Last updated 18 August 2026
How personal information is collected, used, shared and protected when you use the CREAssets platform — whether as a sponsor administering an investment programme or as an investor invited to one.
To be completed by counsel
The factual sections below describe what this software actually does with personal information. The statutory sections — legal basis, individual rights, retention periods, international transfer mechanism and the identity of the controller — must be completed and the whole reviewed by counsel before this policy is presented as binding.
Nothing here claims a certification, a privacy framework membership or an adequacy decision. Do not add one that does not exist.
This policy covers personal information handled through the CREAssets platform and the operator’s website.
Two roles matter throughout. For information a sponsor loads into its own workspace — its investors, their contact details, their subscription and KYC records — the sponsor decides what is collected and why, and the operator handles it on the sponsor’s instructions. For account and billing information, and for the operation and security of the platform itself, the operator decides.
To be completed by counsel
Name the controller and processor for each role in the jurisdictions served (GDPR/UK GDPR controller vs processor; CCPA/CPRA business vs service provider), and state whether a data processing addendum is offered and where it can be found.
The platform collects the following categories.
Directly from you; from a sponsor who invites you or maintains your investor record; from verification, bank, payment and e-signature providers acting on an instruction; and automatically from your use of the platform.
Personal information is not sold. It is not used to advertise to a sponsor’s investors.
To be completed by counsel
If aggregated or de-identified data is used for product analytics or benchmarking, say so explicitly here and describe the de-identification standard. Silence on this point is the most common gap in a policy of this kind.
To be completed by counsel
Counsel must map each purpose in section 4 to a lawful basis for jurisdictions requiring one (contract, legal obligation, legitimate interests, consent), and record the legitimate-interests assessments.
If you are an investor, the sponsor who invited you controls your investor record. Questions about why particular information was requested, how long the sponsor keeps it, or requests to correct or delete it should go to that sponsor in the first instance. The operator will assist a sponsor in responding.
Information is kept for as long as an account or investor record is active, and afterwards for the periods required by tax, securities and anti-money-laundering law and for the resolution of disputes. Audit-log entries and completed signature records are retained as evidence of what occurred.
To be completed by counsel
Insert the specific retention periods per category.
This note previously said to reconcile them with “the export window and deletion timetable in section 14 of the Terms of Service”. There is no longer any such window or timetable — that clause was removed on 2026-08-25 because nobody could perform it (owner decision, Q-40; the reasoning is in the CounselNote at Terms section 14). So there is currently nothing to reconcile against, and this note is not waiting on the Terms.
When a data-return clause is eventually drafted, the reconciliation duty returns and the two documents must not give different numbers.
Safeguards include encryption of data in transit, encryption at rest of two-factor secrets, hashed password and recovery-code storage, role-based access control scoped to a single organisation’s workspace, optional and enforceable two-factor authentication, and an audit log of significant actions.
No system is completely secure. Choose a strong, unique password, enable two-factor authentication, and tell us promptly about any suspected unauthorised access.
To be completed by counsel
Add the breach notification commitment — who is told, within what period, and by what means — required by applicable law and customer contracts. Do not name a certification (SOC 2, ISO 27001) unless it has been obtained; if it has, give its scope and date.
You can review and update your account details in the platform, control your notification preferences, and export data available to you through the platform’s export features.
To be completed by counsel
Counsel must set out the statutory rights that apply (access, correction, deletion, portability, restriction, objection, opt-out of sale/sharing, non-discrimination), how a request is made and verified, the response deadline, and the appeal or complaint route including the relevant supervisory authority.
Transactional and service messages — capital-call notices, distribution notices, security alerts, document availability — are part of the service and are sent while your account or investor record is active. Marketing messages from a sponsor can be declined at any time using the preference controls or the unsubscribe link in the message.
To be completed by counsel
State where data is hosted and processed, which providers process it outside that region, and the transfer mechanism relied on (standard contractual clauses, adequacy, or another). Do not assert a framework certification the operator does not hold.
The platform is intended for business and investment use by adults. It is not directed to children and does not knowingly collect their personal information.
You can sign in with Google, and a sponsor can connect a Google account so the platform can send email as that account, keep the sponsor’s investor conversations in step with their mailbox, and read calendar availability to book meetings. Signing in uses only your name, email address and profile picture. A connected account additionally grants the Gmail and Calendar permissions shown on Google’s consent screen, and nothing else.
Information received from Google APIs is used only to provide those features to the person who connected the account. It is not sold, not used for advertising, not used to train artificial intelligence models, and not transferred to anyone except as needed to provide the feature, to comply with law, or with your consent. People do not read it except with your permission, for security, or as the law requires. Disconnecting the account in the platform, or revoking access at myaccount.google.com, stops further access.
CREAssets’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
This policy may be updated. Material changes will be notified in the platform or by email before they take effect, and the “last updated” date above will change.
Privacy questions should be sent to the operator using the contact details published on the operator’s website. Investors should contact the sponsor who maintains their investor record for questions about that record; see the Terms of Service for how the two relationships differ.
To be completed by counsel
Insert the privacy contact address, the data protection officer or EU/ UK representative where one is required, and the postal address for written requests.