Privacy Policy

R&P Enterprises Limited ("R&P", "we", "us"), a private limited company incorporated in England & Wales under company number 17083208, whose registered office is 1st Floor Spitalfields House, Stirling Way, Borehamwood, Hertfordshire WD6 2FX, is the controller of personal data processed through this platform (the "Platform"). We process your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. There is no statutory requirement for us to appoint a Data Protection Officer; privacy questions reach the team directly at the address in section 12.

We collect the following categories of personal data:

• Identity and contact data: name, email address, telephone number, country/jurisdiction of residence.
• Eligibility data: investor self-certification category and the declarations you make, indicative investment size, timeline, and how you heard about us.
• Account data: the email address used to access the investor portal. Sign-in is by a one-time code sent to your email; we do not use or store a password.
• Onboarding and verification data: where you apply to invest, your legal name, date of birth, nationality, residential address, a copy of your identity document, and the bank account details you nominate for distributions. Where automated identity verification is used, our verification provider also processes a facial scan to match you to your document and screens your details against sanctions and politically-exposed-person lists.
• Usage and technical data: IP address, approximate location derived from it (country and city), browser and user-agent, pages viewed, and referral and attribution (UTM) parameters. Your IP address and user-agent are also recorded against your investor certification as evidence of when and from where it was made.
• Communications: messages you send us via forms, chat, or email.

We use your data to:

• verify your eligibility to access deal-specific information;
• create and secure your investor account and restore access across devices;
• communicate with you about opportunities, your enquiries, and your account;
• operate, maintain, secure and improve the Platform; and
• comply with legal and regulatory obligations.

We rely on a specific basis for each purpose. Consent for marketing emails, which you may withdraw at any time. Legitimate interests for operating, securing and improving the Platform, for understanding how it is used, and for contacting investors who have asked to hear from us. Performance of a contract for administering your investment, your agreement and your payments. Legal obligation for tax reporting, financial-promotion record keeping, and for checking you against sanctions lists. Where identity verification involves a facial scan, that is biometric data and we rely on your explicit consent, given when you start the check; you may instead ask us to verify you manually from documents. Identity and sanctions checks are run by software, but no decision about your investment is taken by automated means alone: a person at R&P reviews every result before anything follows from it.

We do not sell your personal data. We share it with our affiliate 18 Main where relevant to an opportunity, with professional advisers, with authorities where required by law, and with the following service providers who process it on our behalf under contract: Supabase (database and document storage), Vercel (website hosting and traffic analytics), Resend (email delivery), Sumsub (identity verification and sanctions screening), DocuSign (electronic signature), Anthropic (AI assistance with internal call preparation and draft correspondence), PostHog (product analytics), HubSpot (customer records) and Google (business email). Some of these process data outside the UK, including in the United States and the European Economic Area; where they do, we rely on UK adequacy regulations or the International Data Transfer Addendum to the standard contractual clauses.

The Platform uses strictly necessary cookies to operate, such as the cookie that keeps you signed in. We do not use advertising cookies, and we do not sell or share data with advertising networks.

For statistical purposes the Platform stores two random identifiers on your device: a visitor identifier (local storage) and a session identifier (session storage). They are meaningless on their own, but once you give us your email address we link them to your record so we can see how you used the Platform. We also use two analytics providers, PostHog and Vercel, which record page views and may set their own storage. None of this is used for advertising. You can switch off our statistical tracking for this device at any time with the control below, or by clearing your browser storage.

We keep personal data only for as long as we need it, and we apply these periods. Enquiries and leads that do not become investments: two years from your last contact with us. Investor certifications and the record of what was shown to you: six years, to evidence compliance with financial-promotion rules. Identity verification records, including your identity document and the verification result: five years after our relationship ends, the period expected of anti-money-laundering records. Investment records, signed agreements, payments and tax documents: seven years after the investment is repaid, for tax and accounting. Website analytics: two years. After these periods the data is deleted or anonymised. If you ask us to erase your data sooner we will do so, except where we are required to keep it for one of the reasons above.

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. To exercise any right, contact us using the details below; we will respond within one month. You also have the right to complain to the UK Information Commissioner's Office, at ico.org.uk or on 0303 123 1113, though we would ask you to raise it with us first so we can put it right.

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, one-time-code authentication, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Platform is intended only for eligible investors and is not directed at anyone under 18. We do not knowingly collect data from children.

We may update this policy from time to time. The current version is always posted here with its "last updated" date.

For any privacy matter, including to exercise your rights, contact invest@rpenterprises.co.uk. See also our Terms of Service.