01
Controller and scope
Investor & Co acts as controller for the personal data of account holders and website visitors, and as processor for the project data and documents that Clients upload to their workspace on behalf of their own organisation and counterparties.
This policy applies to the public website, the client workspace, the institution register and all associated services.
02
Categories of data processed
- Identity and profile data: first name, surname, professional email address, country, sector of activity, function and organisation.
- Account and security data: hashed credentials, session records, sign-in events, IP address and device information.
- Project and financial data: project descriptions, financial statements, models, assumptions, ratios and generated analytical outputs.
- Documents and data-room content: uploaded files, versions, permissions and access events.
- Compliance data: identification documents, beneficial ownership information and screening outcomes where a workflow requires them.
- Commercial data: subscription plan, activation status, invoices and support correspondence.
03
Purposes and lawful bases
- Performance of the contract: creating and operating the account, delivering modelling, scoring, document assembly and capital-raising workflows.
- Legitimate interests: platform security, fraud prevention, service improvement, aggregate and anonymised statistics.
- Legal obligation: know-your-customer and anti-money-laundering record-keeping, accounting and tax retention, responses to lawful requests.
- Consent: optional communications and any processing expressly presented as optional; consent may be withdrawn at any time.
04
No confirmation email at registration
Accounts are created and activated immediately once the registration form is completed and the password confirmed. Investor & Co does not send a verification email as part of account creation. Operational messages relating to a Client's own files may still be sent inside the workspace.
05
Disclosure of data
- To financial institutions and investors selected by the Client when a submission, shortlist or introduction is authorised by that Client.
- To infrastructure, hosting, database and processing providers acting under contract and instruction, limited to what the service requires.
- To regulated partners where a transaction requires local authorisation, and to professional advisers bound by confidentiality.
- To competent authorities where disclosure is required by law or necessary to protect rights, safety or the integrity of the Platform.
- Data is never sold, rented or traded, and workspace content is never shared between Clients.
06
International transfers
The Platform serves users across many jurisdictions and data may be processed outside the Client's country of residence. Where data leaves a jurisdiction that restricts transfers, appropriate safeguards such as standard contractual clauses, adequacy decisions or equivalent contractual protections are applied.
07
Security controls
- Encryption of data in transit and at rest.
- Row-level access control so that each Client reaches only its own workspace records.
- Role-based permissions, segregation of preparation, review and approval, and second-approver requirements for sensitive changes.
- Append-only audit ledgers for document uploads, version changes, permission updates and status transitions.
- Least-privilege administrative access, credential rotation and monitoring of authentication events.
08
Retention
- Account and profile data: for the life of the account and up to twenty-four months after closure, unless a longer period is legally required.
- Project data and documents: for the life of the account, then deleted on request subject to legal holds.
- Compliance records: for the statutory period applicable to anti-money-laundering record-keeping.
- Audit ledgers: retained as immutable records for the period required to evidence governance decisions.
- Billing records: for the period required by accounting and tax law.
09
Rights of data subjects
Subject to applicable law, individuals may request access to their personal data, rectification of inaccurate data, erasure, restriction of processing, portability in a structured format, and may object to processing based on legitimate interests. Where processing rests on consent, consent may be withdrawn without affecting prior lawful processing.
Requests are submitted through the contact page and answered within one month, extendable where a request is complex. Identity verification may be required before a request is actioned.
10
Automated processing
Scoring, readiness assessment and matching involve automated calculation. These outputs are decision-support material presented to human reviewers; they do not produce a binding decision about an individual without human involvement. A Client may request an explanation of the factors that contributed to a score or match.
11
Incidents
Security incidents are investigated, contained and recorded. Where an incident is likely to result in a risk to the rights of individuals, affected Clients and, where required, the competent authority are notified without undue delay, with a description of the incident, its likely consequences and the measures taken.
12
Changes to this policy
This policy is reviewed periodically and updated to reflect changes in the service or in applicable law. Material changes are notified in the workspace before they take effect, and the version and effective date shown at the top of this page are updated accordingly.
To exercise a right, appoint a contact for data protection matters, or request our sub-processor list and transfer safeguards, write to us through the contact page. Every request is logged and answered in writing.
