Privacy Policy

01Who we are

The controller of your personal data is HYPER TARGET S.R.L., a limited liability company registered in Romania with the Trade Register under number J2026005185003, fiscal code (CUI) 53489278, with its registered office at Intrarea Reconstrucției nr. 6, Sector 3, Bucharest, Romania ("The Discreet Investor", "we", "us").

For any privacy question or request, contact our data protection team at office@thediscreetinvestor.com or by phone / WhatsApp on +44 7365 874434.

This policy applies to visitors of thediscreetinvestor.com, to people who contact us, and to our clients and the family members, company owners and other people included in their files.

02What we collect

When you contact us — through the brief form, email, phone or social media: your name, country, email address, phone number, the services and regions you are interested in, your message and the page you wrote from. If you use our cost calculator and then ask for a quote, the family composition and figures you chose are added to your message.

When you book a paid orientation session — through our booking provider Cal.com: your name, email address, phone number if you give it, the time you choose, your answers to the booking questions and your confirmation about the withdrawal period. Card payments are processed by Stripe; we receive confirmation of the payment, never your full card details.

When you apply to become a partner — your name, firm, profession, country, contact details, website, the partnership model and volume you indicate and your message; if we proceed, the identity and company documents needed for our partner checks.

When you use the client area — your account details (name, email, country, phone number and language), your password (stored only as a one-way hash), the documents you upload, the messages you exchange with us, the progress of your case, and a security log of sign-ins and actions in your account with date, time and IP address.

When you become a client — the information Authorities, Partners and anti-money-laundering law require, for you and each person on the file. Depending on the service, this can include:

• identity data: passports, national ID, photographs, date and place of birth, nationality, signatures;
• family data: birth, marriage and divorce certificates, adoption and custody documents, including data about children;
• contact and residence data: addresses, proof of address, residence history;
• financial data: source of funds and wealth, bank statements, tax returns, company documents, payment information;
• background data: police certificates, sanctions and adverse media screening results, political exposure (PEP) status, previous visa or citizenship decisions;
• health data: medical certificates, where a programme requires them.

Criminal record and health data are especially sensitive. We collect them only where an Authority requires them for your application, and handle them with additional care.

When you browse — we use no advertising cookies. If you accept analytics, Google Analytics records pseudonymous usage data (pages viewed, approximate location, device type, clicks on our contact buttons); without your consent it does not run. Technical data such as your IP address, browser type and the pages requested are processed by our hosting provider in server logs. Fonts and images are served from our own server, so no other provider receives this data while you simply browse (see the Cookie Policy). The one exception is the Trustpilot widget on our home page and case studies page: it loads from Trustpilot’s servers, which receive your IP address and browser details, as with any embedded content.

From third parties — due diligence and screening providers, Authorities and Partners (for example, a request for further documents or a decision), public registers, and the person who introduced you to us.

03Why we use it, and our legal basis

Where we rely on legitimate interest, we have balanced it against your rights; you can object at any time (see Your rights). We do not make decisions about you based solely on automated processing.

04Who we share it with

We share personal data only with the parties your file requires, and only what they need:

• Authorities — citizenship and investment units, immigration offices, company registries and consulates deciding on your applications;
• Partners — licensed local agents, law firms, banks, approved developers, fund administrators, escrow agents, notaries, translators and couriers working on your file;
• due diligence providers engaged by us, a Partner or an Authority to verify your background;
• our service providers — website and email hosting (the website forms are delivered by our own server straight to our mailbox), website analytics (Google Analytics, only with your consent), consultation booking (Cal.com), card payments (Stripe) and document storage — who process data on our instructions under confidentiality and data-processing terms;
• the professional who introduced you, if any — only that you opened an account and, if you allow it in your account, the stage of your case; never your documents or messages;
• professional advisers — accountants, auditors, insurers and lawyers under a duty of confidence;
• law enforcement and regulators, where the law requires it.

Stripe also processes some payment data as an independent controller, for example to prevent fraud, under its own privacy policy.

We never sell your personal data, and we do not share it for advertising.

05International transfers

By their nature, our services involve sending data to other countries — to the governments of the programmes you choose and to Partners abroad, many of them outside the European Economic Area and the United Kingdom.

Transfers needed to deliver the service you asked for (for example, filing your application with a Caribbean citizenship unit) are made because they are necessary for the performance of our contract with you. Transfers to our service providers outside the EEA are protected by an adequacy decision or by standard contractual clauses approved by the European Commission. You can ask us for more information about the safeguards used.

06How long we keep it

• Enquiries that do not lead to an engagement — up to 24 months after our last contact, so we can answer follow-up questions, then deleted.
• Client files — for the duration of the engagement and then for at least five years after it ends, or longer where anti-money-laundering, tax or accounting law requires, or while a legal claim is possible.
• Server logs — kept by our hosting provider for a short period for security and troubleshooting.
• Client area — documents and messages are kept like client files (above). If you open an account but never become a client, we delete it at your request. The security log of the client area is kept for 24 months.

When the retention period ends, we delete or anonymise the data securely.

07How we protect it

We use access controls, encrypted storage and transmission, and least-privilege sharing: each Partner receives only the documents they need. Staff and Partners are bound by confidentiality. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the competent authority where the law requires it.

In the client area, every document and message is encrypted on our server with its own key (XChaCha20-Poly1305); the master key is kept outside the website, and the servers are in the European Union. Every sign-in is confirmed with a one-time code, and staff accounts also use an authenticator app. The emails we send you never contain the content of your messages or documents.

Please send identity and financial documents only through the client area or another channel we give you for your file, not through social media messages.

08Your rights

Depending on where you live, you have the right to:

• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• delete data we no longer need or process unlawfully;
• restrict processing, or object to processing based on our legitimate interests;
• data portability — receive data you gave us in a structured, machine-readable format;
• withdraw consent at any time, without affecting processing already done;
• if you live in California or another US state with a privacy law, know what we collect and opt out of any sale or sharing — we do neither.

Some rights are limited by law: we cannot delete data we must keep under anti-money-laundering rules, for example. Use the form on Your privacy choices or email office@thediscreetinvestor.com. We reply within one month and may ask you to confirm your identity first.

You also have the right to complain to a data protection authority — in particular the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro), or the authority of the country where you live or work.

09Children

Our website and services are for adults. We process children's data only when a parent or legal guardian includes them as dependants in a family application, and only as the Authority requires.

10Changes to this policy

We update this policy when our practices or the law change. The current version is always on this page, with its "last updated" date; we will tell clients directly about significant changes.