Privacy Policy

Draft. This document is a draft and must be reviewed and approved by an attorney before publication. Items in square brackets must be completed. In case of discrepancy, the Czech version prevails.

1. Controller

The controller of personal data is [FILL IN: company name], company ID (IČO) [FILL IN: IČO], with its registered office at [FILL IN: registered office] ("ICORENT", "we" or "us"). For data protection matters, contact us at [email protected] or in writing at our registered office.

We have not appointed a Data Protection Officer because we are not required to do so under Article 37 GDPR. [FILL IN: attorney to confirm.]

Processing is governed by Regulation (EU) 2016/679 (the "GDPR") and Czech Act No. 110/2019 Coll., on the Processing of Personal Data.

2. Who our services are for

ICORENT provides advisory and intermediation of financing secured by real estate exclusively to businesses and legal entities with a company ID. We are not a bank and do not provide or broker consumer credit under Czech Act No. 257/2016 Coll. We therefore mainly process personal data of self-employed individuals, contact persons and representatives of companies, and investors.

3. Data we process

3.1 Enquiry form data

• first name and surname, business e-mail and phone,
• company ID and name, position or relationship to the company,
• requested financing amount and purpose,
• property information (address, cadastral area, title deed number, estimated value),
• the content of your message and any other information you choose to share.

3.2 Data from public registers

After you submit an enquiry, we automatically supplement data based on the company ID from these public sources:

• ARES (Administrative Register of Economic Entities) – name, registered office, legal form, business activities, statutory bodies,
• Insolvency Register (ISIR) – whether insolvency proceedings are pending against the entity,
• VAT payer register – VAT registration, any "unreliable payer" status, published bank accounts.

For self-employed individuals and members of statutory bodies, this constitutes personal data.

3.3 Land Registry data

If you provide property details, we may obtain data from the title deed (list vlastnictví) through the official remote access service of the Czech Office for Surveying, Mapping and Cadastre (ČÚZK): property identification, owners and their shares, mortgages, easements, pending entries and other records. A title deed may contain personal data of owners and other entitled persons who did not provide the data to us themselves. We inform those persons through this Policy (Article 14 GDPR).

3.4 Investor data

For investors we process identification and contact details, portal login data, approval status, interest expressed in specific opportunities and communication with us, as well as data needed for identification and checks under anti-money laundering legislation, where it applies to us.

3.5 Technical data

IP address, browser and device information, access logs and cookies. Cookies are described in detail in our separate Cookie Policy.

4. Purposes and legal bases

Purpose	Legal basis	Retention
Handling your enquiry and negotiating financing intermediation	Art. 6(1)(b) GDPR (self-employed individuals – pre-contractual steps); Art. 6(1)(f) GDPR (contact persons of legal entities)	24 months from last contact if no contract is concluded
Verifying the client and property in ARES, ISIR, the VAT register and the Land Registry	Art. 6(1)(f) GDPR – legitimate interest in assessing the enquiry and confirming business status	for the duration of the enquiry, max. 24 months
AI-generated automatic reply	Art. 6(1)(f) GDPR – prompt confirmation of receipt	as for enquiry handling
Forwarding enquiries to staff and cooperating partners	Art. 6(1)(b) and (f) GDPR	for the duration of the enquiry
Presenting anonymised opportunities to investors and sharing documents with an interested investor	Art. 6(1)(b) and (f) GDPR	for the duration of financing negotiations
Performing a contract with a client or investor	Art. 6(1)(b) GDPR	for the term of the contract and 10 years after (limitation periods, accounting and tax law)
Legal obligations (accounting, tax, AML where applicable)	Art. 6(1)(c) GDPR	as required by the relevant law, typically 5–10 years
Investor portal administration and security	Art. 6(1)(b) and (f) GDPR	while access is active and 3 years after
Defending legal claims	Art. 6(1)(f) GDPR	for the limitation period and duration of any dispute
Website analytics and marketing	Art. 6(1)(a) GDPR – consent	see Cookie Policy
Commercial communications to existing clients	Section 7(3) of Czech Act No. 480/2004 Coll. and Art. 6(1)(f) GDPR	until you object

Where we rely on legitimate interest, you have the right to object (see Section 9).

5. Automated processing and artificial intelligence

5.1 Automated register checks

The automatic retrieval of data from public registers serves to prepare documentation. No automated decision-making with legal or similarly significant effects within the meaning of Article 22 GDPR takes place – a human always decides whether we pursue an enquiry and whether financing is offered.

5.2 AI-generated reply

After you submit the form, our system may generate an automatic e-mail reply using the Claude language model by Anthropic. For this purpose we send the model the content of your enquiry and the supplemented company data. In line with the transparency requirements of Article 50 of Regulation (EU) 2024/1689 (the AI Act), such a reply is expressly labelled in the e-mail as generated by artificial intelligence.

Anthropic acts as our processor. Under its commercial API terms, inputs and outputs are not used to train models. [FILL IN: verify Anthropic's current terms and data retention period.]

6. Recipients

We disclose data only to the extent necessary to the following categories of recipients:

• our staff and external associates (callers) who handle your enquiry; they are bound by confidentiality and a data processing agreement,
• investors – in the portal they see only anonymised opportunity information; identification data and documents are shared with a specific investor only in connection with financing negotiations and after a non-disclosure agreement is signed,
• hosting and infrastructure provider – [FILL IN: provider name, server location],
• e-mail service provider – [FILL IN: provider name],
• Anthropic, PBC (USA) and its European entities – generating the automatic reply,
• Telegram (Telegram Messenger Inc. / Telegram FZ-LLC) – internal notifications of new enquiries to staff; notifications contain [FILL IN: scope of data – we recommend minimising, e.g. only name, company and a link to the internal system],
• Google Ireland Limited – Google Tag Manager and Google Analytics 4, only with consent,
• Meta Platforms Ireland Ltd. – if you contact us via WhatsApp yourself, and marketing tools only with consent,
• ČÚZK – Land Registry queries are logged,
• accountants, tax and legal advisers, and public authorities where required by law.

We do not sell your data.

7. Transfers outside the EU/EEA

Some recipients (in particular Anthropic, Google, Meta and Telegram) may process data outside the European Economic Area. Transfers are based on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified recipients) or standard contractual clauses under Article 46 GDPR. We will provide a copy of the safeguards on request. [FILL IN: attorney to verify the transfer mechanism for each recipient, especially Telegram.]

8. Security

We use encrypted connections (HTTPS), access control, two-factor authentication for internal tools, pseudonymisation of data in the investor portal and regular deletion of old records. Staff and partners only have access to the data they need.

9. Your rights

Under the GDPR you have the right to:

• access your personal data and obtain a copy (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure where the purpose of processing has ceased (Art. 17),
• restriction of processing (Art. 18),
• data portability for data processed by automated means on the basis of a contract or consent (Art. 20),
• object to processing based on legitimate interest, including objection to commercial communications (Art. 21),
• withdraw consent at any time, without affecting the lawfulness of prior processing,
• lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz, or with the supervisory authority in your EU member state.

We respond to requests without undue delay and within one month at the latest. To exercise your rights, write to [email protected]. We may ask you to verify your identity.

10. Sources of data and whether providing it is required

We obtain data directly from you, from public registers (ARES, ISIR, VAT register), from the Land Registry and from persons who referred you to us. Providing data in the form is voluntary, but without it we cannot handle your enquiry.

11. Changes

We may update this Policy. The current version is always published on the website with the date of the last update.