Privacy Policy

Who We Are and What This Policy Covers

BRIKS Advisory ("the Firm," "we," "our," or "us") is a financial intelligence advisory firm incorporated and operating in the Cayman Islands. We deliver the Operator Intelligence Engine (OIE), a suite of analytical products for real estate developers, operators, and investors across the Cayman Islands, the United Kingdom, and the wider Caribbean region.

This Privacy Policy explains how we collect, use, store, share, and protect personal data in connection with our services, website at vantage-advisory.co, and all client engagements. It applies to prospective clients, current clients, website visitors, and any individuals who submit data to us in the course of engaging with our products.

Identity of the Data Controller

For the purposes of applicable data protection legislation, the data controller responsible for your personal information is:

We are registered with the Cayman Islands Office of the Ombudsman as required under the DPA 2017. Where our processing activities engage UK data subjects, we comply with the UK GDPR obligations applicable to controllers without a UK establishment that target UK residents.

What Personal Data We Collect

We collect personal data only to the extent necessary to deliver our services and maintain secure, effective client relationships. The categories of data we may collect include the following.

• Full legal name and preferred name
• Business or company name and jurisdiction of incorporation
• Email address and telephone number
• Correspondence address or registered office address
• Professional role or title

• Property or project information submitted for analysis, including location, asset type, purchase price, and projected returns
• Financial assumptions, capital stack details, and development cost schedules provided by the client
• Investment objectives, risk parameters, and exit strategies as disclosed in engagement briefs

• IP address, browser type, and device information
• Pages visited on vantage-advisory.co, time and duration of visits
• Cookie identifiers and session data (see Section 9)
• Form submission data including enquiry content and deal brief entries

• Invoice details and records of payments received
• We do not store card numbers or banking credentials. Payment processing is handled by third-party processors (see Section 7).

• Email correspondence, meeting notes, and records of consultations
• Feedback, reviews, or responses submitted to us

Legal Basis for Processing

Under the UK GDPR and consistent with the principles of the Cayman Islands DPA 2017, we process personal data under the following lawful bases.

Where we rely on legitimate interests as a lawful basis, we have assessed that our interests do not override the rights and freedoms of affected individuals.

How We Use Your Personal Data

We use collected data for the following purposes only, and we do not process data in ways that are incompatible with these purposes.

• To assess and respond to deal submissions, engagement enquiries, and client briefs
• To produce and deliver Deal Intelligence Reports, Investment Committee Underwrites, Portfolio Reviews, and Intelligence Toolkit products
• To manage client accounts, invoicing, and project correspondence
• To issue relevant firm updates, product announcements, or market intelligence to clients who have consented to receive such communications
• To maintain business records in compliance with applicable accounting, regulatory, and contractual obligations
• To monitor and improve the performance and security of our website and digital tools
• To protect against fraudulent submissions or misuse of our services

We do not use personal data for automated decision-making that produces legal or similarly significant effects without human review.

Data Storage and Security Measures

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it from unauthorised access, loss, disclosure, or destruction.

Data is stored in cloud-based platforms and CRM systems operated by reputable third-party providers. Storage locations may include servers in the United States, the European Economic Area, and the United Kingdom. Where data is transferred internationally, we ensure appropriate safeguards are in place consistent with UK GDPR requirements (including standard contractual clauses where applicable) and the Cayman Islands DPA 2017.

• Encrypted transmission of data (TLS/HTTPS) across all website and platform interactions
• Access controls limiting data access to authorised personnel only
• Password protection and multi-factor authentication on key systems
• Regular review of third-party processor security practices
• Secure file delivery through access-controlled document sharing systems

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals, in accordance with applicable law.

Third Party Disclosure and Data Processors

We do not sell, rent, or trade your personal data. We may share your data with the following categories of third parties, solely for the purposes described in this policy.

We use third-party software platforms to operate our business, including CRM, email, payment processing, and file delivery tools. These providers are contractually bound as data processors and may only process your data on our documented instructions.

Payment transactions are handled by third-party processors. We do not handle or store payment card data directly. The relevant processor's privacy policy governs their handling of payment data.

We may share data with legal, accounting, or compliance advisors where required to meet a legal obligation or protect our legitimate interests. Such advisors are bound by professional confidentiality obligations.

We may disclose personal data to regulatory authorities, courts, or law enforcement agencies where required by law or lawful order, including the Cayman Islands Office of the Ombudsman, the UK Information Commissioner's Office, or other competent bodies.

Cross-Border Data Transfers

Given the multi-jurisdictional nature of our operations, personal data may be transferred between the Cayman Islands, the United Kingdom, and other territories in the course of delivering our services or maintaining our technology infrastructure.

Where personal data relating to UK data subjects is transferred outside the UK, we apply safeguards recognised under UK GDPR, including reliance on adequacy decisions or execution of International Data Transfer Agreements (IDTAs) as applicable.

Where personal data relating to Cayman Islands data subjects is transferred internationally, we ensure that the recipient jurisdiction provides an adequate level of protection consistent with the requirements of the DPA 2017, or that appropriate contractual safeguards are in place.

Clients in the wider Caribbean region are advised that their data may be processed in jurisdictions outside their country of residence. We take reasonable steps to ensure that any such processing meets a standard equivalent to the protections described in this policy.

Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to support site functionality, analyse usage, and improve the visitor experience. A cookie is a small data file placed on your device when you visit our site.

You may withdraw consent for non-essential cookies at any time by adjusting your browser settings or using the cookie preference tool on our website where available. Disabling certain cookies may affect the functionality of our site.

Data Subject Rights

Depending on your jurisdiction of residence, you may hold some or all of the following rights in relation to your personal data. We will respond to verified requests within the timeframes required by applicable law (generally 30 days under UK GDPR; one month under the Cayman Islands DPA 2017).

• Right of Access: You may request confirmation of whether we hold personal data about you and, if so, a copy of that data along with relevant processing information.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data held by us.
• Right to Erasure: In certain circumstances, you may request deletion of your personal data where there is no continuing lawful basis for its retention.
• Right to Restrict Processing: You may request that we limit the way in which we process your data in defined circumstances.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request your data in a commonly used, machine-readable format (UK GDPR).
• Right to Object: You may object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, submit a written request to [email protected]. We may require identity verification before actioning your request.

Data Retention Periods

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law or regulation.

On expiry of the applicable retention period, data is securely deleted or anonymised in a manner that prevents re-identification.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable legal requirements. We will post the revised policy at vantage-advisory.co/privacy with an updated effective date.

Where changes are material, we will notify active clients by email or through our client portal. Your continued use of our services following notification constitutes acceptance of the updated policy.

Data Requests and Privacy Enquiries

All data subject requests, privacy concerns, or questions relating to this policy should be directed to our designated data contact. We aim to acknowledge all requests within 5 business days and resolve them within the timeframe required by applicable law.