GDPR Statement
A focused statement covering how 4invest meets EU GDPR, UK GDPR, and equivalent obligations for organizations operating across the Mediterranean, GCC, North America, and Asia Pacific.
Section 01
For organization data (employee accounts, billing, support communications) 4invest is the controller. For workspace content the customer submits — clients, deals, documents, payments — the customer is the controller and 4invest is the processor.
The processing terms are in the Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
Section 02
EU/UK individuals have the right to access, rectify, erase, restrict, port, and object to processing of their personal data. Where 4invest acts as controller, requests are handled within one month at privacy@4invest.co. Where 4invest acts as processor, requests are routed to the customer (controller) without undue delay.
We do not charge for rights requests except in cases of manifest excess, in which case we will explain the reason in writing.
Section 03
Default EU customer hosting is in Frankfurt, Germany. Where data leaves the EEA for service operations, transfers rely on Standard Contractual Clauses (2021/914) plus, for transfers from the UK, the UK International Data Transfer Addendum. We publish the current list of transfer destinations in the DPA.
Section 04
Contract — operating the service for customers and their authorized users.
Legitimate interests — security, fraud prevention, service improvement, and limited B2B marketing where allowed.
Consent — marketing emails outside an existing business relationship, optional analytics cookies, and any future feature that requires it.
Legal obligation — financial records, tax, anti-money-laundering, and lawful government requests.
Section 05
The Data Protection Officer can be reached at dpo@4invest.co. An EU/UK Article 27 representative is appointed before the first EU customer enters production; current details are published here when active.
Section 06
In the unlikely event of a personal-data breach affecting customer data, 4invest will notify the affected controller within 48 hours and provide the information required under Article 33 GDPR to enable the controller's own notification obligations. Incident timelines are tracked at status.4invest.co.
Questions on this document?
Email legal@4invest.co. We aim to reply within two business days, faster for active commercial conversations.
Ready when your team is
Start with the core workspace, then add the client, finance, reporting, and governance modules your organization needs.
