Privacy Policy

Forest Hills Ventures (“Forest Hills Ventures”, “we”, “us” or “our”) respects the privacy of individuals whose personal data we process. This Privacy Policy explains how we collect, use, store, disclose and protect personal data through:

• our public website;
• restricted, invitation-only customer portals and digital services;
• business communications and enquiries; and
• services delivered to customers under written agreements.

Our customer portals are private systems. Public self-registration is not available. Access is provided only to authorised internal users and selected customers.

1. Scope and our role

Depending on the context, Forest Hills Ventures may act as:

• a data fiduciary or controller when we determine why and how personal data is processed, such as website enquiries, account administration, security monitoring and direct business communications; or
• a processor or service provider when we process personal data, files, images or business records on behalf of a customer under that customer’s instructions.

Where a customer controls the data submitted to a restricted service, the customer remains responsible for ensuring that it has the necessary authority, notices and lawful basis to provide that data to us.

2. Personal data we may collect

Public website and enquiries

We may collect:

• name;
• business name and role;
• email address and telephone number;
• country or location;
• the contents of an enquiry or message;
• technical information such as IP address, browser type, device information, request path, date and time; and
• records of our correspondence.

Restricted accounts and access administration

For authorised users, we may process:

• name, business email and organisation;
• account status, assigned role, domain or organisation membership and permissions;
• authentication and account-recovery information;
• multi-factor authentication status and related security records;
• session, login, logout and failed-access records;
• invitation, activation, suspension and access-revocation records; and
• audit logs recording relevant account and administrative activity.

Passwords are not stored in readable form. Security-sensitive credentials and secrets must be handled using the safeguards implemented in the platform.

Customer content and service data

Depending on the authorised service used, we may process:

• product and jewellery images;
• catalogues, artwork, flyers, banners, social-media content, videos and advertising assets;
• logos, brand files and product information;
• quotation inputs and outputs;
• instructions, comments, approvals and workflow history;
• filenames, metadata and storage references;
• AI-assisted image-processing inputs, outputs and processing records; and
• other business information submitted by or for a customer.

Restricted services may contain confidential commercial information. They are not public repositories.

3. How we obtain personal data

We may obtain personal data:

• directly from you;
• from your employer, customer organisation or an authorised administrator;
• through an invitation or access-approval workflow;
• when you upload, create, review or download content;
• automatically through security, server and application logs;
• through service providers acting on our behalf; or
• from a customer that has engaged us to perform services.

4. Why we process personal data

We may process personal data to:

• respond to enquiries and communicate about our services;
• evaluate and establish a business relationship;
• create, verify, administer and secure restricted accounts;
• deliver services requested under a contract or written instruction;
• store, organise, process and return authorised customer content;
• operate approval, quotation, creative and image-processing workflows;
• provide support and investigate technical issues;
• maintain audit trails and enforce access permissions;
• detect, prevent and investigate fraud, abuse, malware, unauthorised access and security incidents;
• meet accounting, tax, legal, regulatory and record-keeping obligations;
• protect our rights, customers, users, systems and property; and
• improve reliability, accessibility and performance using appropriately limited operational information.

We do not sell personal data. We do not use customer uploads or restricted customer content for unrelated advertising.

5. AI-assisted processing

Selected authorised users may use AI-assisted jewellery image-processing functionality.

When such functionality is used:

• uploaded images and instructions may be transmitted to infrastructure used to perform the requested processing;
• generated or edited images may be stored temporarily or within the authorised customer workspace, depending on the implemented workflow;
• processing records may be retained for security, troubleshooting, usage control and service administration; and
• outputs may contain inaccuracies and must be reviewed by an authorised person before commercial, manufacturing or publication use.

Customer images and generated results will not be used to train a general-purpose model unless this is separately agreed in writing with the relevant customer.

6. Lawful processing and consent

We process personal data where permitted by applicable law, including where processing is necessary:

• to take steps requested by an individual or organisation;
• to perform a contract or provide an authorised service;
• to comply with law;
• for legitimate business, security and operational purposes that do not override applicable rights; or
• on the basis of valid consent where consent is required.

Where consent is relied upon, it may be withdrawn in the manner communicated at the time of collection, subject to processing already lawfully completed and records we must retain.

7. Disclosure and service providers

We may disclose personal data only as reasonably necessary to:

• authorised Forest Hills Ventures personnel and affiliated offices;
• the customer organisation responsible for the relevant account or workspace;
• hosting, storage, email, security, monitoring, authentication, communication and technology providers;
• professional advisers, auditors and insurers;
• regulators, courts, law-enforcement authorities or other persons where required by law; or
• a successor in connection with a lawful merger, restructuring or transfer of business.

Service providers must be engaged for defined purposes and given access only to the information reasonably required for their work.

We do not disclose restricted customer content to other customers.

8. International processing

Our customers, authorised users, offices and service providers may be located in different countries. As a result, personal data or customer content may be accessed or processed outside the individual’s country.

Where required, we use contractual, organisational and technical safeguards appropriate to the transfer and the nature of the information. A customer agreement may specify additional location or processing restrictions.

9. Retention

We retain information only for as long as reasonably necessary for the purpose for which it was collected, including to provide services, maintain security and audit records, resolve disputes and comply with legal, tax, accounting and contractual obligations.

Retention periods may differ by category:

• enquiry records are retained for a reasonable business follow-up period;
• active account records are retained while access remains authorised;
• security and audit logs are retained according to the implemented security policy;
• customer content is retained according to the applicable agreement, workspace settings and operational backup cycle; and
• records required by law are retained for the required period.

After the applicable period, information is deleted, anonymised or placed beyond routine use, subject to secure backups and legal holds.

10. Security

We use administrative, technical and organisational safeguards designed for the sensitivity of the information processed. These may include:

• invitation-only account creation;
• role- and permission-based access;
• multi-factor authentication;
• secure session management;
• password hashing;
• encryption for appropriate data in transit and at rest;
• audit logging;
• access revocation and account suspension;
• environment and secret separation;
• monitoring, backups and recovery controls; and
• restricted administrative access.

No internet-connected system can be guaranteed to be completely secure. Users must protect their credentials, use approved devices and immediately report suspected unauthorised access.

11. Security incidents

We investigate suspected personal-data or security incidents and take reasonable steps to contain, remediate and document them. Where required by applicable law or contract, we will notify affected customers, individuals or authorities within the applicable timeframe.

12. Cookies and similar technologies

The public website may use strictly necessary technologies for security, performance and basic operation. Restricted portals use necessary cookies or comparable storage for authenticated sessions, security controls and user preferences.

We do not use restricted customer content for behavioural advertising.

13. Rights and requests

Subject to applicable law and relevant exemptions, an individual may request:

• information about the personal data we process;
• access to personal data;
• correction or completion of inaccurate data;
• deletion of data that is no longer required;
• withdrawal of consent where consent is the basis of processing; or
• grievance redressal.

Where we process data only on behalf of a customer, we may direct the request to that customer or assist the customer in responding.

We may need to verify identity and authority before completing a request.

14. Responsibilities of authorised users and customers

Authorised users and customers must:

• provide accurate account information;
• upload only content they are authorised to use and process;
• avoid including unnecessary personal or sensitive information;
• keep login credentials and invitations confidential;
• not share restricted links or content with unauthorised persons;
• promptly notify us when access should be changed or removed; and
• comply with applicable privacy, intellectual-property and confidentiality obligations.

15. Children

Our website and restricted business services are not directed to children and are intended for business use. Users must not submit children’s personal data unless specifically authorised by law, contract and the relevant customer.

16. Third-party links

Our website or services may contain links to third-party websites. Their privacy practices are governed by their own policies, and we are not responsible for those external services.

17. Changes to this policy

We may update this Privacy Policy to reflect legal, operational or service changes. The current version and effective date will be published on our website. Material changes may also be communicated to affected authorised users or customers.

18. Contact and grievance redressal

Questions, privacy requests or grievances may be sent to:

Forest Hills Ventures
Email: info@foresthills.ventures

Please include sufficient information to identify the relevant account, organisation or interaction. Do not send passwords, authentication codes or other security secrets by email.