Privacy policy

1. The data controller

The data controller is GJO&PARTNERS LTD, a company registered in England and Wales under number 17319883, whose registered office is at 128 City Road, London EC1V 2NX, United Kingdom.

For any question about your data, or to exercise your rights, write to contact@gjoandpartners.com.

2. What we collect

Account data: your full name, your email address, a password stored in encrypted form, your profile (company or investor), your interface language, the account creation date, your acceptance of the terms of use and, if you gave it, your time-stamped consent to receive our commercial communications. For an investor: your type of organisation, its country and the date of your professional declaration.

File data, for a company: legal name, country, sector, stage of development, revenue range, EBITDA, amount sought, instrument, uploaded pitch deck, username and published updates. The legal name is never shown publicly.

Credibility signals and direct contact, for a company, if it fills them in: registration number and country of incorporation, reference client names, number of employees, and a contact email address or WhatsApp number. The registration number is visible only to our team, for verification; the other items are shown only if the company ticked the corresponding box.

Profile data, for an investor: organisation name, description, website, tickets, target sectors, countries and instruments, and, when claiming an existing profile, the role and professional contact details you provide to establish your affiliation.

Directory: unclaimed profiles are compiled from funds' public information and describe organisations only, never individuals. Should a profile mention a natural person, that person may ask for it to be corrected or removed.

Interaction data: the contact requests you make, the co-investment notices you post or flag yourself on, the updates you back, the comments and replies you post and the companies you follow, each time-stamped.

Diagnostic without an account: if you use the public diagnostic, your email address and the answers you enter, to send you the report and a short sequence of three emails, each carrying an unsubscribe link.

Technical data: the access and error logs produced by our hosting providers, and an internal, append-only audit log that records sensitive actions (account creation and deletion, changes to a file's status, consents).

3. Why we process it

To perform the contract between us: run your account, publish your file or profile, apply the filter on declared criteria, pass on your contact requests and notify you of publications that fall within your criteria.

On the basis of our legitimate interest: security of the service, prevention of abuse and false identities, completeness and authenticity checks before publication, product improvement.

On the basis of your consent, which you may withdraw at any time: sending our commercial communications, and the email sequence that follows the public diagnostic.

To comply with our legal obligations: responding to requests from competent authorities, keeping proof of consent.

The filter compares your data with the criteria declared by other users; it produces no solely automated decision with legal effect on you. We do not use your data for advertising on behalf of third parties.

4. Who has access

Other users, within the limits you set. An investor sees only an anonymous teaser of a company, until the company chooses to reply. When an investor requests contact, their name, organisation and email are passed on to the company and become visible to the other investors who requested contact on the same file. When an investor flags themselves on a co-investment notice, their name and email are passed on to the author and the other flagged investors. These rules are enforced by the database itself, not only by the screen.

If a company chooses to show a direct contact channel, its email address or WhatsApp number is visible to certified investors, and to them only, on its updates and teaser. A comment is visible to the same people as the update it relates to: signed-in users, or any visitor if the company made the update public. An investor appears there under the name of their organisation, a company under its username, each with its profile type shown.

Our technical processors, within the limits of their function: Supabase for hosting the database, authentication and uploaded files; Vercel for hosting the application; Resend for sending emails.

Our team, for the completeness and authenticity check before publication, and when you ask for assistance.

We do not sell or rent your data, do not pass it to any financial intermediary, and do not use it to train models.

5. Where it is hosted

The database and uploaded files are hosted by Supabase in the European Union. The application is served by Vercel from its international network, and emails are sent by Resend.

Where a transfer outside the European Economic Area or the United Kingdom is necessary, it relies on the European Commission's standard contractual clauses or on a recognised adequacy mechanism.

6. For how long

Your account, file, profile and interaction data are kept as long as your account is active. You can request deletion of your account from your dashboard: your file, profile and interactions immediately stop being visible, then the account, the file and the pitch deck are erased by an automated process thirty days after the request, during which you can cancel. Proof of consent and the audit log are kept for at most two years, then purged automatically.

Public diagnostic data is erased automatically twelve months after it was entered, or the day after you unsubscribe if that comes first.

Technical logs are kept for at most twelve months.

7. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability over your personal data, and the right to withdraw any consent at any time. You can edit your file, your profile and your notifications from your account; for the other rights, write to contact@gjoandpartners.com. We reply within one month.

If our reply does not satisfy you, you may complain to the competent supervisory authority: the Information Commissioner's Office in the United Kingdom, or the data protection authority of your country of residence.

8. Cookies

Invest Matching only uses cookies strictly necessary for its operation: those that keep your session open. They serve no advertising tracking.

The service embeds no audience measurement tool and no third-party tracker. That is why no consent banner is shown to you.

9. Security

Exchanges with the service are encrypted in transit. Separation between accounts and the reciprocity of contact requests are enforced by the database, row by row, and not only by the application. Pitch decks are accessible only through signed, time-limited links.

In the event of a data breach likely to put your rights at risk, we notify the competent authority within seventy-two hours and inform you without undue delay.