Privacy Policy
1. Who is responsible
TW CONSULTING & TRADE LTD., registered in Malta, company number C 108362, is the proposed controller for GIO's platform administration and services described here.
Registered office and EU office: Town's End, Block D / Office 2, Triq ta' Fuq il-Migduma, Mellieħa, MLH 1590, Malta.
Privacy requests: info@gioventure.com. Telephone: +356 2701 9052.
GIO is intended for people aged 18 or over, worldwide. Contact us if you believe a child has supplied information so we can assess and remove information where appropriate. Availability worldwide does not remove applicable local privacy rights.
2. Services and information
The intended launch includes membership subscriptions, payments, member profiles and messaging, project sharing, private document uploads, investor matching, TWire AI reviews and support chat. These services are planned; this Home design does not establish that their backend systems are operating.
Depending on the services you use, relevant information may include:
- Account and professional details: name, contact information, company, role, location, profile and investment preferences, login and subscription records.
- Community content: messages, group contributions, projects, expressions of interest and interactions you choose to make.
- Document-review information: files you deliberately submit, text and metadata needed for the review, instructions, generated feedback and review history.
- Payment information: billing details, order amounts, transaction identifiers, payment/subscription status, refunds and dispute records. WooCommerce is the intended commerce software and Stripe is the chosen payment service.
- Enquiries and support: correspondence, chat content and information you provide to resolve a request.
- Necessary technical records: connection and security information such as IP addresses, request times and device/browser details, subject to the final logging configuration.
Do not submit documents containing another person's information unless you have authority and an appropriate basis to do so. Minimise unnecessary personal data. Special-category information, identity documents and criminal-offence information need a separately assessed workflow; they are not a default requirement for an AI document review.
3. Why information is used
| Purpose | Proposed legal basis, subject to the implemented workflow |
|---|---|
| Accounts, subscriptions, requested matching, messages, uploads and AI reviews | Performance of the service contract, or requested pre-contract steps, where necessary |
| General enquiries, service administration, security, fraud prevention and proportionate community moderation | Legitimate interests, supported by documented assessments |
| Accounting, tax and other binding record-keeping duties | Applicable legal obligation |
| Optional device storage/access requiring consent | Consent before that activity starts |
No newsletters, promotional emails, advertising pixels or visitor-analytics programme are planned. Necessary account, billing, security and service notifications are different from marketing and may still be sent. Any future marketing programme would require a separate decision, disclosure and applicable permission.
4. Visibility and recipients
Membership does not make all information public. The launch must enforce profile/listing visibility choices, message recipients, document-room permissions and NDA/access requirements. Information deliberately shared with other members may also be retained by those recipients under their own responsibilities; platform deletion cannot recall copies already downloaded or messages kept independently.
Relevant suppliers include Hostinger for hosting and email, Stripe for the selected payment integration, and providers needed for document storage, AI processing and support chat. The design currently requests Google Fonts, which involves technical connection data. WooCommerce is installed software; its presence alone does not mean every record is sent to Automattic.
Stripe may act as a processor or an independent controller depending on the activity. Explain the final integration and applicable Stripe entity before launch; see Stripe's Privacy Policy.
Details awaiting confirmation: exact hosting/storage locations and contracting entities; connected AI operator and subprocessors; chosen live-chat provider; any verification or other suppliers actually added. Necessary professional/legal disclosures and valid authority requests must be handled under the applicable law.
5. TWire AI reviews
TWire will connect to a separately developed AI platform. The operator's legal identity, hosting countries, underlying model providers, access arrangements and actual retention terms have not been supplied.
Proposed requirements, not verified provider promises: send only the material needed for a requested review; restrict access; protect transfers and storage; prohibit provider training and unrelated reuse of customer documents under the processing contract; identify subprocessors and transfer safeguards; delete processing copies when no longer needed; support deletion requests and incident reporting.
The 12-month GIO document-retention target below must not automatically become a provider's permission to retain processing copies for 12 months. Provider retention should be limited to the review and an evidenced operational need.
Before activation, replace the unresolved details with the actual operator, data locations, approved retention, training/reuse terms and deletion process. Review outputs assist the user; the intended design must not automatically determine funding eligibility or other legally significant outcomes. If the implemented system differs, assess and disclose that use before launch.
6. Retention targets
These are the company's chosen or proposed launch rules, not a claim that deletion automation is already configured:
| Record | Target |
|---|---|
| Ordinary enquiries and support correspondence | 12 months after the last substantive interaction |
| Uploaded documents and AI feedback stored by GIO | 12 months from upload or creation, with earlier deletion requests assessed promptly |
| Ordinary account/profile and associated community records | Up to 12 months after account closure, unless a justified shorter or longer period applies |
| Company accounting records, including relevant financial records | Generally 10 years under Malta's Companies Act; classify records and calculate the applicable start date with the accountant |
| Security logs, backups and provider processing copies | Final periods still to be agreed and documented; use only the duration justified for each purpose |
The accounting exception does not justify retaining every uploaded document or message. Preserve only the records needed for an applicable obligation or specific dispute/security hold, restrict their use, and review the hold. Backups need a defined expiry cycle and a process preventing deleted records from being routinely restored into active use. Cookie expiry is addressed separately and is not automatically 12 months.
7. International handling and security
A Malta registered office does not establish where every supplier processes information. Map actual countries and remote access. Where a restricted non-EEA transfer occurs, identify the relevant lawful transfer mechanism and any required supplementary safeguards before processing starts. [Insert final provider/country and safeguard details, plus how to obtain a copy.]
The launch security design should include role-based access, owner-approved document permissions, secure transfer/storage, administrator protection and controlled deletion. Do not publish statements about encryption, certifications or storage regions that have not been verified.
8. Your rights and contact
Subject to the applicable conditions, you can request access, correction, deletion, restriction or portability of your information. You can object to processing based on legitimate interests. You may object to direct marketing at any time, should it ever be introduced. Where processing relies on consent, you can withdraw that consent; this does not change earlier lawful processing.
Contact info@gioventure.com. We may request proportionate evidence to verify identity. The intended request-handling process must support the GDPR's usual one-month response period and any permitted extension, with an explanation where needed.
You may complain to Malta's Office of the Information and Data Protection Commissioner (IDPC) through its complaint/contact page, or to another competent supervisory authority where applicable. You do not have to contact GIO before exercising a complaint right.
9. Cookies and changes
Read the Cookie Policy. Its final inventory must match the actual login, commerce, Stripe and chat configuration. This draft was published on 22 October 2026; the final effective date will be confirmed after review. Reassess the notice before adding providers, tracking, document uses or automated decisions.