Privacy Notice

This notice explains what personal data Escrow.International processes, why, on what legal basis, who receives it, how long it is kept and what rights you have. It describes the platform as it actually works today, including the fact that several planned service providers are not yet in use. You can exercise your access and erasure rights yourself at any time under Settings, Data and privacy.

1. 1. Controller and contact

   The controller within the meaning of Article 4(7) GDPR is: MATTALNET GRUPP OÜ, Tuukri tn 19-315, 10120 Tallinn, Estonia Registration number 14744075, VAT ID EE102519059 Represented by the managing director Andreas A. Gleim Email: mail@escrow.international We have not appointed a data protection officer. Whether a designation under Article 37 GDPR is required is under review, and this notice will name the officer if one is appointed. Privacy questions and rights requests are handled by the management at the address above.

2. 2. Where the data comes from

   Most of the data we process comes from you: what you enter when you register, verify your identity, publish a listing, make an offer, upload a document or write a message. Some comes from other people: a counterparty who adds you to a deal room, an organization that invites you as a member, a professional who records an engagement, or another member who leaves a review of a completed deal. Some is generated by the platform itself: match scores, risk levels, compliance cases, audit records, invoices and notifications. Some is collected automatically when you use the site: technical connection data, and the identifiers described in the Cookie Policy.

3. 3. Categories of personal data

   Account and profile data: first and last name, email address, telephone number if you provide one, country, interface language, account status, platform role, the time you accepted the terms, the time of your last sign-in, failed sign-in counters and any lock-out time. Authentication data: a hash of your password, whether two-factor authentication is switched on, its secret and its recovery codes, and one record per active session with its refresh-token hash, IP address, user agent and expiry. Organization data, where you act for an entity: company name and legal name, register number, VAT number, country, address, website, your role in the organization and the verification status of the entity. Verification data: the type of check (identity, business, ownership evidence, professional credential, source of funds, source of wealth), its status, the reviewing decision and the reason for a rejection, the expiry of an approval, the identifier the verification provider returned, and the evidence documents you attached. Documents: the file itself and its name, category, type, size, version, checksum and malware-scan result. Categories include identity, ownership evidence, valuation, contract, compliance, financial, registry and correspondence documents. Compliance data: risk level, screening results (the name screened, the type of screening, the outcome, the number of matches, the provider and its reference), compliance cases with their summary, findings and decision, and the compliance gates cleared for a deal. Marketplace and transaction data: assets, images and valuations, listings and preferences, saved searches, matches, offers, deals, deal parties, milestones, tasks, messages and attachments, reviews, settlement case records reported by a settlement partner, fees and invoices. Communication data: in-app notifications, the emails we send you, your notification and digest preferences, and, if you switch it on, the web-push subscription of a specific browser (its endpoint address and its two encryption keys). Audit and technical data: an audit record for every legally material action, containing who acted, on what, when, from which IP address and with which user agent, together with server log data. We do not ask you for special categories of data under Article 9 GDPR. An identity document you upload may nevertheless contain such data, for example a photograph or a place of birth. Sanctions, politically exposed person and adverse media screening may involve data about criminal convictions and offences within the meaning of Article 10 GDPR, processed only within the limits that Union or Member State law allows.

4. 4. Purposes and legal bases

   Providing the account, the marketplace and the deal rooms, including search, matching, offers, deal coordination, documents, messaging and reviews: performance of the contract with you, Article 6(1)(b) GDPR. Identity, business, ownership, credential and source-of-funds verification: performance of the contract, Article 6(1)(b), because verification is a condition of transacting under the Terms of Service; our legitimate interest in a trustworthy marketplace and in preventing fraud and identity abuse, Article 6(1)(f); and compliance with a legal obligation, Article 6(1)(c), to the extent anti-money-laundering law applies to us. Sanctions, politically exposed person, watchlist and adverse media screening, risk classification and compliance cases: compliance with a legal obligation, Article 6(1)(c), in particular restrictive measures adopted by the European Union that apply to us directly; and our legitimate interest in not enabling a prohibited transaction, Article 6(1)(f). Article 10 GDPR data is processed only under the authority of Union or Member State law. Fraud prevention, abuse detection, malware scanning of uploads, rate limiting and platform security: legitimate interest, Article 6(1)(f), in a secure service for all members. Audit records of legally material actions: legal obligation, Article 6(1)(c), and legitimate interest, Article 6(1)(f), in being able to reconstruct what happened in a transaction. Invoicing, accounting and tax: legal obligation, Article 6(1)(c), and performance of the contract, Article 6(1)(b). Service emails and in-app notifications about your account, your listings, your deals and your requests: performance of the contract, Article 6(1)(b). Web push notifications: storage of the subscription on your device requires your permission, which your browser asks for and which you can withdraw at any time in the browser or under Settings, Notifications. The subsequent sending is part of the contract, Article 6(1)(b). Handling your data-protection requests: legal obligation, Article 6(1)(c). Asserting, exercising or defending legal claims: legitimate interest, Article 6(1)(f), and legal obligation where applicable. We do not send marketing newsletters and we run no advertising profiling. If that ever changes, it will happen on the basis of consent, Article 6(1)(a), which you can withdraw at any time with effect for the future.

5. 5. Is providing the data required

   Registration data is required to conclude the contract. Without it we cannot open an account. Verification data is required to transact. Without an approved identity verification you can browse and prepare, but you cannot publish a listing, make or answer an offer, or open a deal room. Everything else is voluntary: a telephone number, an avatar, a saved search, a web-push subscription. Not providing it costs you the corresponding function and nothing else.

6. 6. Recipients and processors

   We disclose personal data only where it is necessary and lawful. Today the recipients are the following. Other members of the platform: a counterparty sees what you publish in a listing and what you share in a deal room. Members of an organization see its organization data. A professional you or your counterparty adds to a deal room sees the deal room content and the documents shared with them. Access to a document always requires an explicit permission or membership of the deal. Our hosting provider: IONOS SE, Germany, operates the server on which the application, the database and the uploaded files are stored. IONOS acts as our processor. Our email provider: the same provider operates the mail service through which service emails are sent. Recipient address, subject and message content pass through it. Emails can contain a single-use link, for example to reset a password or confirm an address. Browser push services, only if you switch on push notifications: the delivery service chosen by your own browser, which is operated by Google, Mozilla or Apple depending on the browser you use. It receives the subscription endpoint and the encrypted notification, and it can see when a message is delivered to your device. Our own second server, used for off-site backups of the database under our sole control. Courts, authorities, supervisory authorities and law enforcement, where we are legally obliged to disclose data or where disclosure is necessary to establish, exercise or defend legal claims. Professional advisers bound by professional secrecy, such as our accountants and lawyers, where necessary. What we do not do today: no identity verification vendor, no sanctions or politically exposed person screening vendor, no exchange rate provider and no settlement partner receives personal data from the platform at present. Those functions currently run as internal, self-contained implementations on our own server, without any transfer to a third party. Before a real provider is connected, we will conclude a processing agreement with it, name it in this notice and update the notice before the transfer begins. We do not sell personal data and we do not pass it to anyone for their own advertising purposes.

7. 7. Transfers to third countries

   The application, the database, the uploaded documents and the backups are held on servers operated for us within the European Union. A transfer outside the European Economic Area occurs today in one case only: if you switch on web push notifications, the notification is delivered through the push service of your own browser, whose operator may process data outside the EEA. In that case we rely on the safeguards available under Chapter V GDPR, in particular an adequacy decision of the European Commission where one applies to the recipient, and otherwise standard contractual clauses. You can avoid this transfer entirely by not enabling push notifications, or by switching them off again. Cross-border deals bring a second situation into view: if you invite a counterparty, an adviser or a settlement partner located outside the EEA into a deal room, the data you share there reaches them. You decide who joins a deal room, and you can see the participants at any time. If we later engage a processor outside the EEA, we will name it here together with the transfer mechanism relied on, before the transfer starts.

8. 8. How long we keep data

   Account, profile and marketplace data is kept while the account exists, and afterwards for as long as a statutory retention period requires. Deal, settlement, fee and invoice data, and the audit records belonging to them, are kept for the statutory bookkeeping and, where it applies to us, anti-money-laundering retention period. Under Estonian bookkeeping law that is seven years from the end of the relevant financial year, and the period can be longer where the law of another jurisdiction applies to a specific transaction. Verification and screening records are kept for the retention period that applies to the check, and an approved identity verification expires two years after approval, after which it must be repeated in order to keep transacting. Sessions expire after at most thirty days and are revoked automatically once expired. Technical one-time keys used to make requests repeat-safe are deleted automatically once they expire. A data export you request stops being downloadable seven days after it is created. The stored export file is not yet removed automatically at that point, so if you want the copy deleted sooner, write to mail@escrow.international and we will delete it. Backups of the database are kept for fourteen days on the production server and, off-site, on a rotation of daily, weekly and monthly copies. Data already erased from the live system continues to exist in a backup until that backup is overwritten in the ordinary course. Apart from the cases named above, the platform runs no automatic deletion job today. Data is removed when you exercise your right to erasure and the conditions in the next section are met, or when we determine that no purpose and no retention obligation remains.

9. 9. Erasure, and why a live deal blocks it

   You can request erasure yourself under Settings, Data and privacy. The request is decided immediately and the outcome is shown to you. The request is refused while you are an active party to a deal that has not reached a final status, meaning completed, cancelled or failed. For as long as a deal is live, its compliance, settlement and contractual records have to stay attributable to a real identity, both for your counterparty and for us. Once every deal you are party to has reached a final status, you can make the request again. When the request is granted, we anonymise rather than delete. Your first name, last name and email address are replaced by neutral placeholders, your telephone number is removed, your two-factor secret and recovery codes are destroyed, all your sessions are revoked and the account is closed and cannot be signed into again. The deal, settlement, audit, fee, review and message records that refer to the account are kept, because a statutory retention obligation applies to them, and because deleting them would destroy the record of a transaction for the other parties to it. They no longer carry your identifying profile data. Documents you uploaded are not deleted by this process. If you want a specific document removed, ask us and we will assess whether a retention obligation stands in the way.

10. 10. Your rights

    You have the right to obtain confirmation as to whether we process personal data about you and, if so, access to that data and the information in Article 15 GDPR. You have the right to have inaccurate data corrected and incomplete data completed, Article 16 GDPR. You can correct most of your profile data yourself under Settings. You have the right to erasure, Article 17 GDPR, within the limits described in the previous section. You have the right to restriction of processing, Article 18 GDPR, for example while we check the accuracy of data you contest. You have the right to data portability, Article 20 GDPR. Under Settings, Data and privacy you can generate a machine-readable export of your profile, assets, listings, offers, deals, document list, verification status, notifications and reviews, and download it for seven days. You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, Article 21 GDPR. We will then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. Where processing is based on consent, you can withdraw it at any time with effect for the future, without affecting the lawfulness of what was done before. To exercise a right, use Settings, Data and privacy, or write to mail@escrow.international. We answer without undue delay and in any event within one month; where a request is complex we may extend that period by two further months and will tell you why.

11. 11. Right to complain to a supervisory authority

    You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, Article 77 GDPR. Our lead supervisory authority is the Estonian Data Protection Inspectorate: Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia Email: info@aki.ee If you are in Germany, you may instead contact the data protection authority of your federal state. A complaint to a supervisory authority does not affect your right to a judicial remedy.

12. 12. Automated decision-making and profiling

    We want to be precise about this, because two things in the platform are automated and only one of them decides anything. Matching calculates a score between a listing and a stated preference from objective factors such as intent, asset type, geography, value band, verification strength and timing. It suggests counterparties for you to consider. It produces no legal effect and does not similarly significantly affect you, so it is not a decision within the meaning of Article 22 GDPR. It is profiling in the sense of Article 4(4) GDPR, and you can object to it under Article 21 GDPR. Compliance screening does decide something. If a name screen produces a confirmed match, the account is automatically set to a prohibited risk level, which blocks publishing a listing, making or answering an offer and opening a deal room, and a compliance case is opened at the same time. We rely on Article 22(2)(b) GDPR for this: the processing is authorised by Union law that applies to us, namely the restrictive measures we are obliged to observe, and it exists to keep us from enabling a prohibited transaction. Safeguards apply to that decision. Every confirmed match creates a case that a human being reviews and decides. You have the right to obtain human intervention, to express your point of view and to contest the decision. Write to mail@escrow.international, and say that you are contesting a compliance block. Risk levels are also raised by that mechanism and are used to prioritise review. They are not sold, shared with other members or used for advertising.

13. 13. Security

    Access tokens are stored only in cookies that JavaScript in your browser cannot read, so a script injected into a page cannot steal your session. Two-factor authentication is available for every account and is required for the internal console. Access to a document requires an explicit permission or membership of the deal it belongs to. A document is never served on the strength of its identifier alone. Downloads run through short-lived, single-purpose links. Uploads are scanned for malware before they can be retrieved. Every legally material change writes an audit record. Passwords, two-factor secrets, tokens, identity document numbers and bank details are removed from our log output automatically, and we do not log the content of identity documents. Transport is encrypted with TLS. Access to the production systems is restricted to a small number of people, by key-based authentication only. No system is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority and, where the law requires it, you.

14. 14. Cookies and storage on your device

    The platform sets only strictly necessary cookies today and uses no analytics or advertising technology. The Cookie Policy lists every cookie by name, purpose and lifetime, and explains what else is stored in your browser.

15. 15. Children

    The platform is intended for adults. It is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a minor has registered, write to mail@escrow.international and we will close the account and delete the data.

16. 16. Changes to this notice

    We update this notice when the platform, its service providers or the law change. The date of the current version is shown at the top of this page. Where a change materially affects how we process your data, we will tell you before it takes effect.

17. 17. Contact

    Privacy questions, rights requests and complaints: MATTALNET GRUPP OÜ, Tuukri tn 19-315, 10120 Tallinn, Estonia mail@escrow.international You can also start an export or erasure request yourself under Settings, Data and privacy.