Investor Portal privacy notice

The DILS Investor Portal

When DILS invites you to, or gives you access to, the DILS Investor Portal (the secure web application used to manage commercial-real-estate transactions and investor relationships), we process the following personal data about you.

Personal data we process in the portal

• Account & identity: your name, business email address and an encrypted password; your role and the company/companies you are associated with.
• Contact details: name, business email and telephone number of contacts at investor, broker and advisory firms (these may be entered by a DILS employee or a broker on your behalf).
• Transaction data: the deals you are associated with, your interest level, and any bid/offer amounts you submit.
• Electronic signatures: when you sign a document in the portal (e.g. an NDA), your name, email, the signature image and the signed document, plus the IP address and browser identifier recorded at the time of signing.
• Communications: invitation and notification emails we send you, and notes/comments DILS staff record about the relationship.
• Technical & security data: sign-in events, IP address and activity logs used to keep the portal secure.

Why we process it and on what legal basis

• To give you access to and operate the portal for you — performance of a contract (Art. 6(1)(b) GDPR).
• To manage the deal pipeline and our investor/broker relationships, and to keep the portal secure and prevent abuse — our legitimate interests (Art. 6(1)(f) GDPR) in running our real-estate advisory business securely. You may object to this processing (see “Your rights”).
• To comply with legal obligations, including any applicable record-keeping and anti-money-laundering rules — legal obligation (Art. 6(1)(c) GDPR).

Source of your data

If you did not give us your details yourself, they reached us through one of the following (Art. 14(1)(f) GDPR):

• provided by your firm, as part of an existing business relationship;
• shared by a DILS deal contact (e.g. a broker or advisor working the transaction);
• a public business source (e.g. a company register or firm website);
• or entered by yourself, for example via the “request access” form.

Who we share it with

The portal is operated using a small number of carefully selected service providers who process data on our behalf under a data-processing agreement:

• Supabase (EU — Ireland) — database and private file storage.
• Vercel — application hosting.
• Mailgun (EU endpoint) — transactional email.
• Upstash — rate-limiting / security.

International transfers. Portal data is hosted within the European Economic Area (EEA). Where a provider’s parent company is outside the EEA, transfers are protected by an adequacy decision (the EU-US Data Privacy Framework) and/or the European Commission’s Standard Contractual Clauses.

How long we keep it

• Signing tokens and unaccepted invites: deleted 30 days after they expire.
• Activity logs: kept 24 months.
• User accounts: kept for the life of the account plus 12 months after deactivation.
• Deal/tracking data: kept for the active deal plus 24 months after it closes or drops.
• Signed documents and signatures: kept for the statutory/AML retention period (generally at least 5 years), under legal hold — not deleted automatically.

Your rights

You have the right to access, rectify, erase, restrict or object to the processing of your data, and the right to data portability. To exercise these rights for portal data, contact privacy.netherlands@dils.com. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Cookies

The portal uses only a strictly-necessary cookie to keep you signed in; it does not use analytics or marketing cookies, so no cookie banner is shown there. See our Cookie Policy for the cookies used on dils.nl.