Vestcove Privacy Notice

Introduction

Vestcove ("Vestcove", "we", "us", or "our") provides a property underwriting platform for private investors. This Privacy Notice explains how we collect, use, share, and protect personal data when you visit our website or use the Vestcove service. It applies to all users of our products and services worldwide and is intended to comply with applicable data protection laws, including the European Union's General Data Protection Regulation (GDPR).

Data Controller

Vestcove is the data controller responsible for the personal data we process about users of our services. You can reach our privacy team at any time at privacy@vestcove.com.

Information We Collect

We collect personal data that you provide to us, that we generate when you use our services, and that we receive from public sources we describe on our Data Sources page.

• Account information. When you create an account, we collect your email address and display name. We generate a secure session token that allows you to stay signed in.
• Workspace data. When you use the customer workspace, we store the bookmarks, saved scenarios, investor preferences, and similar inputs you create.
• Communications. If you contact us, we keep a record of the correspondence and any information you provide so that we can respond.
• Technical and usage information. Our servers automatically record a request identifier and an anonymised internet protocol (IP) address each time you interact with our services. We use this information to operate, secure, and improve the service. We do not operate analytics platforms, advertising networks, or cross-site tracking.
• Public source data. To produce property scorecards, we process public source data such as transaction records, rent statistics, energy ratings, and tenancy comparable evidence. This information is not your personal data and is not displayed as such. Vestcove is not the publisher of the underlying datasets.

How We Use Information

We use personal data to provide and improve our services, to authenticate users, to maintain the security and integrity of our platform, to respond to enquiries and support requests, to communicate with you about service-related matters, and to comply with our legal and regulatory obligations. We do not use personal data for advertising, profiling, or behavioural targeting.

Legal Bases for Processing

Where the GDPR applies, we rely on the following legal bases to process personal data:

• Performance of a contract (Article 6(1)(b)), to operate the services that you have signed up for and to provide the customer workspace you use.
• Legitimate interests (Article 6(1)(f)), to provide underwriting evidence to private investors and to protect our services against fraud and abuse. Where any source includes information that could identify an individual, we aggregate or anonymise that information before it is used in customer-visible outputs.
• Compliance with legal obligations (Article 6(1)(c)), where we are required to act on a lawful request from a regulator, court, or data subject.
• Consent (Article 6(1)(a)), for any processing that is not covered by one of the bases above. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

How We Share Information

We do not sell personal data and we do not share it with third parties for their own purposes. We engage sub-processors to provide cloud hosting and storage, content delivery and transport-layer security, map basemap and tiling, transactional email, and address-lookup services. Each sub-processor is bound by a written data-processing agreement that requires them to maintain appropriate security and confidentiality measures and to process personal data only on our documented instructions. We may also disclose personal data where required by law, in connection with a lawful request from a regulator or court, or where necessary to protect the rights, property, or safety of Vestcove, our users, or others.

International Data Transfers

We host the Vestcove service on infrastructure located within the European Economic Area. Where personal data is transferred to a country outside the European Economic Area, we put in place appropriate safeguards in accordance with applicable data protection laws, including, where relevant, the European Commission's Standard Contractual Clauses.

Cookies

Vestcove uses only strictly necessary cookies. A secure session cookie allows you to stay signed in across page loads in the customer workspace. While the public preview environment is access-gated, a short-lived access cookie may also be set. None of our cookies carry profiling identifiers or third-party advertising tokens. We do not deploy analytics or advertising trackers.

Data Retention

We retain account information for as long as your account is active and for a reasonable period afterwards where we are required to keep it for accounting, audit, or legal-compliance purposes. Workspace data is retained until you delete it or close your account. Server-side request logs are retained for a rolling thirty days. Public source data is refreshed regularly from the upstream publisher and is not specific to your account.

Children

The Vestcove service is not directed at, and is not intended for use by, individuals under the age of eighteen. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact privacy@vestcove.com and we will take appropriate steps to delete it.

Your Rights

Subject to applicable law, you have the following rights in relation to the personal data we hold about you:

• Right of access. You may request confirmation that we process personal data about you and ask for a copy of that data.
• Right to rectification. You may ask us to correct personal data that is inaccurate or incomplete.
• Right to erasure. You may ask us to delete personal data that we hold about you, subject to limited exceptions provided for by applicable law.
• Right to restriction of processing. You may ask us to limit how we process personal data while a question about that data is being resolved.
• Right to object. You may object to processing carried out on the basis of our legitimate interests.
• Right to data portability. You may request a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format.
• Right to withdraw consent. Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint. You may lodge a complaint with the Irish Data Protection Commission (dataprotection.ie) or with the supervisory authority in your country of residence.

To exercise any of these rights, please contact privacy@vestcove.com. We respond to verifiable requests within thirty days and will inform you in advance if we require additional time, as permitted by applicable law.

Security

We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorised access, disclosure, alteration, and destruction. Although no system can be guaranteed against every risk, we continuously review and improve our security practices.

Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our services, in applicable law, or in our operational practices. When we make material changes we will update the date at the top of this page and, where appropriate, provide additional notice through the service or by other reasonable means.

Contact Us

If you have any questions about this Privacy Notice or about how we handle personal data, please contact our privacy team at privacy@vestcove.com.