How enquiries and controlled access are handled.

This notice covers the Private Introduction form and the Request Consideration forms appearing across the public mandate pages. All such forms submit to the same controlled consideration process and are handled by the same present contracting and controlling entity.

Each form collects a name, a stated role, an email address, an optional telephone number, a country or jurisdiction, the nature of the matter, a preferred form of reply, and a written description of the matter. A technical record of the market and language selected, the page from which the enquiry was written, and a one-way hash of the submitting network address and browser identification is retained to prevent abuse. Sensitive documentation must not be submitted through these forms.

Access to the Private Salon is granted individually following introduction and qualification. Where an invitation is issued, DGF & Co Capital Services GmbH records a recipient label, the relevant mandate reference, the permitted scope of access, the issue and expiry dates, revocation status and the applicable use count or use limit.

The access credential itself is not stored in readable form. Only a cryptographic hash of the credential is retained for server-side verification.

Successful verification creates a limited session associated with the relevant invitation, mandate and permission scope. The session is subject to idle and absolute expiry and becomes unusable following logout, expiry or invalidation. The related browser cookie is encrypted, HttpOnly, Secure, SameSite and short-lived.

Access attempts may be rate-limited using a one-way hash of the submitting network address. Repeated unsuccessful attempts may result in temporary restriction or lockout. A limited security record is maintained to protect the Private Salon and investigate suspected misuse.

This information is processed to authenticate approved recipients, restrict access to the appropriate mandate and materials, protect confidential residence information, prevent misuse, investigate attempted unauthorised access and preserve an appropriate security record for the Private Salon.

Depending on the relationship and stage of the matter, this processing is undertaken to take steps at the request of the recipient before a possible engagement or in connection with an existing mandate under Article 6(1)(b) GDPR, and on the basis of the legitimate interests of DGF & Co Capital Services GmbH in maintaining controlled access, confidentiality, information security and abuse prevention under Article 6(1)(f) GDPR.

This website is published on the Lovable platform. The platform injects its own visitor-measurement script, served from the path /~flock.js, which transmits measurement data to the platform endpoint /~api/analytics. This script is added by the publishing platform and is not part of the editorial content of the website.

To the extent verified, the information transmitted is technical and relates to the page requested, the referring page, and standard technical characteristics of the request such as the browser identification and network address made available to the platform. The purpose is aggregate measurement of website usage.

This measurement is a setting of the publishing platform and can be switched off there. Where it is switched off, the script and the endpoint are no longer served and this section is withdrawn. No retention period or international-transfer arrangement is stated here, because none has been verified by DGF & Co Capital Services GmbH.

An enquiry is retained for as long as the matter is under consideration and for such further period as is necessary to answer it or to comply with legal obligations. Where the House is not the appropriate recipient, the enquiry is deleted once the reply has been made and any applicable retention obligation has expired. Deletion may be requested at any time in writing.

Invitation information is retained while access remains valid. An invitation becomes unusable upon its stated expiry date, upon revocation or upon exhaustion of any applicable use limit. A session becomes unusable following logout, expiry or invalidation.

Security and access records are retained only for so long as is necessary to protect the Private Salon, investigate suspected misuse, administer the relevant mandate and comply with applicable legal obligations. When those purposes and obligations have ended, the records are deleted or irreversibly anonymised. Hashed network addresses are treated as pseudonymous security information.