NGP Data Room privacy notice

Effective October 14, 2026

Next Gen Professionals Management, LLC

This notice explains how Next Gen Professionals Management, LLC (NGP) uses personal information for the private investor data room. The notice applies to invited data-room users and administrators. Separate investment and professional agreements govern those relationships.

Who is responsible

NGP determines the purposes and methods of processing personal information for the data room. This role is called the data controller where that term applies. NGP’s mailing address is 13833 Wellington Trace Blvd E4-306, Wellington, Florida 33414, United States.

The privacy contact is joannaspeed@nextgenprofessionals.net. Privacy questions and requests can use the subject “Data room privacy”. Sign-in credentials stay private to the account holder.

Information and sources

Invitation and account information includes name, email address, account identifiers, investor or administrator role, invitation details, room membership, document permissions, access dates and revocation status. An NGP administrator supplies invitation information. Account holders and the organizations represented by account holders can also provide contact information directly.

Sign-in information supports account verification and a secure session. Google sign-in provides account identity and profile information through Google and the authentication service. NGP uses the account identifier, email address and available name to establish the account. Google manages the Google account password. An issued access code provides a separate sign-in method.

Access records include recorded sign-in starts, latest recorded activity, confirmed explicit sign-outs, document-content preparation and permitted-download events. An event can identify the account, room, document version, time and outcome. An unobserved sign-out or browser closure leaves the session end unknown.

Optional viewing estimates add visible document-page events and estimated active document viewing time. NGP collects these estimates after the account holder chooses “Allow viewing estimates”. Updates occur every 30 seconds while the document is visible and the browser tab has focus. Measurement pauses when the document is hidden or the tab loses focus. Overlapping viewing periods count once for a person or session. Document and page totals describe their own viewing periods and can overlap with each other.

NGP stores the current viewing choice, wording version, choice time and account revision. NGP also uses a small browser record to remember a pending basic-access choice. It contains an opaque account reference and a random request reference. This record supports pausing optional estimates in that browser through page changes, tabs and refreshes while confirmation is pending. The record is cleared when the pending choice is confirmed or a new allowance is deliberately saved. The account holder can choose basic access records and change the choice in Privacy settings. Document access remains available with either choice. A change applies to future optional viewing estimates. Earlier recorded events and estimates remain subject to the retention and rights provisions below.

Electronic-signature records include the legal name entered, typed signature, signing-intent and electronic-record confirmations, signing time and agreement version. NGP links the signature to the account, invitation and room. NGP stores the completed agreement as a private PDF with the recipient name, signing date and time, agreement version and confirmation number. File reference, size and integrity information support checks of the saved copy.

NGP records a video playback request with the account, signed-in session, video reference and request time before opening the Google player. A retry of the same request retains one history entry. The record confirms that playback was requested. Video receipt, time watched and completion are separate from that request.

Google video playback is a separate choice. Opening the Google player connects the browser to Google, which receives technical information such as IP address and browser information and can use cookies. Google can associate playback with a Google account that is signed in. The account holder can keep the player closed and continue using permitted documents. Closing the player stops this site loading that player. Earlier Google processing and cookies are managed through the browser and Google account under Google’s privacy practices.

Support information includes messages supplied when requesting help. Hosting and authentication services can process technical information such as IP address, browser information, request times, error details and security logs.

Necessary sign-in cookies are small browser records that maintain an authorized session and complete Google sign-in. Account permission checks continue to control room and document access.

Browser “Do Not Track” signals leave the data room’s collection settings unchanged. The account holder’s choice in Privacy settings controls optional viewing estimates.

Administrator access

Authorized NGP administrators can see account access, recorded sign-in starts, latest recorded activity, confirmed explicit sign-outs and document-access events. Where optional viewing estimates are allowed, the administrator can also see document versions, visible pages and estimated focused viewing time. Access to permitted-download and security records is restricted to authorized personnel who need those records to manage or protect access.

A document-content event records server preparation of permitted content before the response is sent. Browser receipt, reading, understanding and agreement are separate from that event. A permitted-download event records the service action; saving and reviewing the file are separate actions. Viewing estimates describe observed visibility and focus. Recorded sign-in spans and focused viewing estimates are separate measures. Historical viewing time and unobserved session endings remain unknown.

Activity records cover the account, session, document and page events described here. Screen images, pointer movements, keystrokes and investor-interest scores remain outside these records. Each investor’s activity is restricted to authorized NGP personnel.

Signing events identify the account, invitation, room, signature reference, agreement version and signing time. Permission checks protect signature records and completed agreements. NGP uses these records as evidence of the electronic signature and to provide the completed agreement.

Purposes and choices

NGP uses information to administer invitations, verify identity, provide permitted documents, enforce access dates and revocation, respond to support requests, protect confidential materials and investigate access or security problems. Relevant records can also support a specific legal obligation or dispute.

Where EU or UK data-protection law applies, the stated basis for necessary administration and security is NGP’s legitimate interests in operating a requested, invitation-only service and protecting accounts and confidential information, balanced against the individual’s rights. Processing genuinely necessary for a contract or requested steps before a contract uses that basis. A legal-obligation basis applies to processing required by a specific applicable duty.

Optional viewing estimates use the account holder’s separate affirmative choice. Privacy settings provides an equally accessible choice to use basic access records and stop future optional estimates. Google identity sign-in and optional viewing estimates serve separate purposes. An invitation provides data-room access information and keeps marketing subscription separate.

Necessary identity, sign-in and permission information supports verification and document access. Account verification and the permissions assigned to the account determine the available documents. Signing out clears the application session cookie and requests closure of the sign-in session. Recorded sign-out history reflects independently confirmed closure.

Recipients and service providers

NGP limits access within NGP to personnel who need information for administration, support, security or an applicable legal purpose. Supabase provides authentication, database services and private storage for documents and completed agreements. Vercel provides website hosting and delivery. Google processes information when the account holder uses Google sign-in or chooses to open the Google video player.

Resend delivers account emails. The email and mailbox services involved in invitation and support correspondence process recipient addresses, message content and related delivery information. Relevant information can be disclosed to professional advisers under appropriate confidentiality or to an authority where disclosure is required by law. NGP limits disclosure to the operational and legal purposes described here; personal information remains outside data sales and cross-context behavioral advertising.

Service providers process information under the terms applicable to their services. Providers can also process technical or account information for their own security and operational purposes. Google’s privacy policy describes processing by Google services.

International processing

NGP operates in the United States and uses service providers with international operations. The database’s selected hosting region is London. Other service, support and security operations can involve the United States and other countries.

International-transfer protection follows the requirements of applicable law and the arrangements applicable to the relevant service. Information about service locations and applicable safeguards is available through the privacy contact, including requests for copies with confidential details removed.

Retention

Room access follows the terms assigned to the account, including no end date where granted. Revocation or an existing end date ends document access. Account, invitation, activity, signature and provider records are retained separately from room permission. Signature records and completed agreements can remain stored after room access ends.

Retention depends on the purpose of the record, active account relationships, unresolved access or support issues, specific security incidents or disputes, and applicable legal recordkeeping duties. A specific need or legal hold applies to the relevant records. Account and invitation records are considered separately from routine activity and technical logs.

Investment, tax and contractual records can have separate retention requirements. A signed agreement or acknowledgment supplies its own evidence. Provider logs, backup copies and live account records can have different retention arrangements. The privacy contact handles requests about the period applicable to particular records and requests for deletion.

Security and access decisions

Account verification and permission checks restrict room and document access. Account holders protect access codes and sign out on shared devices. Security measures reduce risk; online services retain security risks.

The service checks identity, role, room permission and expiry before providing access. Investment eligibility, creditworthiness and similar decisions remain separate from data-room activity records. NGP provides human review of disputed access decisions through the privacy contact.

Individual rights

Depending on applicable law and the circumstances, individuals can request access or correction, deletion, restriction, and a portable copy where applicable. Consent-based processing includes the right to withdraw consent. Withdrawal applies to future processing and preserves the legal assessment of processing before withdrawal. NGP can request proportionate identity-verification information, keeping access codes private.

Where legitimate interests apply and the applicable law provides a right to object, an individual can object because of the individual’s particular circumstances. NGP considers the objection and explains the outcome and any lawful reason for continuing relevant processing.

NGP responds within the period required by applicable law and explains permitted restrictions, refusals or extensions. Where applicable, an individual can appeal by replying to the privacy contact with “Privacy appeal”. Raising a concern preserves applicable legal rights.

Individuals can complain directly to the relevant data-protection authority. In the United Kingdom, the authority is the Information Commissioner’s Office, telephone +44 303 123 1113. In the European Economic Area, individuals can contact the authority where the individual lives or works, or where the issue arose. Other local complaint rights can apply.

Notice updates

NGP makes the current notice available before sign-in and from the data room. Material changes are explained before information is used for a materially different purpose. A separate affirmative choice supports optional viewing estimates. Fresh permission is requested where required for a new optional purpose.