Privacy Policy

Last updated: 1 September 2026

Preamble

This privacy notice is issued by INVEST BUSINESS LTD ("we", "us" or "our"), a company registered in England and Wales under company number 14852760, with its registered office at 207 Regent Street, Suite 8, Third Floor, London, England W1B 3HH, United Kingdom. We are the data controller of the personal information described in this notice.

It describes how and why we collect, store, use and/or share ("process") your personal information when you use our services ("Services"), such as when you: visit our website at https://investbusiness.com or any website of ours that links to this notice; download and use our INVEST BUSINESS mobile application or any other application of ours that links to this notice; or engage with us in other related ways, including sales, marketing or events.

The Services are provided to businesses only. The personal information we process is therefore primarily that of the owners, employees and other representatives acting for Registered Users (legal entities), and of individuals who contact us. This notice is governed by the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 and, where it applies to users in the European Union, the EU General Data Protection Regulation ("GDPR").

Questions or concerns? If you do not agree with our policies and practices, please do not use the Services. For any question, contact us at privacy@investbusiness.com.

Contents

1. Summary of key points
2. What information do we collect?
3. How do we process your information?
4. What legal bases do we rely on?
5. When and with whom do we share your information?
6. International transfers
7. Cookies, analytics and third-party websites
8. How long do we keep your information?
9. How do we keep your information safe?
10. Do we collect information from minors?
11. Your privacy rights
12. Automated processing, matching and AI drafting
13. Do-Not-Track features
14. Updates to this notice
15. How to contact us, and how to review, update or delete your data

1. Summary of key points

• What do we process? Identity, contact, professional, account, payment-related and usage information, depending on how you interact with the Services (Section 2).
• Special-category data? We do not seek to collect it; do not submit it to the platform (Section 2).
• Why? To provide and administer the Services — including matching Requests with counterparts and sending invitations and notifications — to process payments, communicate with you, keep the Services secure and comply with law (Section 3).
• On what basis? Only where we have a valid legal basis: contract, legitimate interests, consent, legal obligation or vital interests (Section 4).
• Who do we share with? Service providers under contract (such as Stripe and hosting/analytics providers), other Registered Users in the context of matching and invitations, and in the other specific situations listed in Section 5. We do not sell personal data.
• Your rights? Access, rectification, erasure, restriction, portability, objection and complaint to a supervisory authority (Section 11). Exercise them at privacy@investbusiness.com.

2. What information do we collect?

Personal information you disclose to us. We collect personal information that you voluntarily provide when you register on the Services, express an interest in us or our Services, participate in activities on the Services (such as publishing Requests, sending invitations or messaging counterparts) or otherwise contact us. Depending on the context, this may include: names; job titles; phone numbers; e-mail addresses; mailing and billing addresses; usernames and passwords; contact preferences; and contact or authentication data.

Verification data. As a business-only platform, we may process information needed to verify a Registered User and its representatives, which may include information about authorisations and licences, company registration details and, where lawfully required for verification, government-issued identifiers and creditworthiness-related information.

Payment data. If you make purchases, payment is processed by Stripe. Payment card data is collected, handled and stored by Stripe, not by us; we receive confirmation of payment and limited billing information. Stripe's privacy notice is available at https://support.stripe.com/topics/privacy.

Special-category (sensitive) data. We do not seek to collect special-category personal information (such as data revealing racial or ethnic origin, health data or biometric data), and you must not submit it to the platform. If such data is exceptionally processed, it will only be with your explicit consent or as otherwise permitted by applicable law.

Application data. If you use our App, we may also process, where you grant permission: push-notification tokens (to send you notifications about your account, invitations and matches — you can turn these off in your device settings) and mobile device data (device ID, model, manufacturer, operating system, version, browser type, IP address, and information about the features of the App you use). This information is needed to maintain the security and operation of the App, for troubleshooting and for internal analytics.

Information automatically collected. When you visit or use the Services we automatically collect log and usage data (IP address, browser and device characteristics, operating system, language preferences, referring URLs, date/time stamps, pages viewed, searches and other actions), device data, and approximate location derived from your IP address. Like many businesses, we also collect information through cookies and similar technologies (Section 7).

Information from other sources. We may obtain limited information from publicly available sources — such as company registers and the official sources from which we aggregate tenders, public funding and facilities announcements — and from business partners, to maintain the accuracy of our records and operate the Services.

All personal information you provide must be true, complete and accurate, and you must notify us of any changes.

3. How do we process your information?

• To provide the Services — including creating and authenticating accounts, publishing Requests, operating the matching engine, transmitting invitations, enabling user-to-user messaging, and delivering the notifications described in Section 12.
• To manage payments — to fulfil and manage orders, subscriptions, credits and verification fees processed through Stripe.
• To respond to inquiries and offer support.
• To send administrative information — details about the Services and changes to our terms and policies.
• To send marketing communications — in accordance with your preferences; you can opt out at any time (Section 11).
• To protect the Services — security monitoring, fraud prevention and enforcement of our Terms of Use.
• To analyse and improve — identifying usage trends and evaluating the effectiveness of our communications.
• To comply with legal obligations — and to establish, exercise or defend legal claims.
• To protect vital interests — where necessary to prevent harm to any person.
• To record and evidence agreements between Registered Users — keeping the record of any Platform Confidentiality Agreement you accept, so that it can be proved and so that claims under it can be established, exercised or defended.

4. What legal bases do we rely on?

• Performance of a contract — most of our processing is necessary to provide the Services under our Terms of Use to the Registered User you represent, or to take steps at your request before entering into that contract.
• Legitimate interests — where reasonably necessary to achieve our legitimate business interests and those interests are not outweighed by your interests and fundamental rights: for example, operating and improving the matching engine, analysing use of the Services, preventing fraud and securing the platform, and sending relevant business communications.
• Consent — for processing where we ask for it (for example, certain cookies or optional marketing). You can withdraw consent at any time (Section 11); withdrawal does not affect the lawfulness of prior processing.
• Legal obligations — for example cooperation with law enforcement or regulators, tax and accounting duties, disclosure in litigation, and compliance with an order of a court, tribunal or competent authority, including an order to disclose the identity of a Registered User behind its pseudonym. We also rely on our legitimate interest in the establishment, exercise and defence of legal claims, our own and those of Registered Users.
• Vital interests — protection of the vital interests of any person.

We are the data controller of the personal information described in this notice. Where we process personal information strictly on behalf and under the instructions of a customer (as a processor), that customer is the controller and its privacy notice applies; direct your questions to it.

5. When and with whom do we share your information?

Service providers. We share data with third-party vendors, service providers, contractors or agents who perform services for us or on our behalf and need access to the information to do that work — under contracts designed to safeguard your personal information: they may only process it on our instructions, may not share it with organisations other than us, and must protect and retain it only as instructed. The categories are: AI drafting providers (Google); cloud computing services; communication and collaboration tools; data analytics services; data storage providers; finance and accounting tools; payment processors (Stripe); performance monitoring tools; product engineering and design tools; testing tools; user account registration and authentication services; and website hosting providers. Section 12 describes separately what is sent to the AI drafting provider, on what basis, and how long that provider may keep it.

Registration and verification details. The details you provide when registering your organisation — such as its legal name and address, national identification number, beneficial-owner disclosure and, for financial institutions, regulator and licence details — are used for internal purposes only: verifying your organisation and administering your account. They are never published on the platform. Counterparts only ever see your pseudonym, together with the information you subsequently choose to share with them, as described below. We never disclose your identity to a counterpart as a feature of the platform, on request, or because you and that counterpart have agreed that we may. The only exception is a disclosure ordered by a court, described in the next paragraph.

Courts, tribunals and competent authorities. Where you and another Registered User have each accepted a Platform Confidentiality Agreement, that agreement records your agreement that we may disclose your organisation's legal name, registered office and the record of your acceptance to a court, tribunal or other competent authority under an order or other lawful process, and to that other Registered User only where an order of such a body requires it. We disclose nothing to the other Registered User without such an order, and we do not disclose beneficial-ownership information, identification-document data or licence documentation unless a court expressly orders it. This is a contractual agreement, not your consent: we rely on Article 6(1)(c) of the UK GDPR where we are under a legal obligation, and otherwise on Article 6(1)(f), the establishment, exercise or defence of legal claims. Nothing in it affects your rights, or the rights of any individual, under data protection law.

Other Registered Users. The platform is built on controlled disclosure: your Requests are presented to matched counterparts under your pseudonym, and when you engage with a counterpart (for example through an invitation, an inquiry or chat), the business and contact information you choose to share is disclosed to that counterpart so it can respond to you. Information you post in areas visible to other users may be viewed by them.

Other situations. We may also share personal information: in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or part of our business (business transfers); with Google Maps Platform APIs (e.g. Maps and Places APIs) where map features are used; with our affiliates, who must honour this notice; and with business partners to offer you certain products, services or promotions. We do not sell personal data.

6. International transfers

The Services are hosted in the United Kingdom. Where personal information of users in the European Union or the European Economic Area is transferred to the United Kingdom, the transfer is covered by the European Commission's adequacy decision for the United Kingdom. Where we or our service providers transfer personal information to other countries, we rely on appropriate safeguards recognised by the UK GDPR and the GDPR — such as adequacy regulations or standard contractual clauses — details of which are available on request at privacy@investbusiness.com.

7. Cookies, analytics and third-party websites

We use cookies and similar tracking technologies (such as web beacons and pixels) to operate and secure the Services, save your preferences and understand how the Services are used, and we permit selected third parties to use such technologies for analytics. Details — including how to refuse cookies — are set out in our Cookies Policy.

Google Analytics. We may share information with Google Analytics to track and analyse use of the Services. To opt out, visit https://tools.google.com/dlpage/gaoptout; for more on Google's practices, see the Google Privacy & Terms page.

Third-party websites. The Services may link to third-party websites, services or applications that are not affiliated with us. Data collected by third parties is not covered by this notice; we are not responsible for their content, privacy or security practices. Review their policies and contact them directly with questions.

8. How long do we keep your information?

We keep personal information only as long as necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law (for example tax or accounting requirements). No purpose in this notice requires us to keep your personal information for longer than the period in which you have an account with us. When there is no ongoing legitimate business need, we delete or anonymise the information — or, where that is not immediately possible (for example, backup archives), we securely store it, isolated from further processing, until deletion is possible. There is one exception. Where you have accepted a Platform Confidentiality Agreement, we keep the record of that acceptance — the version accepted, a hash of that wording, the confirmations recorded, the date and time, the account and the pseudonym recorded at acceptance — together with the link between that pseudonym and your organisation, for the limitation period applicable to a claim under it — six years after that agreement ends, under the Limitation Act 1980 — and in no event for more than twelve years after acceptance. We keep these records even if you close your account or your pseudonym is changed, so that the agreement can be proved and claims under it brought or defended. We rely on the legitimate interest of both Registered Users in the establishment, exercise and defence of legal claims (Article 6(1)(f)), and you may object under Section 11. We keep a record of any disclosure made under such an agreement for the same period.

9. How do we keep your information safe?

We have implemented appropriate technical and organisational security measures designed to protect the personal information we process. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise that hackers, cybercriminals or other unauthorised third parties will not be able to defeat our security. Transmission of personal information to and from the Services is at your own risk; access the Services only within a secure environment.

10. Do we collect information from minors?

The Services are for business users aged 18 or over. We do not knowingly collect data from, or market to, anyone under 18. If we learn that personal information of a person under 18 has been collected, we will deactivate the account concerned and take reasonable measures to delete the data promptly. If you become aware of any such data, contact us at privacy@investbusiness.com.

11. Your privacy rights

Under the UK GDPR and, where applicable, the GDPR, you have the right to: (i) request access to and obtain a copy of your personal information; (ii) request rectification or erasure; (iii) restrict the processing of your personal information; (iv) data portability, where applicable; (v) object to processing based on legitimate interests, including direct marketing; and (vi) not be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. Make a request at privacy@investbusiness.com; we will consider and act on it in accordance with applicable data protection law.

Withdrawing consent. Where processing is based on your consent, you may withdraw it at any time by contacting us or updating your preferences; withdrawal does not affect the lawfulness of processing carried out before it.

Marketing opt-out. You can unsubscribe from marketing at any time via the unsubscribe link in our e-mails or by contacting us; we may still send you non-marketing, service-related messages necessary for the administration of your account.

Account information. You can review or change your account information, or terminate your account, by logging into your account settings or contacting us. On termination, we deactivate or delete your account and information from our active databases and instruct our payment processor to stop any further subscription renewals, so that no further renewal payment is taken; we may retain some information to prevent fraud, troubleshoot problems, assist investigations, enforce our legal terms and/or comply with legal requirements. Where you have accepted a Platform Confidentiality Agreement, we keep the acceptance record and the pseudonym-to-organisation link described in Section 8 after your account is deleted, for the period stated there.

Complaints. If you believe we are unlawfully processing your personal information, you have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EU/EEA, with your Member State data protection authority; if you are in Switzerland, with the Federal Data Protection and Information Commissioner. We would, however, appreciate the chance to address your concerns first at privacy@investbusiness.com.

12. Automated processing, matching and AI drafting

The platform's matching engine automatically compares the structured parameters of Requests (such as request type, sector, location and value ranges) to present Requests to relevant counterparts and to send match and invitation notifications. This automation determines what is shown and notified to whom; it does not produce decisions with legal effects on you or similarly significant effects — whether to send, accept or decline an invitation always remains a human decision of the Registered Users concerned.

AI-assisted drafting. This paragraph is about AI drafting; the paragraph above is about matching. Where you use an AI drafting tool, we send the brief you write and the studio context to our AI provider, which returns a draft to you. We do not send your pseudonym: it stays on our systems and is used only to check the draft that comes back for wording that could identify you. Before it is sent, we automatically remove email addresses, web links and telephone-number patterns from your brief and from the studio context. That is a safeguard rather than a guarantee: it works by matching patterns, so it does not remove your organisation's legal name, and contact details written in an unusual form can pass through it. The filter is deliberately broad and also removes text that is not a contact detail at all: figures written with dots such as 2.500.000, dates such as 15.03.2026, and long reference numbers are replaced too, so a draft can come back missing a figure you gave us. You must therefore not put your organisation's name, its registration or verification details, anyone's contact details — or any special-category data — in a brief. We do not authorise any provider to use briefs or drafts to train its models, and we will not engage one on terms that permit it. A provider may hold them briefly for its own security and abuse monitoring. Where a provider is established outside the United Kingdom, the safeguards described in Section 6 apply. We show the draft to you and we do not publish it. If a draft is adopted, we keep it alongside the wording actually adopted, so that it can later be shown what the tool produced and what your organisation changed. A draft is a suggestion and nothing more: nothing follows from it unless an individual at your organisation decides to adopt it, so it produces no decision about you based solely on automated processing that has legal effects on you or similarly significantly affects you. We rely on our legitimate interests in providing the drafting tool your organisation has contracted for, and in keeping a reliable record of who adopted which wording; we do not rely on your consent for any of this, and you may object under Section 11. We keep an adoption record for as long as we may need it to establish, exercise or defend a legal claim about the adoption, and after the account it was made from is closed. In practice that is the limitation period for such a claim: six years from the adoption, under the Limitation Act 1980, the law of England and Wales that governs our Terms of Use. This is an exception to Section 8, and where you ask us to erase or change an adoption record we will normally refuse on that ground and tell you that this is why.

Screening and drafting tools. We apply automated security and abuse screening to messages and documents exchanged privately between Registered Users, including material covered by a Platform Confidentiality Agreement. We do not use that material for marketing, for ranking, or to train models, and our staff read it only where necessary to investigate a security incident, to respond to a competent authority or to meet a legal obligation. Where you choose to use a drafting tool we make available on the Platform, the text you submit to it is processed by us and by the model provider we engage for that purpose, as our processor and on our instructions, solely to produce the draft you asked for; the result is a draft only, and whether to adopt, change or discard it is always your decision. Neither the screening nor the drafting tools produce decisions with legal effects on you or similarly significant effects.

13. Do-Not-Track features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") setting. No uniform technology standard for recognising and implementing DNT signals has been finalised, and we therefore do not currently respond to DNT browser signals. If a standard we must follow is adopted, we will inform you in a revised version of this notice.

14. Updates to this notice

We may update this notice from time to time to stay compliant with relevant laws. The updated version will be indicated by an updated "Last updated" date at the top. If we make material changes, we will notify you by prominently posting a notice of the changes or by directly sending you a notification. We encourage you to review this notice frequently.

15. How to contact us, and how to review, update or delete your data

If you have questions or comments about this notice, or wish to exercise any of your rights — including requesting access to, correction of, or deletion of your personal information — contact our privacy team by e-mail at privacy@investbusiness.com, by phone at (+44) 20 3290 2022, or by post at:

INVEST BUSINESS LTD
Company No. 14852760
207 Regent Street, Suite 8, Third Floor
London, England W1B 3HH, United Kingdom

These rights may be limited in some circumstances by applicable law. We will respond in accordance with applicable data protection laws.