Privacy

Who we are

This notice explains how Dorhyan uses personal data collected through dorhyan.eu and its members area.

Dorhyan is the trading name of Dorhyan SCSp, a special limited partnership (société en commandite spéciale) registered with the Luxembourg Trade and Companies Register (RCS) under number B283423, with its registered office at 54, rue Charles Martel, L-2134 Luxembourg. Dorhyan SCSp acts through its general partner, Dorhyo Ltd, a private limited company registered in England and Wales under company number 14849955, with its registered office at 86-90 Paul Street, London EC2A 4NE, United Kingdom.

Dorhyan is the controller of the personal data described in this notice. For any question about it, or to exercise your rights, write to contact@dorhyan.eu.

What we collect and where it comes from

Contact form: your first and last name, email address, firm, the subject you are interested in and your message.

Partner application: your first and last name, work email address, firm, firm type, headquarters location, your relationships with general partners, the EU coverage you need and what you want to achieve.

Readiness screen: your name and work email address, which you give to see the detailed result after your route is shown, and the answers you give about your fund and your firm's current regulatory set-up.

Members area: your email address and a password, which is stored only in hashed form by our authentication provider. If you choose to sign in with Google, we receive your name, email address and profile picture from Google. We also keep the date of sign-up and of your most recent sign-in.

Emails and meetings: anything you send us by email or tell us in a call, if you contact us directly.

Technical data: when you visit the site, our hosting provider processes your IP address, browser type and the pages requested, so that the site can be delivered and protected against abuse.

Analytics data, only if you accept analytics cookies: how you use the site, such as the pages you view, how you arrived, the device and browser you use, your approximate location (derived from your IP address, which Google Analytics does not store) and whether you sent one of our forms. We never send your name, email address or the content of a form to Google Analytics.

We do not ask for, and ask you not to send, special category data such as health information, or data about criminal convictions.

Why we use it and our lawful basis

To reply to your enquiry or application and to discuss working together. Our lawful basis is taking steps at your request before entering into a contract, and our legitimate interest in answering professional enquiries.

To give you your readiness-screen result and to follow up on it by email. Our lawful basis is our legitimate interest in providing the result you asked for and continuing a professional conversation about it. You can ask us to stop following up at any time.

To create and run your members account and give you access to members content. Our lawful basis is the performance of our agreement with you to provide the members area.

To keep the site and our systems secure and to prevent spam and misuse. Our lawful basis is our legitimate interest in protecting our services.

To understand how the site is used, so that we can improve it. Our lawful basis is your consent, which you give or refuse in the cookie banner and can withdraw at any time.

To carry out identity, anti-money laundering and other checks before we take on a client or partner, and to keep the records the law requires. Our lawful basis is compliance with our legal obligations.

To send you updates or insights by email, only where you have asked for them or where the law otherwise allows it. Every such email includes a way to unsubscribe.

Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details of that assessment.

The readiness screen result

The readiness screen gives an indicative result built from your answers using fixed rules written in advance. It is not legal or regulatory advice and it is not a decision about you. It has no legal or similarly significant effect, and any follow-up is handled by a person.

Who we share it with

We share personal data only with service providers who process it on our behalf and under our instructions, and only as far as they need it:

Vercel Inc., which hosts the website.

Supabase, which provides our members-area authentication and database, hosted in Frankfurt, Germany.

Resend, which sends the emails generated by our forms, using its EU region (Ireland).

folk, the contact-management (CRM) tool in which we keep the enquiries, applications, sign-ups and readiness-screen results you send us.

Google, which provides our email and office tools (Google Workspace) and the fonts used on the readiness screen.

Google Ireland Limited, which provides Google Analytics, our website analytics service, if you accept analytics cookies. Google acts as our processor for this. Advertising features and data sharing for advertising are switched off.

We may also share personal data with our professional advisers, with an authorised partner firm where that is needed to provide a service you have asked for (we will tell you who it is first), and with courts, regulators or other authorities where the law requires it.

We do not sell personal data and we do not share it for advertising.

Calendly LLC, which handles meeting bookings. If you book a call through the calendar on our contact page, Calendly receives the name, email address and any notes you enter, and processes them under its own privacy notice.

International transfers

We keep personal data in the European Economic Area and the United Kingdom where we can. Some of our providers are based in, or may access data from, the United States or other countries outside the EEA and the UK. Where that happens, we rely on an adequacy decision (including the EU-US Data Privacy Framework and its UK extension, where the provider is certified) or on the standard contractual clauses approved by the European Commission and the UK addendum to them.

Dorhyan works from London and Luxembourg, so data may pass between the UK and the EU. Both are covered by adequacy decisions.

You can ask us for a copy of the safeguards that apply.

How long we keep it

Enquiries, partner applications and readiness-screen submissions that do not lead to a working relationship: 24 months from our last contact with you, then deleted.

Members accounts: for as long as the account is open. When you ask us to close it, we delete your account within 30 days. Backups are overwritten within a further 90 days.

Clients and partners: for the length of the relationship and then for as long as the law requires, which for anti-money laundering records is at least five years after the relationship ends and for accounting records is up to ten years.

Analytics data: event data in Google Analytics is kept for 14 months, then deleted automatically.

Technical logs held by our hosting provider: for the short period set by that provider for security and troubleshooting.

Your rights

You have the right to ask for access to your personal data, to have it corrected, to have it erased, to restrict how we use it, to receive it in a portable format, and to object to our use of it where we rely on legitimate interests. Where we rely on your consent, you can withdraw it at any time without affecting what we did before.

To exercise any of these rights, email contact@dorhyan.eu. We may need to confirm your identity first. We reply within one month, and tell you if we need longer because the request is complex.

Members can also change their password or ask for their account to be closed by writing to the same address.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right.

You also have the right to complain to a supervisory authority. In Luxembourg this is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu. In the United Kingdom it is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow SK9 5AF, ico.org.uk. If you live or work in another EU country, you can also complain to the authority there.

Cookies and similar technologies

This site does not use advertising or tracking cookies. It uses analytics cookies only if you accept them.

Analytics: if you select "Accept analytics" in the cookie banner, Google Analytics sets two cookies, _ga and _ga_<ID> (where <ID> is our analytics property's identifier), which distinguish one visitor from another and keep track of a visit. They are set only after you consent; until then the Google Analytics script is not loaded at all. The cookies last up to two years in your browser, and the event data they produce is kept in Google Analytics for 14 months. If you select "Reject", nothing is loaded and no analytics cookies are set. You can change your choice at any time with the "Cookie settings" link at the foot of every page; withdrawing consent stops analytics from that point and removes the analytics cookies from your browser.

If you sign in to the members area, our authentication provider sets cookies that keep you signed in and protect your session. They are strictly necessary for the members area to work, so they do not need your consent. They are removed when you sign out or when the session expires.

The readiness screen loads its fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). When it does, your browser sends your IP address to Google so the fonts can be delivered. Google does not set cookies for this.

You can block or delete cookies in your browser settings. If you block the members-area cookies you will not be able to sign in.

The booking calendar on our contact page is provided by Calendly, which sets its own cookies when it loads. It loads only after you choose to open it by selecting "Show available times".

Changes to this notice

We will update this notice when our use of personal data changes. The date at the top shows when it was last revised. If a change matters to you, we will tell you directly where we can.