Privacy Policy

1. Introduction

1.1.Who we are. This Privacy Policy explains how InvestConnect Global Limited (“we”, “us”, “our” or “InvestConnect”) collects, uses, shares and protects personal data when you visit our website or use the InvestConnect platform (the “Platform”). InvestConnect is an information and discovery platform that connects verified investment professionals acting on behalf of institutions with UK infrastructure, property and real-asset opportunities. We do not arrange, advise on, manage or execute investments.

1.2.We are committed to protecting your personal data in compliance with the United Kingdom General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (“PECR”) (in each case as amended from time to time, including by the Data (Use and Access) Act 2025) and all other applicable laws and regulations of the United Kingdom.

1.3.Data controller. InvestConnect Global Limited is the controller responsible for your personal data. We are a company registered in England and Wales (company number 17263903) with our registered office at 16 Great Queen Street, Covent Garden, London WC2B 5AH. Any questions about this Privacy Policy or your personal data should be sent to us at privacy@investconnect.com or by post to the registered office address above.

1.4.You have the right to make a complaint at any time to the Information Commissioner’s Office (the ICO), the UK supervisory authority for data protection (www.ico.org.uk). We would, however, welcome the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance. If you make a complaint to us about our use of your personal data, we will acknowledge your complaint within 30 days of receiving it and will respond to it without undue delay. You can make a complaint by contacting us at privacy@investconnect.com.

2. The personal data we collect

2.1.“Personal data” means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). The Platform is intended for investment professionals acting on behalf of institutions, and for opportunity partners. Depending on how you interact with us, we may collect the following categories of personal data:

2.1.1.Identity data — first name, last name, job title or role, and the organisation you represent;

2.1.2.Contact data — work email address, telephone number and business address;

2.1.3.Account and authentication data — information used to create and secure your account and to sign you in, including passwordless (magic-link) authentication and session data;

2.1.4.Platform-activity and usage data — information about how you use the Platform, including opportunities viewed, searches and filters applied, meetings or introductions requested or booked, and content you submit or download;

2.1.5.Opportunity data — where you act for an opportunity partner, information you submit about an opportunity, which may include the names and contact details of relevant individuals at your organisation;

2.1.6.Technical data — internet protocol (IP) address, browser type and version, time-zone setting and location, operating system and platform, and other technology on the devices you use to access the Platform;

2.1.7.Communications and marketing data — your preferences in receiving communications from us, and the content of correspondence and support requests.

2.2.How we collect your personal data. We collect personal data: directly from you, when you register for an account, submit an opportunity, request an introduction or meeting, update your preferences or correspond with us; automatically, as you interact with the Platform, through server logs, essential cookies and similar technologies (see the Cookies section below); and from third parties or publicly available sources, such as your organisation or public registers, where we verify investor or opportunity-partner status.

2.3.If you fail to provide personal data. Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform that contract — for example, we may be unable to register you, verify your status or provide you with access to the Platform. We will notify you if this is the case at the time.

2.4.Aggregated data. We also collect, use and share aggregated data, such as the total number of opportunity views or meetings booked. Aggregated data may be derived from your personal data but is not personal data in law, as it does not directly or indirectly reveal your identity. If we combine aggregated data with your personal data so that it can identify you, we treat the combined data as personal data.

2.5.Special category data. We do not collect any special categories of personal data (such as data revealing race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, or genetic or biometric data), and we do not collect information about criminal convictions or offences. The Platform is not directed at children and we do not knowingly collect data relating to anyone under 18.

3. How and why we use your personal data

3.1.We will only use your personal data when the law allows us to. Most commonly, we rely on the following lawful bases: performance of a contract with you; our legitimate interests in operating, securing and improving the Platform (provided these are not overridden by your interests and rights); compliance with a legal obligation; and, where required, your consent. The table below sets out the main purposes for which we use your personal data and the lawful basis we rely on for each.

3.2.Where we rely on legitimate interests, we have carried out a balancing assessment to ensure our interests do not override your rights. You may ask us for more information about this assessment.

3.3.Change of purpose. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible reason. If we need to use your personal data for an unrelated purpose, we will notify you and explain the lawful basis that allows us to do so. We may process your personal data without your knowledge or consent where this is required or permitted by law.

3.4.Automated decision-making and profiling. We do not use your personal data to make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or that similarly significantly affect you. If this changes, we will update this Privacy Policy and tell you about your rights in relation to such decisions.

4. Marketing and your communication preferences

4.1.We will only send you marketing communications where you have asked us to or otherwise consented. You can ask us to stop sending you marketing communications at any time by using the unsubscribe link in any marketing email or by contacting us at privacy@investconnect.com. Opting out of marketing will not affect service communications that are necessary to provide the Platform to you, or other personal data we retain arising from your use of the Platform.

5. Cookies

5.1.A cookie is a small file placed on your device when you visit a website. References to cookies in this section include similar technologies that store information on your device or access information stored on your device. The Platform uses strictly necessary (essential) cookies — for example, to keep you signed in, maintain your session and keep the Platform secure. Essential cookies do not require your consent under PECR, as they are necessary to provide the service you have requested. Your consent will not be sought to place these cookies, but it is still important that you are aware of them. The strictly necessary cookies we use are:

5.2.Analytics. The Platform also uses analytics services provided by Google Analytics. Analytics services refers to a set of tools used to collect and analyse usage information, enabling us to better understand how the Platform is used and, in turn, to improve it and the services offered through it. Where possible, this information is used in a way that does not directly identify individual visitors. The analytics service(s) we use set the following cookies:

5.3.Consent. Before any non-essential cookies (including analytics cookies) are placed on your device, you will be shown a cookie banner requesting your consent to set those cookies. You do not have to give your consent, and refusing it will not affect your ability to use the Platform, although we will then be less able to understand and improve how the Platform is used. You can withdraw your consent at any time using the cookie settings link on the Platform or by contacting us at privacy@investconnect.com.

5.4.Browser controls. In addition to the controls we provide, you can choose to enable or disable cookies in your internet browser. Most browsers also allow you to choose whether to disable all cookies or only third-party cookies, and to delete cookies stored on your device at any time. Please note that blocking or deleting essential cookies may affect how the Platform functions.

6. How we share your personal data

6.1.We do not sell your personal data. We may share your personal data in the following circumstances:

6.1.1.Service providers. We use reputable third-party service providers (for example, for cloud hosting, database storage, authentication and email delivery) who process personal data on our behalf as processors, under written contracts that require them to keep it secure and to use it only on our instructions. A list of our current service providers is available on request at privacy@investconnect.com;

6.1.2.Within the Platform. Where you request an introduction or meeting, or submit an opportunity, we may share relevant business-contact details with the counterparty to facilitate that interaction. We will not publicly name you or your organisation without an appropriate lawful basis or, where required, your consent;

6.1.3.Legal and regulatory. We may share personal data where required for legal or regulatory reasons, or to establish, exercise or defend legal claims, or to enforce our terms or this Privacy Policy;

6.1.4.Professional advisers and insurers. We may share personal data with our professional advisers (including lawyers, accountants and auditors), and with our insurers and insurance brokers, where necessary for them to provide their services to us; and

6.1.5.Business transfers. If we are involved in a merger, acquisition, financing or transfer of all or part of our business or assets, we may share personal data with the parties to that transaction, subject to appropriate confidentiality protections.

6.2.Third-party links. The Platform may contain links to third-party websites, plug-ins and applications. We do not control those third parties and are not responsible for their privacy practices. When you leave the Platform, we encourage you to read the privacy policy of each website you visit.

7. International transfers

7.1.We aim to store and process personal data within the United Kingdom or the European Economic Area (EEA). Some of our service providers may, however, process personal data outside the UK or EEA. Where personal data is transferred outside the UK, we ensure a similar degree of protection by relying on one of the following safeguards: a UK adequacy decision in respect of the destination country; the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission’s standard contractual clauses; or another lawful transfer mechanism recognised under the UK GDPR, supported where appropriate by a transfer risk assessment. In particular, analytics data collected through Google Analytics is processed by Google LLC in the United States. Transfers to Google LLC are made under the UK Extension to the EU–U.S. Data Privacy Framework (the “UK–US Data Bridge”), which the UK Government has recognised as providing adequate protection, or, where applicable, under the UK Addendum to the European Commission’s standard contractual clauses.

8. How we keep your personal data secure

8.1.We implement appropriate technical and organisational measures, having regard to recognised information-security principles and guidance, to protect your personal data against unauthorised access, loss, alteration or disclosure. These measures include encryption of personal data in transit (TLS 1.2 or higher) and at rest (AES-256); passwordless authentication and role-based access controls that limit data access to authorised personnel on a least-privilege basis; hosting with infrastructure and service providers that maintain recognised security standards; regular security patching; access logging; and encrypted database backups.

8.2.Access to personal data is limited to personnel who need it and who are bound by obligations of confidentiality. Where we engage service providers to store or process personal data, we do so under contracts that require appropriate security and do not relinquish control of your personal data. No transmission of data over the internet can be guaranteed to be completely secure, and we cannot guarantee the security of personal data while it is in transit to us; once we have received your personal data, we will protect it in accordance with the measures described in this section. If you believe your interaction with us is no longer secure, please contact us at privacy@investconnect.com.

8.3.Data breaches. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO, and where the breach is likely to result in a high risk to you, we will notify you, in each case in accordance with our legal obligations.

9. How long we keep your personal data

9.1.We will retain your personal data only for as long as reasonably necessary to fulfil the purposes for which we collected it, including to satisfy any legal, regulatory, accounting or reporting requirements. We may retain personal data for a longer period in the event of a complaint, or where we reasonably believe there is a prospect of litigation. When personal data is no longer required, we will delete or anonymise it, save for copies we are required to retain by law or that are held in the ordinary course as part of secure, automated back-up systems that cycle out over time.

9.2.As a guide, we expect to retain: identity, contact, account and platform-activity data for the duration of your account and for six years after it is closed; opportunity data for the duration of the relevant listing and six years thereafter; technical and server-log data for 12 months; records of your marketing consents and preferences for as long as we send you marketing and two years thereafter; and correspondence and support requests for two years from resolution. We keep these periods under review and will update this Privacy Policy if they change materially.

10. Your legal rights

10.1.Under data protection law you have the following rights in relation to your personal data: the right to be informed; the right of access; the right to rectification; the right to erasure; the right to restrict processing; the right to object (including to direct marketing, and to processing based on legitimate interests); the right to withdraw consent at any time where we rely on consent (for example, for marketing or non-essential cookies), without affecting the lawfulness of any processing carried out before you withdraw it; the right to data portability; and rights in relation to automated decision-making. Some of these rights apply only in certain circumstances. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

10.2.You may close your account at any time. Doing so will remove your account from the active Platform; we will then delete or anonymise the associated personal data in accordance with the retention section above, subject to any data we are required to keep by law or that remains in secure automated back-ups.

10.3.You will not usually have to pay a fee to exercise your rights. We may need to request specific information to confirm your identity before responding, as a security measure. We aim to respond to all legitimate requests within one month; occasionally it may take longer if the request is complex or you have made a number of requests. If your request is vexatious or excessive, we may refuse it or charge a reasonable fee. To exercise any of your rights, please contact us at privacy@investconnect.com.

11. Changes to this Privacy Policy

11.1.We keep this Privacy Policy under review and will post any updates on this page, updating the date at the top. Where changes are significant, we will take reasonable steps to bring them to your attention. Your continued use of the Platform after we post an updated Privacy Policy constitutes your acknowledgement of the updated policy, to the extent permitted by law; where the law requires your consent for a particular change, we will obtain it.

12. Interpretation and contact

12.1.In this Privacy Policy, “including” means “including but not limited to”, and the examples given are not intended to limit the term they illustrate. Any email address set out in this policy may be used solely for the purpose for which it is provided.

12.2.If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at privacy@investconnect.com or by post to InvestConnect Global Limited, 16 Great Queen Street, Covent Garden, London WC2B 5AH.