Legal Terms & Conditions

Resolver Inc. Privacy Statement

Version: 5.0 (archived versions) Last updated: October 19, 2026

1. Resolver Values Your Privacy

This Privacy Statement (the “Statement”) governs all aspects of how RESOLVER INC. and its sub-contractor affiliates (collectively “Resolver”, “We”, “Us” or “Our”), collect, use, maintain, disclose and process Personal Data (as defined below) from worldwide prospects, customers, suppliers, business partners and other individuals (“Users“, “You” or “Your” and similar words). This Statement covers both Personal Data which We process on behalf of the customers using Our Software (as a “processor”), and Personal Data which We collect and process for Our own purposes (as a “controller”).

By accessing a Resolver website, registering for events, downloading content, obtaining information from Us, communicating with Us via email, in person or through Our websites (or service providers’ websites on our behalf) or information volunteered by You, and/or by using our Software, You agree to the terms of this Statement.

We are committed to protecting the confidentiality, integrity and security of all Personal Data entrusted to Us, and complying with the applicable data privacy and security requirements in the countries in which We operate, including, but not limited to, Canada’s Personal Information and Privacy Protection Act (PIPEDA) and the EU’s General Data Protection Regulation (GDPR).

Resolver has prepared this Statement to inform You of Our policy and practices concerning the collection, use, disclosure and processing of Personal Data.

If you are a resident of the State of California, please see our CCPA Privacy Policy to learn about your rights under the California Consumer Privacy Act.

If you are a resident of the Commonwealth of Virginia, please see our Virginia Privacy Notice to learn about your rights under the Virginia Consumer Data Protection Act.

2. Personal Data that We collect

We, from time-to-time, may collect information relating to an identified or identifiable natural person (“data subject”) who can be identified, directly or indirectly by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (“Personal Data”). Note that, as a provider of B2B Software to be used for business purposes, We do not expect that Personal Data of children will be involved in any processing activity.

Resolver collects the following categories of Personal Data:

Contact data: We may collect account information about data subjects such as name and contact details (email, phone number, etc.) in order to communicate and facilitate the provision of our services with our customers or potential customers. For example, contact details of individuals who work for or on behalf of the customers, in order to carry out the customer’s engagements with Resolver.

Services data: Personal Data may be provided to Us by Our customers to the extent required to perform services or deliver Our Software to them. For example, We may collect information about Your computer, such as Your IP address; the type of Internet browser You are using; the type of computer operating system You are using; the domain name of the websites from which You linked to Our websites; User authentication data; User-generated information; and usage logs and statistics in relation to Your use of Our Software. This information will only be collected for planning, forecasting and/or evaluation purposes.

Marketing information: We may collect information to respond to Your inquiries regarding our products and services, or to provide You with information, reports, or updates.

Website visitor information: When You visit Our website, We may collect information about Your visit such as your IP address and the pages You visited and when You use our services. We may collect information on how You use those services.

Privacy rights and complaint information: If You contact Us to exercise Your privacy rights, make a privacy enquiry, or make a data protection complaint, We may collect information needed to identify You, understand and manage Your request or complaint, correspond with You, investigate the matter, record the outcome, and to document any action taken.

This includes Personal Data:

  • that You provide to Us or one of our service providers about You (in which case, We are a data controller) or about other Users, where You are permitted to do so pursuant to applicable law (in which case, We are a data processor);
  • collected from third party sources, such as someone authorized by You to act on Your behalf, third-party services that You use or interact with, or from other sources as and when permitted by applicable laws, such as public sources, joint marketing partners, and social media platforms; or
  • collected electronically about how You use a Resolver website, or Our Software, via “cookies”, or through Your use of any of Our Software. Please see the Resolver Cookies Policy on Our website for additional information, at www.resolver.com/legal.

As a provider of Software to Our customers who submit data to Us for processing, We would process their data solely on the instructions of that customer, who determines the purpose and means of processing and exercise overall control of the data (for example, the hosting of client data on our web-based due diligence portal). Therefore, if You have questions, or wish to exercise Your rights relating to your personal data, You may need to contact the customer (and controller) on whose behalf the processing of Your data is carried out. If We receive a request from You relating to data controlled by a customer, We will pass Your request on to the appropriate customer (and controller of Your data) where permitted by applicable privacy law.

You may have received a unique client ID and created a password in order to use Our Software. You are requested not to divulge Your client ID or password to anyone other than Your own personnel or Our personnel and then only for the purpose of permitting Our personnel to provide services to You.

Please note that this Privacy Statement does not cover aggregated and/or anonymized data from which the identity of data subject cannot be determined. We retain the right to use any aggregated/anonymized data in any way that We determine appropriate.

We have no control over the content of third party websites that may be identified on Our websites or, if applicable, accessed through hyperlinks.

3. Legal Basis for Processing

Where applicable data protection laws require a legal basis for processing personal data, we process personal data on one or more of the following grounds:

  • Performance of a Contract. We process Personal Data where necessary to provide our Software and services, administer customer accounts, authenticate users, process transactions, provide customer support, and otherwise fulfill our contractual obligations.
  • Legitimate Interests. We process Personal Data where necessary for our legitimate business interests, provided that those interests are not overridden by an individual’s rights and freedoms. These interests may include operating and improving our Software and services, maintaining the security and integrity of our systems, preventing fraud and misuse, conducting business analytics, developing new products and features, enforcing our agreements, and managing our business operations.
  • Consent. We process Personal Data based on an individual’s consent where required by law or where We choose to rely on consent. Examples may include certain marketing communications, cookie and tracking technologies, and other specific processing activities. Individuals may withdraw their consent at any time, although doing so will not affect the lawfulness of processing carried out before consent was withdrawn.
  • Compliance with Legal Obligations. We process Personal Data where necessary to comply with applicable laws, regulations, court orders, lawful governmental requests, tax and accounting requirements, and other legal obligations.
  • Protection of Vital Interests. In limited circumstances, we may process personal data where necessary to protect the vital interests of an individual or another natural person, such as in situations involving serious threats to health or safety.
  • Public Interest or Official Authority. Where permitted or required by law, We may process Personal Data for reasons of substantial public interest or where processing is carried out pursuant to a legal mandate, regulatory obligation, or official authority.
  • Product Improvement and Artificial Intelligence. Where permitted by applicable law and Our agreements with customers, We may process Personal Data and service-related information to improve, secure, monitor, and develop our products and services, including through analytics, testing, machine learning, and artificial intelligence technologies. Where required by law, We will rely on an appropriate legal basis, such as legitimate interests or consent for such processing. We do not use Customer Content to train generalized artificial intelligence models except as expressly described in our agreements, product documentation, or with the customer’s authorization.

The legal basis applicable to a particular processing activity may vary depending on the nature of the services, the relationship between Us and the data subject, and the requirements of applicable law. Note also that, where We process Personal Data on behalf of our customers (as a processor), the customer is responsible for identifying and communicating to You the appropriate legal basis for such collection and processing.

When You provide Personal Data to Us, that means that You agree and consent that We may collect, use, disclose, update, and process Personal Data that You provide in accordance with this Statement. If You do not agree with these terms, You are requested not to provide any Personal Data to Us. Certain services can only be offered if You provide Personal Data to Us and/or You may not be able to access any of Our Software. Consequently, if You choose not to provide Us with any required Personal Data, We may not be able to offer You certain services or You may not be able to access any of Our Software.

In the event that we have obtained Your Personal Data from a third-party source, then we will obtain your consent prior to using that Personal Data for communications with You as required by applicable laws, within a reasonable period after obtaining that data or at the time of the first communication with You.

Where We rely on your consent, you have the right to withdraw consent to Our processing your Personal Data. This will not affect the processing already carried out with Your consent. You may manage Your receipt of marketing and non-transactional communications by: (i) clicking on the “unsubscribe” link in marketing emails; or (ii) contacting Us, as set forth below in this Statement.

4. How We use Personal Data

We collect Personal Data to offer and administer our services and products. We may, from time-to-time, use Personal Data that We collect from You (including through Our Software), or that You provide to Us, to:

  • contact You directly regarding Our products, services and events;
  • provide You with proper, authenticated access to and use of Our Software;
  • help You use Our Software;
  • contact You to provide customer service support;
  • research the effectiveness of Our corporate websites and Our marketing, advertising and sales efforts;
  • keeping You informed and up-to-date with Our products and services and events;
  • sell or market Our products and services to You;
  • comply with obligations provided by laws and current regulations, including to prevent fraud or online harms; and
  • for security purposes, when your data can help us to protect Resolver and its third parties against security breaches, and to prevent violation of Our applicable agreements.

If We use Your Personal Data for the marketing purposes described above:

  • If You are located in the EU, UK, Australia, Japan, or Singapore, We will only send You marketing communications and updates about Our products, services and events with Your prior consent or based on Our and Your legitimate interests where permitted. In either case, You can withdraw Your consent or opt-out or receiving such communications at any time.
  • If You are located elsewhere than in the EU, UK, Australia, Japan, or Singapore, You may opt-out of receiving marketing communications and updates at any time.

Whenever We process your Personal Data for our legitimate interests, We make sure to consider and balance any potential impact on You and Your rights under data protection laws. Our legitimate business interests do not automatically override Your interests – We will not use Your personal data for activities where Our interests are overridden by the impact on You (unless We have your consent or are otherwise required or permitted to by law). You have the right to object to this processing if You wish.

Our use of Personal Data is limited to these purposes. Unless permitted by law, we require that no Personal Data about a User is collected, without an appropriate entity first obtaining the consent of the data subject to the collection, use, sharing or processing of that information.

5. Sharing Personal Data

We will use Personal Data collected from You and Users for internal purposes only. We may share Personal Data with organizations which perform services on Our behalf (“Service Providers”). Such Service Providers may include cloud hosting providers, payment processors, providers of back-end analytics, and Our affiliates, as sub-processors and authorized resellers of Our products and services. We will take reasonable and appropriate steps to ensure that Personal Data provided to Service Providers (including, using standard contractual clauses, as appropriate) is minimized, and processed only for the purposes of providing their services to Us, under Our instruction and in a manner consistent with the relevant principles articulated in this Statement.

Please note that there are circumstances where the use or disclosure of Personal Data may be justified or permitted by law, or where We are obliged to share information without consent. Such circumstances may include: where We believe in good faith that the law requires it; where We believe, upon reasonable grounds, that it is necessary to protect the rights, privacy, safety or property of an identifiable person or group; where it is necessary to protect Our rights or property, and to collect any money owing; or if We are acquired by or merged with another entity (in which case We will require such entity to assume Our obligations under this Statement).

Where obliged or permitted to share information without consent, We will not share more information than is required. We do not sell any Personal Data that We have obtained.

6. International Transfers

Resolver Inc., a Canadian legal entity domiciled in Toronto, Canada, is the primary legal entity that provides goods and services (including Software). With respect to Personal Data originating from a member state of the European Economic Area (“EEA”) or the United Kingdom (the “UK“) which may be transferred to Canada, You acknowledge that the European Commission, pursuant to decision 2002/2/EC has declared Canada’s PIPEDA, which applies to Us, provides an adequate level of protection for Personal Data transferred from the European Community.

Whenever Personal Data that originates from the EEA is processed by Us or one of Our affiliates in a country that the European Commission has determined does not offer an adequate level of data protection, We take measures designed to provide the level of data protection required in the EU, including ensuring transfers are governed by the requirements of the Standard Contractual Clauses adopted by the European Commission, or another adequate transfer mechanism. Resolver entities have entered into intragroup transfer agreements based on the Standard Contractual Clauses which allows for the processing and transfer of Personal Data. In addition, Resolver and all of its operating affiliates and subsidiaries based in the United States comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), (collectively the “Data Privacy Framework” or “DPF”) as set forth by the U.S. Department of Commerce.  For more information about the Resolver’s compliance with the DPF, please see: https://www.kroll.com/en/data-privacy-framework-policy. We regularly monitor latest developments about appropriate data transfer mechanisms of EEA data to countries that do not have adequacy status.

7. Maintenance and Security of Personal Data

Personal Data is processed both manually and electronically in accordance with the above-mentioned purposes and in compliance with current regulations. We permit only authorized Resolver employees and Our Service Provider processors to have access to Your information. Such employees and processors are appropriately designated and trained to process data only according to the instructions We provide them.

We retain Personal Data about Users as long as We believe it is necessary to fulfill the purpose for which it was collected, taking into account legitimate business needs to capture and retain such information. Information will also be retained for a period necessary to comply with state, local, federal regulations, or other applicable country-specific regulations and requirements. Currently, We hold Personal Data in North America, Europe and Oceania. Personal Data maintained on Our systems is protected using industry standard security measures. However, We cannot guarantee that the information submitted to, maintained on, or transmitted from Our systems will be completely secure and transmission of information over the Internet is susceptible to possible loss, misrouting, interception and misuse.

8. Privacy By Design

We are committed to incorporating privacy and data protection considerations into the design, development, deployment, operation, and maintenance of our Software and services. We seek to implement appropriate technical and organizational measures that are designed to protect personal data and support compliance with applicable privacy and data protection laws.

When designing and enhancing our Services, we consider privacy and security requirements throughout the product lifecycle, including during planning, development, testing, implementation, and ongoing operations. Our objective is to ensure that privacy considerations are integrated into business processes, product features, and technology decisions from the outset rather than being addressed only after deployment. Consistent with this approach, we may implement measures such as:

  • Collecting and processing personal data only to the extent reasonably necessary for identified business and service-related purposes;
  • Applying data minimization, purpose limitation, and retention management practices where appropriate;
  • Maintaining reasonable administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, use, disclosure, alteration, or destruction;
  • Evaluating privacy and data protection risks when introducing new products, features, technologies, vendors, or processing activities;
  • Restricting access to personal data based on business need and job responsibilities;
  • Supporting transparency, accountability, and individual privacy rights through appropriate policies, procedures, and governance practices;
  • Providing privacy and data protection training to relevant personnel; and
  • Periodically reviewing and improving our privacy, security, and governance practices in light of evolving legal, regulatory, technological, and business requirements.

Where appropriate and required by applicable law, We conduct privacy impact assessments, data protection impact assessments, or similar reviews to identify and address privacy risks associated with new or materially changed processing activities.

Where We process Personal Data on behalf of our customers, We also provide tools and capabilities in our Software that may assist customers in managing access controls, retention practices, security settings, data exports, and the exercise of applicable data subject rights. Customers remain responsible for determining whether and how to use such features to meet their own legal obligations

9. Access to Your Personal Data

Depending on the laws of the jurisdiction governing the processing of Your Personal Data, such as Canada’s (PIPEDA), the EU’s GDPR, or the California Consumer Privacy Act (CCPA), and depending on whether We are a controller or processor of Your data for a third-party, You may have certain rights under applicable data protection laws, including:

Access: You may have the right to access personal information that We hold about You.

Rectification: You may have the right to ask Us to correct information which We hold about You if it is inaccurate or not complete.

Erasure: You may request that We erase Your Personal Data. We will keep basic data to identify You and retain it solely for preventing further unwanted processing.

Restrict Processing: You may have the right to ask Us to restrict how We process your data. This means that We are permitted to store the data but not further process it. We would keep just enough data to make sure We respect your request in the future.

Object to processing: Where processing is based on legitimate interests, You may have the right to object to Our processing your Personal Data. We will discontinue processing Your data, unless We can demonstrate compelling legitimate grounds for the processing. We will keep basic data to identify You and retain it solely for preventing further unwanted processing.

Portability: Where processing is based on consent or performance of a contract, You may have the right to data portability. We must allow You to obtain and reuse Your Personal Data for Your own purposes in a safe and secure way without this effecting the usability of your data. This right only applies to personal data that you have provided to Us as the Data Controller.

Complaints: You may also make a data protection complaint about how We handle Your Personal Data by submitting a request using the contact information set forth below, or via a Data Subject Access Request Form sent to Us directly from Our website at: www.resolver.com/legal..

If You submit a Data Subject Access Request to Us, then We will consider Your request under applicable law. Requests to access, correct, or remove Personal Data, to the extent possible, will be handled within thirty (30) days and may be subject to a fee, as permitted by applicable law. To protect Your privacy and security, We may take steps to verify Your identity before complying with the request. If We are a data processor of Your Personal Data on behalf of a customer of Our Software, We will refer your requests to that customer, whose responsibility it will then be to respond to You, or provide Us with appropriate instructions.

You also have the right to complain to a data protection authority about Our processing of Personal Data. For more information, please contact Your local data protection authority.

Subject to legal considerations or certain exemptions, We may not always be able to address Your request. We reserve the right to decline access to Personal Data where the information requested:

  • Would disclose the Personal Data of another data subject or of a deceased data subject;
  • Would disclose business confidential information that may harm Us or the competitive position of a third party;
  • Is subject to solicitor-client or litigation privilege;
  • Could reasonably result in: serious harm to the treatment or recovery of the data subject concerned; serious emotional harm to the data subject or another data subject; or, serious bodily harm to another data subject;
  • May harm or interfere with law enforcement activities and other investigative or regulatory functions of a body authorized by statute to perform such functions;
  • Is not readily retrievable and the burden or cost of providing would be disproportionate to the nature or value of the information; or
  • Does not exist, is not held, or cannot be found, by Us.

Where information will not or cannot be disclosed, the data subject making the request will be provided with the reasons for non-disclosure. Where information will be disclosed, We will endeavor to provide the information in question within a reasonable time and no later than thirty (30) days following the request.

We will not respond to repetitious or vexatious requests for access. In determining whether a request is repetitious or vexatious, We will consider such factors as the frequency with which information is updated, the purpose for which the information is used, and the nature of the information. To guard against fraudulent requests for access, We will require sufficient information to allow confirmation of the identity of the person making the request before granting access or making corrections.

Please note that due to technical constraints and the fact that We back up Our systems, Personal Data may continue to reside in Our systems for up to sixty (60) days after deletion. Individuals, therefore, should not expect that their Personal Data would be completely removed from Our systems in response to an accepted request for deletion.

10. Automated Decision Making

Automated decisions are defined as decisions about individuals which are based solely on the automated processing of data and which produce legal effects that significantly affect the individuals involved.

We do not make automated decisions using Personal Data. If automated decisions are to be made, the affected persons will be given an opportunity to express their views on the automated decision in question, and object to it.

11. Lawful Access

As a provider of hosted software and cloud-based services, We generally process Personal Data only under the instructions of our customers. Except where legally prohibited, We seek to maintain transparency regarding governmental access requests and support our customers’ ability to understand and respond to requests affecting their data.

We do not voluntarily provide hosted customer data to governmental authorities for surveillance, intelligence-gathering, law enforcement, or regulatory purposes, except where required by applicable law or where necessary to prevent imminent harm, fraud, abuse, or unlawful activity. Any such disclosure will be governed by the legal and procedural safeguards applicable to the circumstances of the request.

12. Special Products

Tipline Services: We make available to our customers certain web-based and/or telephony services, which allow their employees and/or members of the public (“Callers”) to submit communications to that company via a tip-line. Such communications may contain Personal Data, and may be made by a Caller on either an anonymous or self-identifying basis. In accordance with the potentially confidential nature of the tip-line services, any information about, or which could reasonably be expected to reveal, a Caller’s identity, including IP address, personal characteristics, or location data, will be handled as confidentially as reasonably possible under the circumstances and consistent with applicable law and the rights of affected individuals.

There may, however, be circumstances in which such tip-line information must be disclosed. Such circumstances may include: compliance with applicable laws, regulations, court orders, subpoenas, or other lawful governmental requests; cooperation with law enforcement agencies, or similar other authorities having jurisdiction; protection of the rights, property, safety, or security of the organization and its personnel, or other affected individuals; conducting, supporting, or defending legal claims, investigations, disciplinary proceedings, or regulatory matters; or responding to emergency, exigent, or exceptional circumstances involving a risk of serious harm, fraud, misconduct, unlawful activity, or threats to health, safety, or security of others.

13. Amendment of Resolver Practices and this Statement

This statement is in effect and was last revised as of October 19, 2026. We will from time to time review and revise Our privacy practices and this Statement. In the event of any amendment, an appropriate notice will be posted on this site. Statement changes will apply to the information collected from the date of posting of the revised Statement to this site as well as to existing information held by Us.

14. Contact information

If You have any questions about the privacy practices of Resolver, or You wish to access Your Personal Data, please contact:

Outside of the EEA:

Privacy Officer
Resolver Inc.
804-111 Peter Street
Toronto, ON M5V 2H1
Canada
Email: resolver.privacy@kroll.com

Inside the EEA:

GDPR Representative
Resolver Inc.
c/o Kroll Advisory (Ireland) Limited
24 St. Stephen’s Green
Dublin, Ireland D02 EK82
Email: kroll.privacy@kroll.com

For data subjects located in the EU: If We are not able to satisfactorily resolve Your questions, concerns, or complaints, or if You believe that the processing of Your Personal Data infringes on Your rights under applicable data protection laws, You have the right, without prejudice to any other administrative or judicial remedies, to lodge a complaint with a supervisory authority, in particular, in the Member State of Your habitual residence, place of work or place of the alleged infringement.

For data subjects located in the UK: If We are not able to satisfactorily resolve Your data protection complaint, or if You believe that Our processing of Your Personal Data infringes applicable data protection law, You have the right to complain to the UK Information Commissioner’s Office.