Privacy notice
Last updated: 8 October 2026
Who is responsible
This notice covers the Gray Fox Capital website and investor workspace. The legal entity acting as data controller, its registered address and dedicated privacy contact remain to be confirmed on the company information page. The site remains a private review version while those details are completed. Please do not enter real investor information for testing.
Information used
- Enquiries: the name, email, subject and message you submit.
- Sign-in: the authenticated identifier, email and available display name supplied by ChatGPT sign-in. The GFC application does not receive your account password.
- Investor administration: name, organisation, mandate, access status and the investment records, files and updates added by GFC.
- Access-review records and administrator activity: the person making a change, the action and its date. Hosting and sign-in providers may also process technical connection and security information.
Information comes from you, your sign-in provider and GFC administrators. Administrators may enter information supplied through the business relationship. Please do not submit passport copies, bank credentials or health information through the enquiry form.
Purposes and proposed lawful bases
The following bases describe the intended service. The controller must validate them against its actual arrangements before external use.
| Purpose | Basis and relevant interest |
|---|---|
| Responding to business enquiries | Legitimate interests in handling requested correspondence; steps at your request before a contract where you would be a contracting individual. |
| Operating investor accounts and sharing assigned materials | Legitimate interests in administering business relationships and confidential access; contract where necessary to provide a service contracted with you personally. |
| Access checks and administration records | Legitimate interests in preventing unauthorised access, protecting information and investigating changes. |
| Records required by applicable law | Legal obligation, only where a specific obligation applies to the controller. |
Submitting an enquiry does not subscribe you to marketing. This application has no automated marketing campaign, behavioural advertising or automated investment suitability assessment. GFC administrators decide who is assigned a deal; portal access is not a suitability determination.
Who can receive information
GFC administrators can access workspace records and enquiries. Approved investors can access the information and files for their assigned deals, but not other investors’ profiles or allocations. Do not upload personal information to a shared deal room unless it is appropriate for all assigned recipients.
The application uses OpenAI’s Sites and sign-in services and Cloudflare-hosted database and file services. Their precise contractual roles, relevant contracting entities, subprocessors and processing locations need to be confirmed for GFC’s account. Professional advisers and authorities may receive information where justified by the relevant purpose or a legal requirement. The application does not sell personal information.
International processing
Provider infrastructure may involve processing outside the UK. This deployment has not been verified as UK-only. Before external launch, the controller must document the actual destinations and applicable transfer arrangements, update this notice and make information about the safeguards available on request. No particular adequacy decision or transfer agreement is represented here as already verified.
How long information is kept
Retention is assessed by reference to the purpose of the enquiry or relationship, whether it remains active, applicable record-keeping duties, and any justified need to establish or defend claims. Information should be deleted or anonymised when those reasons no longer apply. A production retention schedule and review owner still need approval.
Revoking portal access does not delete investor records. This version has no automatic retention deletion job. Test data should be limited and removed before external use; any required legal hold must be considered before deletion.
Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction or a portable copy of your personal information. Rights are not absolute. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.
Raise requests through your existing GFC contact while the dedicated privacy contact is being confirmed. You should not need to hold an active investor account to exercise your rights. Identity checks should be proportionate. Requests should normally be answered within one month, subject to the applicable statutory rules and extensions.
A data-protection complaint should be acknowledged within 30 days, investigated and answered without undue delay, with progress updates as appropriate. The controller must assign a monitored complaints contact before external launch.
You may complain to the Information Commissioner’s Office. This does not prevent you from contacting GFC first.
Providing information and changes
You choose whether to submit an enquiry. A reply address is needed to respond; an approved sign-in identity is needed for private workspace access. Any separate legal or contractual requirement for transaction information should be explained when it is requested. Material changes to purposes or this notice should be communicated before the new processing begins.