1. Who We Are
This Privacy Policy explains how Investra International Ltd, 128 City Road, London EC1V 2NX, United Kingdom (“Investra”, “we”), processes personal data when you use the Investra platform, contact us or interact with our partner network. Investra is the controller of the processing described in this Policy unless expressly stated otherwise.
Our data protection officer can be reached at dpo@investra.io.
2. Personal Data We Collect
We collect: (a) identification and contact data you provide (name, email address, telephone number, postal address, date of birth); (b) verification data required by law (identity document data, sanctions and politically-exposed-person screening results); (c) transaction data (reservations, payments, communications with partners); (d) usage data (device information, log data, approximate location derived from IP address); and (e) preference data (saved searches, favourites, marketing choices).
Providing identification and verification data is a statutory or contractual requirement for certain services; without it we cannot provide those services.
3. Purposes and Legal Bases
We process personal data: to provide the Platform and perform our contract with you (Art. 6(1)(b) GDPR); to comply with legal obligations, including anti-money-laundering and tax rules (Art. 6(1)(c)); for our legitimate interests in securing and improving the Platform, preventing fraud and conducting business analytics (Art. 6(1)(f)); and, where you have given it, on the basis of your consent, for example for optional cookies and direct marketing (Art. 6(1)(a)).
Where we rely on legitimate interests, we balance those interests against your rights and freedoms; you may obtain information about the balancing test from dpo@investra.io.
4. Sources of Data
Most data is collected directly from you. We also receive data from partners you transact with, identity-verification and screening providers, payment processors, and publicly available registers where required for compliance purposes.
5. Recipients of Data
We share personal data with: service providers acting as processors (hosting, communications, analytics, customer support tooling); partners involved in your transaction, acting as independent controllers; payment institutions; professional advisers; and public authorities where disclosure is required by law.
A current list of the categories of processors is available on request. We do not sell personal data.
6. International Transfers
Where personal data is transferred outside the European Economic Area — including to the United Kingdom and the TRNC — we rely on adequacy decisions where available, and otherwise on the European Commission's Standard Contractual Clauses supplemented by appropriate technical measures. Copies of the relevant safeguards may be requested from dpo@investra.io.
7. Retention
We retain personal data only as long as necessary for the purposes described: account data for the life of the Account and up to 6 years thereafter for defence of legal claims; identity-verification records for the period prescribed by anti-money-laundering law (in most markets 5 years after the end of the business relationship); accounting records for the statutory retention period of the relevant market; and marketing preferences until you withdraw consent or object.
8. Your Rights
Subject to the conditions of the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests, including profiling (Art. 21). Where processing is based on consent, you may withdraw consent at any time with effect for the future.
You may exercise your rights through your account settings or by contacting dpo@investra.io. We respond within one month, extendable by two further months for complex requests.
You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.
9. Automated Decision-Making
We do not make decisions producing legal or similarly significant effects based solely on automated processing. Compliance screening results are always reviewed by trained staff before adverse action is taken.
10. Cookies and Similar Technologies
Details of the cookies and similar technologies used on the Platform, including how to give and withdraw consent, are set out in our Cookie Policy.
11. Security
We protect personal data through encryption in transit, access controls, network segregation, vulnerability management and staff confidentiality obligations. No system is completely secure; we will notify you and the competent supervisory authority of personal-data breaches where required by Articles 33 and 34 GDPR.
12. Children
The Platform is not directed at children under 18, and we do not knowingly process their personal data. If you believe a child has provided personal data to us, please contact dpo@investra.io and we will delete it.
13. Changes to This Policy
We will publish any changes to this Policy on the Platform and, for material changes, notify you by email or in-app notice before they take effect. The date of the current version is shown in the document header.