When we share information with services providers, we ensure they only have access to such information that is strictly necessary for us to provide the requested services. These parties are required to secure the data they receive and to use the data for pre-agreed purposes only while ensuring compliance with all applicable data protection regulations (such service providers may use other non-personal data for their own benefit).
Subsidiaries and affiliated companies or any acquirer of our business
All data
We may share Personal Data, internally within our group or in in the event of a corporate transaction (e.g., sale of a substantial part of our business, merger, consolidation, or asset sale). In the event of the above, our affiliated companies or acquiring company will assume the rights and obligations as described in this Policy.
Advertising Partners
Online Identifiers, Device, Location and Usage Data
Where we use third-party advertising partners’ cookies or similar technologies (such as those offered by Google and social media platforms), such third parties may independently collect Personal Data about your device and your online activity over time and across different websites or online services. They may combine such information with other information they have collected about you for purposes such as delivering and measuring personalized or interest-based advertising and providing aggregated reporting regarding the performance of our advertising campaigns. These third parties collect and use information under their own privacy policies and subject to your choices made through our Cookie Settings and other opt-out mechanisms described in this Privacy Policy.
Governmental agencies or disclosure due to a legal process
Subject to law enforcement authority request.
We may need to disclose your Personal Data to comply with legal obligations (including court orders and subpoenas), defend against potential, threatened, or actual litigation, or when we are legally obliged to share information with law enforcement.
7. INTERNATIONAL DATA TRANSFER
Due to our global operations and the location of our service providers (for example, cloud hosting and storage providers), any Personal Data we collect may be transferred to, stored, and processed in countries other than the country from which you accessed the Services. We transfer Personal Data in compliance with applicable data protection laws, and we take appropriate measures to ensure that your Personal Data receives an adequate level of protection. Such measures may include entering into contractual obligations and/or implementing other valid data transfer mechanisms approved or recognized under applicable law (such as the Standard Contractual Clauses), as applicable. Where required under applicable data protection laws, we will obtain your consent to such transfer.
8. DATA RETENTION
As a principal, we will retain the Personal Data we collect only for as long as reasonably necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, regulatory, administrative, recordkeeping, or financial obligations. The criteria we use to determine the applicable retention periods for the Personal Data we collect include the following:
(i) Type of Personal Data and purpose of collection: We consider how long we need to retain the Personal Data to achieve the purposes for which it was collected, as well as the nature and sensitivity of the Personal Data and the potential risk of harm from unauthorized access to, or use of, the Personal Data.
(ii) Legal obligations: The retention period may also depend on the laws applicable to us and/or to the relevant processing activity, as under certain laws we are required to retain certain types of Personal Data. We may also retain Personal Data where required to do so pursuant to a binding legal request or court order.
(iii) Disputes, claims, and legal proceedings: We may retain certain types of Personal Data if we reasonably determine it is necessary to protect our rights, enforce our terms and policies, or defend against threatened or potential claims. In the event of a dispute between you and us, including any legal proceedings, we will retain the relevant Personal Data for as long as necessary to resolve the dispute and comply with applicable legal obligations.
Based on the criteria set forth above, we determine when we no longer have a legal justification for retaining Personal Data, and, at the end of the applicable retention period, we will delete it or de-identify it so that it can no longer be associated with you by reasonable means.
Except to the extent required by applicable law, we are not obligated to retain your Personal Data for any specific period of time, and we may delete it for any reason and at any time, without providing you with prior notice if our intention to do so.
9. SECURITY
We implement reasonable technical and organizational security measures designed to reduce the risks of loss, misuse, unauthorized access, disclosure, alteration, or destruction of the Personal Data we process or retain, in accordance with applicable laws. However, no security measures are completely fail-proof, and no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, while we strive to protect Personal Data, we cannot guarantee that our Services, systems, or databases will be secure or immune from unauthorized access, hacking, malware, communications interception, or other security incidents. As the security of information depends in part on the security of the computer, device, and network you use, you should take appropriate steps to protect your information, such as using strong passwords, keeping your credentials confidential, and ensuring your software and security settings are up to date.
10. “SALE” OF PERSONAL DATA
Under certain US state privacy laws, the term “sale” may include disclosing or making available Personal Data to a third party in exchange for monetary or other valuable consideration, and in some cases may also include certain disclosures for targeted advertising. We do not “sell” Personal Data as that term is commonly understood, meaning we do not disclose your Personal Data to third parties in direct exchange for money. However, depending on the applicable law and the specific circumstances, our use of cookies and similar technologies and certain third-party advertising services, and related disclosures of Personal Data, may be considered a “sale” or “sharing” of Personal Data (for example, for targeted advertising). The categories of Personal Data that may be disclosed for these purposes include: online identifiers (such as IP address and cookie ID); internet or other electronic network activity information (such as Device and Usage Data, including your interactions with our websites and Services); and geolocation data (such as approximate, country-level location derived from IP address) (each as described in Section 4 (The Information We Collect & Purpose of Collection)). You can opt out of such “sale”/ “sharing” by adjusting your preferences using the cookie preference tool available on our websites.
11. YOUR PRIVACY CHOICES & RIGHTS
You have certain choices, rights, and controls in connection with the Personal Data we collect about you or retain. Depending on your relationship with us and the applicable data protection laws in your jurisdiction, these rights may include one or more of the rights described in the table below, and the ways you can exercise them.
Please note that, as further explained below, some rights may be exercised independently. To exercise certain rights, you may be required to submit a request by contacting our privacy team at: legal@optival.com
When contacting us, please specify which right you wish to exercise and provide sufficient information to allow us to verify your identity and locate or associate the relevant Personal Data with you. Please note that we may request additional information, as permitted by applicable law, to verify your identity before responding to your request.
Right to be Informed
You have the right to be provided with information regarding our Personal Data collection and privacy practices. All is detailed under this Privacy Policy, however, if you have any questions or you require for additional information, you may exercise your right by contacting us, as set forth above.
Access Rights
You have the right to confirm whether we collect Personal Data about you, as well as to know which Personal Data we specifically hold about you and receive a copy of such or access it. You may exercise your right by contacting us, as set forth above.
Right to Correction/ Rectification
You have the right to request any incomplete or inaccurate Personal Data is corrected or deleted, taking into account the nature of the processing and the purposes. You may exercise your right by contacting us, as set forth above.
Right to Be Forgotten, Right to Deletion
You have the right to request the erasure of certain Personal Data if specific conditions are satisfied. This right is not absolute. We may reject your request under certain circumstances, including where we must retain the data in order to comply with legal obligations or defend against legal claims, other legitimate interests such as record keeping with regards to our engagements, completing transactions, taking actions reasonably anticipated within the context of our ongoing business relationship with you, detecting security incidents, or exercising another right provided for by law. You may exercise your right by contacting us, as set forth above.
Right to Restrict Processing
You may be entitled to limit the purposes for which we process your Personal Data if one of the following conditions are satisfied: where the accuracy of the Personal Data is contested by you, for a period enabling us to verify the accuracy of the Personal Data; where the processing is unlawful and you oppose the erasure of Personal Data and request the restriction instead; where we no longer need the Personal Data for the purposes of the processing, but we are required by you to retain it for the establishment, exercise or defense of legal claims; where you objected to processing (as detailed below) pending the verification whether our legitimate grounds override your request. You may exercise your right by contacting us, as set forth above.
Right to Data Portability
You have the right to receive a copy of your Personal Data in a portable format and, to the extent technically feasible, readily usable format that allows you to transmit the Personal Data to another entity without hindrance. We will select the format in which we provide your copy. You may exercise your right by contacting us, as set forth above.
Right to Withdraw Consent;
Right to Opt-Out / Opt-Out of Sale
Right to Withdraw Consent: when we collect and process your Personal Data based on your consent, you have the right to withdraw such consent at any time.
Right to Opt-Out / Opt-Out of Sale or Sharing: you have the right to opt out of (i) certain marketing communications, where applicable, by unsubscribing through the message received, and (ii) the “sale” or “sharing” of Personal Data (including for targeted advertising), as further explained under Section 10 of this Privacy Policy – “Sale” of Personal Data. Where required by applicable law, you may also have the right to opt out of targeted advertising and/or certain profiling. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you without providing any rights required under applicable law.
Right To Appeal or Lodge Complaint
If we decline to take action on your request, we will inform you as required under applicable laws. The notification will include a justification for declining to take action.
12. ELIGIBILITY AND CHILDREN PRIVACY
The Services are not intended for use by children (a “child” means an individual under the age defined by applicable law), and we do not knowingly collect or otherwise process Personal Data relating to children. If we become aware that we have collected Personal Data from a child, we will take reasonable steps to delete or de-identify such information as soon as reasonably practicable.
13. LINKS TO OTHER SITES
Our websites and Services may include links to third-party websites, including Business Partners’ websites. If you click on a third-party link or enable a third-party connection, the relevant third party may collect or receive information about you, including through cookies or similar technologies. We do not control, and are not responsible for, the privacy practices of these third parties, and their practices are governed by their own privacy policies. If you wish to exercise your rights in relation to information processed by a Business Partner, you should contact that Business Partner directly.