Privacy Policy & Sovereign Data Shield

Sovereign Privacy Philosophy & Zero-Knowledge Architecture

In an era of unchecked algorithmic surveillance, data extraction, and unauthorized training of foundation models on confidential corporate assets, World Invest Center (“WIC,” “we,” “us”) establishes a sovereign standard for data protection.

We treat confidentiality and informational privacy not as discretionary compliance burdens, but as foundational prerequisites for strategic capital allocation. We collect only what is strictly required to execute high-stakes advisory mandates, verify corporate standing, ensure regulatory compliance, and safeguard our infrastructure against malicious attack.

Data Controller Identity & Sovereign Legal Chambers

The Data Controller responsible for processing personal and commercial information under the General Data Protection Regulation (EU GDPR Regulation 2016/679), UK Data Protection Act 2018 / UK GDPR, and the Swiss Revised Federal Act on Data Protection (nFADP / revDSG) is:

Categories of Personal & Institutional Data Processed

Depending on your level of interaction with our public portal, private terminals, or advisory engagements, we process the following categories of data:

• Executive Identification & Contact Data: Name, corporate title, company name, professional email address, telephone or encrypted Signal handle, and verified professional accreditation status provided through contact forms, intake scanners, or booking flows.
• Deal, Mandate & Financial Intake Data: Investment parameters, target check sizes, current valuation multiples, capitalization table structures, asset class specifications, and strategic objectives provided during War Room sessions, Deal Room submissions, or audit scoping.
• Payment & Billing Metadata: Transaction identifiers, customer tokens generated by Stripe, Inc., billing addresses, and VAT/tax registration numbers. Note: WIC never accesses, stores, or processes complete credit card numbers (PANs) or Card Verification Values (CVVs); all financial processing is executed directly inside Stripe’s certified PCI-DSS Level 1 environment.
• Technical Node Telemetry & Security Logs: Internet Protocol (IP) addresses (anonymized and salted within 30 days), TLS cipher suite handshakes, operating system and browser headers, and session latency metrics collected exclusively for firewall routing, anti-DDoS mitigation, and application integrity.

Lawful Grounds for Processing (GDPR Art. 6 / Swiss nFADP)

We process your data strictly under recognized legal bases established in European and Swiss jurisprudence:

Real Intelligence™ (RI) Processing & Zero AI Model Training Guarantee

Sub-Processors, Third Parties & Strict Zero-Sale Covenant

WIC maintains an unalterable commercial policy: We do not sell, rent, monetize, trade, or disclose client data to data brokers, third-party advertisers, or marketing conglomerates under any circumstance.

We engage only vetted, mission-critical infrastructure sub-processors bound by stringent Data Processing Addendums (DPAs):

• Stripe, Inc. (United States / EU): Payment processing and PCI-DSS Level 1 certified billing infrastructure.
• Private Mail Gateway & AWS SES (Stockholm / Ireland): Transactional email distribution for audit deliveries and encrypted communications.
• GLAW Court of Arbitration (Lex Cognitiva): Solely in the event of formal arbitral proceedings invoked by either party under the 1958 New York Convention.
• Statutory Authorities: Disclosures made solely where mandated by enforceable judicial subpoenas, court orders, or statutory anti-money laundering reporting requirements.

Cross-Border International Transfers & Jurisdictional Safeguards

World Invest Center operates across primary nodes in the United Kingdom, Switzerland, and the European Union. Where personal data originates in the European Economic Area (EEA), United Kingdom, or Switzerland and is accessed across borders, we implement robust transfer mechanisms:

• Adequacy Decisions: Mutual recognition of adequacy between the EU, UK, and Switzerland under European Commission decisions and Swiss Federal Council determinations.
• Standard Contractual Clauses: Integration of European Commission Standard Contractual Clauses (SCCs, Implementing Decision (EU) 2021/914) with supplementary technical encryption measures for any third-country processing.
• Zero Exposure to Surveillance Laws: We maintain strict operational protocols to prevent bulk extraterritorial surveillance requests from compromising client sovereign assets.

Retention Schedules & Ephemeral Deletion Cycles

We adhere to strict data minimization and purposeful retention schedules:

• Active Advisory & Mandate Dossiers: Retained for the active duration of the engagement plus five (5) years following closure to comply with statutory corporate limitation periods and accounting obligations.
• Preliminary Intake & Micro-Audit Submissions: Data provided through the online risk scanner is anonymized or permanently purged ninety (90) days after generation if no formal engagement is initiated.
• Security & Web Server Logs: Network telemetry and hashed IP logs are rotated and deleted automatically every thirty (30) days.
• Newsletter Subscriptions: Retained until the subscriber exercises the 1-click unsubscribe option, after which email records are permanently expunged within 48 hours.

Your Sovereign Data Subject Rights (GDPR Arts. 15–22 / Swiss nFADP)

Under the GDPR, UK GDPR, and Swiss nFADP, you possess comprehensive, directly actionable rights regarding your personal information:

• Right of Access (Art. 15): You have the right to request a complete, cryptographically verified record of all personal data held concerning you.
• Right to Rectification (Art. 16): You may request the immediate correction of inaccurate or incomplete corporate or individual information.
• Right to Erasure / “Right to be Forgotten” (Art. 17): You may request the permanent deletion of your data where retention is no longer necessary for contract fulfillment or statutory legal obligations.
• Right to Restriction of Processing (Art. 18): You may suspend active processing while data accuracy or legal claims are contested.
• Right to Data Portability (Art. 20): You may receive your data in a structured, machine-readable JSON format.
• Right to Object (Art. 21): You may object at any time to processing based on legitimate interest or direct communications.

To exercise any sovereign right, transmit your request directly to dpo@worldinvestcenter.com. We respond within a mandatory maximum SLA of thirty (30) calendar days.

Security & Encryption Standards (Technical & Organizational Measures)

WIC implements bank-grade defense-in-depth security architectures:

• Encryption in Transit: Mandatory TLS 1.3 encryption across all public and internal API endpoints with HTTP Strict Transport Security (HSTS max-age=31536000 with preloading).
• Encryption at Rest: AES-256 encryption applied to all database partitions, persistent disk volumes, and document archives.
• Access Isolation: Strict Zero-Trust Architecture with role-based access controls (RBAC) and hardware-token multi-factor authentication (MFA).
• Breach Notification SLA: In the extraordinary event of a security incident affecting personal data integrity, WIC covenants to notify affected clients and competent supervisory authorities within seventy-two (72) hours of confirmed detection in compliance with GDPR Art. 33.

Digital Services Act (DSA) Compliance & Fast-Track Regulatory Point of Contact

In accordance with Articles 11 and 12 of Regulation (EU) 2022/2065 (Digital Services Act – DSA), WIC designates a direct, single point of contact for European regulatory authorities and users:

Inquiries, Policy Evolution & Supervisory Authorities

WIC reviews and updates this Privacy Policy periodically to reflect emerging jurisprudence and technological enhancements. Substantive updates will be published on this page with an incremented revision timestamp.

If you believe our processing infringes your statutory privacy rights, you possess the legal right to lodge a formal complaint with the competent supervisory authority:

• United Kingdom: Information Commissioner’s Office (ICO) – ico.org.uk
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC) – edoeb.admin.ch
• European Union: The Data Protection Authority of your EU Member State of habitual residence, place of work, or place of the alleged infringement.