Privacy Policy

Ventura Investments London Ltd (company number 17040517, registered office 40-44 Church Street, Reigate, Surrey RH2 0AJ) is the data controller for personal data processed through this platform.

We are registered with the Information Commissioner's Office under registration application is in progress; the number will be published here once issued. For any privacy query, contact enquiries@venturaproperty.uk.

[If you appoint a Data Protection Officer, name them here. A DPO is mandatory only in limited circumstances, but is worth taking advice on given the volume of financial and identity data this platform handles.]

Depending on how you use the platform, we may process:

• Identity and contact data — name, company, job title, email address, telephone number, postal address.
• Verification data — identity documents, proof of address, company registration details, and for broker partners: redress scheme membership, AML supervision registration, professional indemnity insurance and ICO registration details.
• Financial data — proof of funds, source of funds and source of wealth information, funding requirements, and investment criteria.
• Transaction data — opportunities viewed, enquiries made, offers submitted, documents accessed and due diligence activity.
• Platform usage data — calculations saved, tools used, searches run, watchlists and preferences.
• Communications — messages sent through the platform and correspondence with our team.
• Technical data — IP address, browser type, device information and access times.

We do not intentionally collect special category data. Please do not submit health, biometric or similar data through the platform.

Under UK GDPR we rely on the following lawful bases:

• Contract — to provide the service you have signed up for: managing your account, giving access to opportunities, facilitating introductions and transactions.
• Legal obligation — anti-money-laundering and counter-terrorist-financing checks, sanctions screening, and record-keeping required by the Money Laundering Regulations 2017 and other applicable law.
• Legitimate interests — verifying members, matching opportunities to stated criteria, preventing fraud and misuse, improving the platform, and business analytics. We balance these against your rights, and you may object (see section 8).
• Consent — marketing communications and non-essential cookies. You may withdraw consent at any time.

We may share personal data with:

• Other members, only to the extent necessary for a transaction and subject to the confidentiality settings applied. Investor identities are anonymised to vendors unless disclosure is authorised.
• Professional advisers instructed on a transaction — solicitors, surveyors, valuers, lenders — where you or a counterparty appoints them.
• Service providers who process data on our behalf, including hosting, identity verification, payment processing and communications providers. These act as processors under written agreement.
• Regulators, law enforcement and other authorities where required by law, including suspicious activity reporting under the Money Laundering Regulations.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place — an adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Supabase (database and storage), Vercel (hosting), Resend (email) and Stripe (payments). Each provides appropriate safeguards for any transfer outside the UK.

We retain personal data for as long as necessary for the purposes set out above. In particular:

• AML and customer due diligence records: five years from the end of the business relationship or the completion of the transaction, as required by the Money Laundering Regulations 2017.
• Transaction and contractual records: six years, aligned to the Limitation Act 1980.
• Account and platform usage data: 24 months after account closure.
• Marketing preferences: until you withdraw consent.

We use encryption in transit and at rest, role-based access controls, audit logging and regular review of access rights. Access to member data within Ventura is restricted to staff who need it for their role.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where the risk is high, notify you directly.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have data erased, where no overriding legal obligation requires us to keep it. Note that AML records must be retained for five years and cannot be erased on request.
• Restrict or object to processing, including processing based on legitimate interests.
• Receive your data in a portable format.
• Withdraw consent at any time, where consent is the basis for processing.

To exercise any right, contact enquiries@venturaproperty.uk. We will respond within one month. If you are unhappy with our response you may complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

The platform uses rules-based matching to suggest opportunities, lenders and professional advisers based on criteria you provide. These are suggestions only — they do not restrict what you can access and have no legal or similarly significant effect on you. We do not carry out automated decision-making within the meaning of Article 22 UK GDPR.

We may update this notice. Material changes will be notified to members. The date at the top shows when it was last revised.