Privacy Notice

Virtus Investments Ltd is the data controller for the personal information described in this notice. We are a company registered in England and Wales, company number 16251513, with our registered office at 7 Blighs Walk, Sevenoaks TN13 1DB.

We have not appointed a formal Data Protection Officer. You can contact us at privacy@virtus-investments.co.uk about privacy, how we use your personal information, or to exercise any of your rights.

• Identity and contact details: full name, email address, telephone number, job title and organisation name.
• Enquiry content: the subject and message you send through our contact form.
• Investor application details: applicant type, your role and the organisation you represent, confirmation of authority, Financial Conduct Authority (FCA) Firm Reference Number, the results of FCA Register checks, supporting information you provide, and your marketing preference.
• Housing provider application details: organisation name and type, your role, and confirmation that you are authorised to act for the organisation.
• Housing requirements: information about accommodation needs submitted by approved housing providers. These are organisational requirements and are not intended to contain details of individual residents.
• Account information: login email, an encrypted (hashed) password, email verification status, and your role and access permissions.
• Platform records: for Virtus staff, contractors and partners, names and contact details recorded against properties, tasks, contractors and finance records, and an audit history of changes.
• Technical information: to prevent abuse of the contact form we store a one-way scrambled (hashed) version of your IP address, not the address itself.

We do not ask for special category data (such as health or ethnicity). Please do not include it in messages or requirements.

• Directly from you, through our forms, emails and the platform.
• From the organisation you represent, or colleagues who add you to the platform.
• From public sources, in particular the FCA Financial Services Register, when we verify investment firms.
• From property data services we use to identify potential properties. These relate to properties rather than individuals.

We rely on the following lawful bases under UK GDPR, depending on the activity:

• Responding to enquiries and managing business relationships — legitimate interests.
• Assessing investor and housing provider applications — legitimate interests, because applications are usually made on behalf of an organisation. Where you apply as an individual and ask us to take steps before entering into an agreement with you, we rely on those steps being necessary at your request.
• Providing accounts and the platform — performance of a contract where our agreement is with you personally; otherwise legitimate interests in serving the organisation you represent.
• Managing properties, contractors and projects — performance of a contract where you are a party to it; otherwise legitimate interests.
• Accounting, regulatory checks and due diligence required by law — legal obligation.
• Security, fraud and spam prevention, and audit trails — legitimate interests.
• Occasional updates to investors — consent, given only by ticking the separate, optional updates box on the investor access form. You can withdraw it at any time. Submitting a contact enquiry or registration form does not sign you up to marketing.

Ticking the box to confirm you have read this notice is an acknowledgement only. It is not consent to processing, and we do not rely on it as a lawful basis.

Where we rely on legitimate interests, these are: running and developing our property investment and housing business; responding to business enquiries; verifying that partners are eligible and authorised; keeping the platform secure; and keeping accurate records. We have considered your interests and expect this processing to be what you would reasonably anticipate in a business relationship. You can object at any time (see section 14).

Virtus Capital is open only to FCA-authorised investment firms and is not open to retail investors. When you request investor access we use your details to verify your email, check your firm against the FCA Register, review your eligibility and authority, and communicate with you about your application. Every application is reviewed by the Virtus team, and decisions are recorded with an audit history.

When you register your organisation we use your details to verify your email, check your organisation and your authority to act for it, and decide on access to Virtus Connect. Approved providers can submit housing requirements, which we use to identify suitable properties. Requirements are visible only to your organisation and to Virtus staff, and are not shared with other providers.

When you use the Contact Virtus form we store your enquiry securely and send an internal notification to the Virtus team so we can reply. We use your details only to respond to you and manage any resulting discussion.

Accounts require email verification. Passwords are stored only in hashed form and are never visible to Virtus staff. We send emails for account verification and password resets. Access to each part of the platform depends on approved roles, enforced on our servers.

We do not sell personal information. We use service providers who process it on our behalf to run our business:

• Database, authentication and backend services (Supabase) — store account, application, enquiry and platform records.
• Website hosting, delivery and email sending (Lovable, which delivers the website through Cloudflare) — host the platform and send account and notification emails.
• Business email (Google Workspace) — our team receives enquiry notifications and corresponds with you by email.
• Workflow automation (n8n) — supports our internal property sourcing. It receives organisational housing requirements, not applicant or visitor contact details.

We also use property research services, such as PropertyData, to find potential properties. These deal with property information and do not receive your personal details.

We may check firm details against the FCA Register, and disclose information to professional advisers, or where required by law or to protect our rights. We do not share your personal details with other investors or housing partners without a clear reason.

Some of our service providers are based in, or may access information from, countries outside the UK, including the United States and the European Economic Area. We cannot guarantee that all personal information stays in the UK.

Where personal information is transferred outside the UK, we aim to make sure it is protected by an appropriate safeguard recognised under UK law, such as UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum. You can ask us for more information at privacy@virtus-investments.co.uk.

We aim to keep personal information only for as long as we need it. The periods below are the retention periods we work to. They are guidelines rather than fixed deadlines, and some records, such as the history of changes made on the platform, may be kept for longer where needed for security, accuracy or legal reasons.

• General contact enquiries: 24 months after our last meaningful contact.
• Rejected or withdrawn investor applications: 24 months after closure, unless a longer period is justified.
• Unsuccessful housing provider applications: 24 months after closure.
• Active investor and housing provider accounts: for as long as the relationship lasts.
• Closed accounts: normally 24 months after closure, unless records must be kept longer.
• Contract and transaction records: generally 6 years.
• Anti-money-laundering and identity checks: normally 5 years after the relationship ends, where the law requires them.
• Security and sign-in logs: around 90 days.

These periods may be longer where the law requires it or where information is needed for a legal claim. Deletion is not currently automatic. If you would like us to delete your information sooner, email privacy@virtus-investments.co.uk.

We use appropriate technical and organisational measures, including encrypted connections, role-based access controls enforced at database level, hashed passwords, and audit logs of key changes. No system is completely secure, but we work to protect your information and will act promptly on any incident.

Under UK GDPR you have the right to:

• access the personal information we hold about you;
• have inaccurate information corrected;
• have information erased in certain circumstances;
• restrict or object to our use of it, including where we rely on legitimate interests;
• receive information you gave us in a portable format, where applicable;
• withdraw consent at any time, where we rely on consent.

To exercise any right, email privacy@virtus-investments.co.uk. We will respond within one month, and may need to confirm your identity.

Please contact us first so we can try to help. You also have the right to complain to the ICO, the UK's data protection regulator: ico.org.uk/make-a-complaint, or telephone 0303 123 1113.

We do not use advertising, analytics or tracking cookies, and we do not load third-party tracking scripts.

The website uses your browser's local storage for essential purposes only: keeping you signed in securely, and remembering whether Virtus staff are viewing live or demonstration data. Because these are strictly necessary for the service you ask for, we do not ask for cookie consent. Our hosting and security providers may process technical information, such as your IP address, to deliver the site and protect it from attacks.

If we add any non-essential cookies or analytics in future, we will update this notice and ask for your consent first.

We may update this notice from time to time. The "Last updated" date at the top shows when it was last revised. Significant changes will be highlighted on this page.

Effective date: 23 October 2026.