NAFIC is an invite-only private community. Your privacy is foundational. This policy explains exactly what we collect, how we protect it, and your rights.
1. Who We Are
NAFIC (New Age Family Investment Council) is a private, invite-only knowledge-sharing circle founded in Abu Dhabi, with hubs in Dubai, Hong Kong, and Singapore, uniting next-generation family offices and family business leaders and decision-makers globally. NAFIC is anchored by 76Columbus, a New York–Abu Dhabi family holding and built for families by family. Qualified members include family offices, family businesses, and select domain experts and strategic partners. We are operated by 76C LTD, an Abu Dhabi Global Market (ADGM) entity, and accessible at nafic.ai.
Contact: app@76columbus.com
2. Applicable Law
As an ADGM entity storing data on EU servers, NAFIC operates under two primary frameworks:
- UAE: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
- EU residents: General Data Protection Regulation (GDPR, Regulation 2016/679)
Where these frameworks overlap, we apply the standard that affords the greater protection to you.
3. What Data We Collect
3.1 Information You Provide
- Full name and professional title
- Email address and WhatsApp / phone number
- WeChat ID (optional)
- LinkedIn profile URL (optional)
- Family office or business name and type
- Geographic focus and regions of interest
- Investment mandate: asset classes, check size range, industry focus
- Co-investment interests and deal signals
- Event RSVPs and attendance
- Messages sent within the platform
3.2 Information Collected Automatically
- Login timestamps and session activity
- Device type and browser (for security monitoring only)
- App usage patterns (page views, feature interactions)
4. How We Use Your Data
We use your information solely for the following purposes:
- Matching you with other members based on mandate alignment
- Facilitating introductions between compatible members
- Sending event invitations and community updates
- Sending WhatsApp notifications (if enabled by you)
- Administering your membership and tier status
- Maintaining platform security and preventing abuse
We do not use your data for advertising, third-party marketing, or any commercial purpose outside of NAFIC operations.
5. Legal Basis for Processing
| Purpose | Legal Basis |
|---|
| Member matching and introductions | Performance of membership agreement |
| Event invitations and community updates | Legitimate interest |
| WhatsApp notifications | Consent |
| Membership administration and tier management | Performance of membership agreement |
| Platform security and abuse prevention | Legitimate interest |
| Responding to data subject rights requests | Legal obligation |
6. How Your Data Is Protected
| Protection | Detail |
|---|
| Server location | European Union (Frankfurt, Germany) |
| Encryption in transit | TLS 1.2+ (HTTPS) on all connections |
| Encryption at rest | AES-256 via Supabase |
| Access control | Row-level security — you see only what you are permitted to see |
| Directory anonymization | Identity protected until personal introduction by admin |
| Session security | Auto-logout after 30 minutes of inactivity |
| Authentication | Email address and password, encrypted and managed via Supabase |
7. Who Can See Your Information
7.1 Admin (NAFIC Operator)
Authorized NAFIC administrators have access to all member profiles for the purpose of administration, matching, and approval decisions. Administrative access is restricted to designated operators of the platform.
7.2 Other Members
Other members see only anonymized information in the directory:
- Family origin country
- Entity jurisdiction
- Asset class focus and mandate range
- No names, contact details, or identifying information
Full identity is revealed only when the admin personally facilitates an introduction between two consenting members.
7.3 Infrastructure Providers
We do not sell, rent, or share your personal information with any third party. The following infrastructure providers process data solely to operate the platform:
| Provider | Purpose | Location |
|---|
| Supabase | Database and authentication | EU (Frankfurt, Germany) |
| Lovable | Application hosting | EU servers |
8. Data Retention
| Data Type | Retention Period |
|---|
| Member profile and personal data | Duration of active membership |
| Profile and personal data after deletion request | Deleted within 30 days |
| Event attendance records (anonymized aggregate) | Retained indefinitely |
| Messages sent to other members | Retained for recipient's records |
| Security and session logs | 90 days |
9. Your Rights
As your data is stored in the EU, GDPR applies. As a UAE entity, the UAE PDPL also applies. You have the right to:
- Access: request a copy of all data we hold about you
- Correction: update any inaccurate information
- Deletion: request complete removal of your data
- Portability: receive your data in a structured, machine-readable format
- Objection: object to any processing you did not consent to
- Withdrawal of consent: where we rely on consent, you may withdraw it at any time without affecting prior processing
To exercise any of these rights, contact app@76columbus.com. We will respond within 30 days.
10. Minors
NAFIC is a professional platform for adult family business leaders and decision-makers. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact app@76columbus.com and we will delete it promptly.
11. Cookies
NAFIC uses only essential cookies required for authentication and session management. We do not use advertising, analytics, or tracking cookies.
12. Changes to This Policy
If we make material changes to this Privacy Policy, members will be notified via email and in-app notification at least 14 days before changes take effect.
13. Contact
For any privacy-related questions or requests:
