Privacy notice

This notice explains how markst collects, uses, and protects personal data when you use the Verus platform, our website, or otherwise interact with us.

1. Who we are

markst is the data controller for personal data processed in connection with the Verus private-credit valuation platform. You can contact our Data Protection Lead at dpo@markst.com (the dpo@ alias is retained as the role mailbox; markst is below the UK GDPR threshold that would require a statutory Data Protection Officer, so the role title is Data Protection Lead).

2. What data we collect

Account data — name, work email, role, and organisation when you register or are provisioned for access.
Demo-request data — when you submit the form at /book-demo: name, work email, firm, role, AUM bracket (optional), any notes you write, your IP address, user-agent, and the UTC timestamp of your NDA acknowledgement.
Usage data — pages viewed, actions taken, valuations run, and API calls made, together with timestamps and IP address.
Content you upload — deal documents, financial statements, and assumption sets. These are processed on your instructions and remain under your control.
Support correspondence — messages you send to us and our replies.

3. Why we use it (lawful bases)

Contract — to provide the Verus service and fulfil our agreement with your organisation.
Legitimate interests — to respond to demo requests (pre-contractual engagement), secure the platform, detect abuse, improve reliability, and develop the product.
Legal obligation — to comply with tax, accounting, and regulatory requirements.
Consent — for non-essential cookies and marketing communications, where applicable.

4. Who we share data with (sub-processors)

We use the following sub-processors to deliver Verus and the markst website. Each operates under a written data-processing agreement with us and processes personal data only on our documented instructions:

Cloudflare, Inc. (US / global) — CDN, DNS, TLS, bot management, and static hosting for markst.com. Processes access logs, IP addresses, and request metadata. Relies on Cloudflare's UK International Data Transfer Addendum and EU SCCs.
Google LLC (US / global) — Google Workspace: transactional email for demo-request confirmations, NDA delivery and Verus platform notices, sent via the Gmail API and the Workspace SMTP relay, plus the markst.com mailboxes that receive your correspondence. Processes the name, email, firm, role, AUM, notes and NDA-ack timestamp you submit, and message content. Google operates under the Google Workspace DPA with EU SCCs and the UK IDTA Addendum.
Attio Limited (UK) — CRM used for demo-request and prospect follow-up. Processes prospect contact details (name, work email, firm, role) and outreach history. Holds no Verus platform data. Hosted on Google Cloud; operates under the Attio DPA with EU SCCs and the UK IDTA Addendum.
Amazon Web Services, Inc. (Verus application hosting, EU-West-2 London region) — cloud hosting and storage for the Verus backend. Customer data at rest stays within the chosen AWS region (UK eu-west-2 by default). Where AWS's US-based control-plane operations touch metadata, transfers rely on the SCCs + UK IDTA Addendum executed with AWS.
GitHub, Inc. (US) — source-code hosting and continuous-integration builds. Processes deploy logs and commit metadata only; no customer personal data.
Anthropic PBC (United States) — large- language-model inference used only when AI extraction or summarisation features are enabled. Prompt contents (excerpts of deal documents or user prompts) transit the Anthropic Enterprise API under contractual terms that prohibit training on customer data and apply a short input- retention window. Scope, controls, and opt-out are documented at /legal/ai-usage. A locally hosted private-LLM alternative is available for customers who require inference inside their own network.

The canonical, current sub-processor register is published at /legal/subprocessors. Material changes are notified to customer contacts in advance — register for notifications at dpo@markst.com.

We do not sell personal data. We do not use your uploaded deal content to train third-party models.

5. International transfers

Some sub-processors (notably Cloudflare, Google, Anthropic, and AWS) process data in the United States and other jurisdictions outside the UK and EEA. Where this happens we rely on the following transfer mechanisms under UK GDPR Article 46 and EU GDPR Chapter V:

UK International Data Transfer Addendum to the EU Standard Contractual Clauses, executed with each US sub-processor.
EU Standard Contractual Clauses (2021/914), modules 2 and 3 as applicable.
Supplementary technical measures — TLS 1.3 in transit, AES-256 at rest, access logging, regional data residency where available.

A Transfer Impact Assessment is available on request.

6. Retention

Demo-request & NDA envelope data — retained for up to 12 months from last activity, or until you ask us to delete it (whichever is sooner). If a demo does not lead to a contractual relationship within that window, the lead record and its associated demo-request and draft NDA envelope rows are purged. Signed NDA PDFs are retained for the duration stated in the NDA itself (typically three years plus survival), which supersedes this shorter default.
Account and usage data — retained for the life of your contract plus up to six years to meet statutory records obligations.
Uploaded content — retained under your instructions and deleted or returned on termination per the service agreement.
Audit logs of AI usage — retained for the life of your contract plus up to six years. See /legal/ai-usage.

7. Your rights

Under UK and EU GDPR you have rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw any consent you have given. The workflow below applies to every data-subject access request (DSAR) we receive.

Submit the request. Email dpo@markst.com with subject DSAR. Include the name and email the request applies to, the right being exercised (access, erasure, rectification, restriction, portability, objection, withdraw-consent), and any scope constraints (a specific period, a specific data category).
Identity verification. For security, we verify that the requester is the data subject (or an authorised representative). Verification is proportionate to the sensitivity of the data held — typically confirming the request from the email address of record. We will not demand more ID than strictly necessary.
Response SLA. We respond within one calendar month of a verified request, as required by UK GDPR Article 12(3). For complex or numerous requests, we may extend by a further two months and will tell you within the first month if that applies, together with the reason.
Format. Access and portability responses are delivered in a structured, commonly-used, machine-readable format (JSON by default; CSV on request).
Fees. DSARs are free. We reserve the right to charge a reasonable administrative fee or refuse manifestly unfounded or excessive requests (Article 12(5)); in practice this will be rare and we will explain the basis.
Refusal grounds. Where we cannot honour a request in full (e.g. legal record-keeping obligations preventing full erasure), we will identify which parts of the request we can satisfy and explain why others are refused or limited, and your route to complain.
Complaints and supervisory authority. You may lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk. In the EU, contact your local supervisory authority. This right is independent of, and in addition to, any remedy under §8 below.

8. Security

We apply administrative, technical, and physical safeguards appropriate to the risk, including encryption in transit and at rest, least- privilege access, audit logging, and periodic reviews.

9. Changes

We will update this notice as our practices evolve. Material changes will be communicated in-product or by email to your account contact.

Privacy Notice