Your enquiry and access.

This notice explains what personal information xPortfolios holds, why we hold it, how long we keep it and the rights you have over it. We follow the EU and UK General Data Protection Regulation (GDPR), and, as a company registered in the Dubai International Financial Centre, the DIFC Data Protection Law (DIFC Law No. 5 of 2020). Where the two set different standards, we apply the one that protects you more. Last updated 29 September 2026.

Who is responsible

xPortfolios is a service of Dirhami Investment Technology Ltd, registered at Unit 201, Gate Avenue, South Zone, Dubai International Financial Center, Dubai, United Arab Emirates. The company is the data controller for the information described here: business enquiries, partner contacts, portal sign-in and the delivery records behind our services. Write to us through the contact form, or use the office address and email for your country on that page, for any question or request about your information.

Our partners are brokers, advisors and robo-advisors. They remain the controller of their own clients’ information. We publish model portfolio targets, not client portfolios, so we do not need and do not ask for your clients’ names, accounts or holdings. Please do not send them to us.

Enquiries and the broker API

The enquiry form collects your contact and company details, client type, platform, country, department, integration preferences and message so xPortfolios can review and respond to your request. Enquiries are stored and sent to our team through SendGrid. Your email is used as the reply address. These details are stored in the service’s enquiry records. Avoid including client account details or sensitive personal information.

The broker API records the use of assigned keys and portfolio delivery acknowledgements to support access control and reliable delivery.

Contacts and one-time samples

Partner contacts are added by an operator or a partner administrator. Notification channels are enabled only with recorded consent; portal access is granted separately. An administrator can request an email confirmation link that expires after 24 hours; you must confirm before receiving portfolio details or attachments. Contact details, consent evidence and notification outcomes are stored in our private frontend database. Email may contain entitled holdings and files; WhatsApp carries portfolio-level alerts only. Email uses SendGrid; WhatsApp uses Twilio. Those providers process destination details and message content to provide delivery.

Public samples require one-time consent and do not create a contact or subscription. We keep a keyed digest of your destination and connection address for request limits. The actual destination is held only while queued or sending and is cleared after a terminal result or after 24 hours. Demo records are deleted after 90 days. Provider acceptance is recorded separately from confirmed delivery, which we do not currently track.

The partner portal

The partner portal uses requested sign-in emails through SendGrid and an essential, secure authentication cookie that lasts up to 30 days. Login tokens are stored as digests, expire after 15 minutes and work once. Sign out to revoke your session. Expired login tokens are removed after one day; expired or revoked sessions are removed after 30 days. Login request records contain keyed address and connection digests and are removed after 30 days. Access records are retained for 12 months. Portal acknowledgements and execution reports identify the partner contact; execution is partner-reported, not independently verified. The public Demo Broker uses no login cookie and its simulated actions write no delivery records.

A partner can connect its custodian login in the portal so that we read, with read-only access, the client accounts the partner enrols: account identifiers and names, holdings, cash and values. We use them only to show the partner how each account compares with its portfolio and whether a weekly change was carried out; we never place, change or cancel orders. The login is stored encrypted and deleted when the partner disconnects. Account snapshots are kept for 24 months unless the partner agrees a shorter period, and a partner administrator can delete all of this data at any time.

Configured Webhooks store organization destinations, signing-key references and event/HTTP-attempt history. SFTP stores organization public keys and file-availability history. Signing secrets stay in private configuration files. These records support delivery and access control; they do not verify partner processing or trade execution. Delivery audit history is retained with broker receipt history.

Why we are allowed to hold it

We rely on three lawful bases. Consent covers notification channels and one-time samples; you can withdraw it at any time through the unsubscribe link or by writing to us, without affecting what was sent before. Contract covers partner access: portal accounts, API keys, file delivery and the receipts that show what was delivered. Legitimate interests cover answering business enquiries, protecting the service against abuse, and keeping records that show how access was granted and data delivered; we keep those records to the minimum that still serves the purpose.

We do not sell personal information, do not use it to build advertising profiles and make no automated decisions that produce legal or similarly significant effects about you.

How long we keep it

Use the unsubscribe link to stop a notification channel, or contact us to disable a contact or request deletion. Contact and consent evidence is retained while the relationship is active and for up to 12 months after disablement, except where attribution must be retained with an existing delivery receipt. Notification and resolution records are retained for 12 months. Existing broker delivery records keep their separate retention. Private operational logs contain identifiers and error types, not destinations or message bodies, and rotate at 2 MB with five retained files.

Where information is held

Our servers run in the European Union, in Amazon Web Services’ Frankfurt region. The website is published over HTTPS through Cloudflare, which handles the connection and may record ordinary connection information for security and delivery. Email runs through SendGrid and WhatsApp messages through Twilio; both are United States providers, and transfers to them rely on the standard contractual clauses in their data protection terms. The public website uses Google Analytics, which sets cookies, to count visits, see which pages are read and which link or campaign brought each visit. The banner on your first visit offers two choices: Basic, which also applies until you choose, switches off Google signals and ad personalisation; Full leaves them on. You can change your choice at any time here: Cookie settings. Google processes that usage information in line with its own terms. The partner portal does not load Google Analytics. The only other cookie is the essential portal sign-in cookie described above.

Your rights over your information

You can ask us for a copy of the information we hold about you, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent you have given. Send the request through the contact form and include your enquiry reference where available. We answer within one month and may ask for information to confirm who you are. Requests are free unless they are repetitive or excessive.

If you believe we have handled your information badly, please tell us first so we can put it right. You can also complain to a data protection authority: the Commissioner of Data Protection at the Dubai International Financial Centre, where the company is registered; the Information Commissioner’s Office in the United Kingdom; or, in the European Union, the authority for the country where you live or work.

Changes to this notice

We update this notice when the service changes. The date at the top shows the current version; material changes are announced to partner contacts through the portal or by email.