Privacy Policy

This policy applies to personal data we collect through:

• The Site, including our contact and "Book a Call" forms
• Calls, meetings, and correspondence with prospective and existing clients (business owners considering or undertaking a sale of their business) and with prospective acquirers and their advisers
• Our engagement as M&A adviser during a sale process, including preparation of information memoranda, valuations, and buyer outreach
• Our booking calendar tool and related scheduling communications
• Analytics and cookies used on the Site

It does not cover the practices of third-party websites we may link to, or of the AI service providers, professional advisers, or acquirers with whom data may be shared as described below — you should review their own privacy policies.

3.1 Information you give us directly

• Identity and contact data: name, job title, company name, email address, telephone number, postal address
• Business and financial information: information about your company provided in connection with a sale mandate, including financial statements, management accounts, business plans, ownership structure, and other information used to prepare a valuation, information memorandum, or buyer outreach materials
• Communications: the content of emails, call notes, meeting notes, and messages exchanged with our advisers
• Booking data: details you provide when booking a call, including your preferred date/time and any information submitted through the booking form

3.2 Information about acquirers and their representatives

Where you are a prospective acquirer, or represent one (for example, a fund, corporate, or adviser), we may collect your name, role, organisation, contact details, investment mandate and deal history information, and records of our correspondence and outreach with you.

3.3 Information we collect automatically

When you visit the Site, we automatically collect certain Usage Data via cookies and similar technologies, including:

• IP address, device and browser type, operating system
• Pages visited, time spent on pages, referring/exit pages, click patterns
• Approximate location derived from IP address

See Section 8 (Cookies) for details.

3.4 Information from other sources

We may supplement the information above with information obtained from publicly available sources (such as Companies House, LinkedIn, and company websites) and from third-party data providers, in order to identify and assess potential acquirers or to verify information provided to us.

We do not intentionally collect special category data (such as health, racial or ethnic origin, or religious belief) and ask that you do not send us such information unless specifically requested.

We use personal data for the following purposes and on the following legal bases under Article 6 UK GDPR:

Where we rely on legitimate interests, we have considered that our processing is necessary and proportionate, and does not unfairly override your own rights and interests. You may ask us for details of this assessment at any time.

Given the sensitive nature of business sale processes, we treat information relating to a client's business, valuation, and sale process as strictly confidential. We only share such information with:

• Our client (the business owner) and individuals they authorise
• Prospective acquirers who have signed a non-disclosure agreement, and only to the extent, and at the stage, our client has approved
• Our own personnel and advisers on a need-to-know basis

Blind teasers are anonymised so that a business cannot be identified before an interested acquirer has signed appropriate confidentiality documentation.

Our service uses AI tools to assist with drafting documents (such as information memoranda and outreach materials), preparing valuation analysis, and ranking prospective acquirers by likely fit. Every document and every acquirer shortlist is reviewed and approved by a human adviser before it is sent or acted upon — we do not make solely automated decisions about you or your business that produce legal or similarly significant effects.

Where AI tools are provided by third parties, we only use providers who agree contractually not to use your data to train their own models and to process data solely on our instructions, in accordance with Section 7 below. Where we are engaged to provide services on behalf of a client, we and our AI sub-processors act as data processors on that client's behalf in relation to the data used to prepare their sale materials.

We may share personal data with:

• Prospective acquirers and their advisers, on the basis described in Section 5
• Service providers and sub-processors who support our business, including website hosting, analytics, booking and scheduling tools, email and outreach platforms, customer relationship management (CRM) software, and AI service providers, each acting under a contract that restricts their use of your data to providing services to us
• Professional advisers, including lawyers, accountants, and other consultants engaged in connection with a transaction or our own business
• Regulators, law enforcement, or other authorities, where required by law or to protect our legal rights
• A buyer or successor, if we sell, merge, or restructure our business, subject to that party agreeing to handle your data in accordance with this policy

We do not sell personal data to third parties.

We use cookies and similar technologies to operate the Site, understand how visitors use it, and run our booking calendar. You can accept or reject non-essential cookies via the cookie banner shown when you visit the Site, and you can change your preferences at any time by clearing your cookies and revisiting the Site, or through your browser settings.

Non-essential cookies are only set with your consent, in accordance with PECR. Blocking or deleting cookies may affect the functionality of the Site, including the booking calendar.

Some of our service providers may process data outside the UK. Where this occurs, we ensure an appropriate safeguard is in place, such as:

• The receiving country benefiting from a UK "adequacy" regulation; or
• Standard contractual clauses or the UK International Data Transfer Addendum, together with any additional measures required to ensure your data receives a level of protection equivalent to that under UK GDPR

We retain personal data only for as long as necessary for the purposes set out in this policy, including:

• Enquiry and unconverted lead data: up to 24 months from last contact, after which it is deleted or anonymised unless you ask us to retain it for longer
• Client engagement and deal records: for the duration of the engagement and for up to 6 years following completion or termination of the engagement, to meet legal, accounting, and limitation-period requirements
• Acquirer records: for as long as reasonably necessary to maintain an accurate, up-to-date record of potential acquirers, or until you ask us to stop contacting you
• Website analytics data: typically no longer than 26 months

Where we no longer need personal data, we securely delete or anonymise it.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including access controls, encryption in transit, and confidentiality obligations on our staff and service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we take these risks seriously and review our measures regularly.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data in certain circumstances ("right to be forgotten")
• Restrict our processing of your data in certain circumstances
• Object to processing based on legitimate interests, or to direct marketing at any time
• Data portability, to receive certain data in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal
• Complain to the ICO (see Section 15) if you believe we have not handled your data in accordance with the law

To exercise any of these rights, contact us using the details in Section 16. We may need to verify your identity before responding, and we will respond within one month, or explain if we need longer.

If you have consented to receive marketing or insights content from us, you may opt out at any time by using the unsubscribe link in any email, or by contacting us directly. We will not send you marketing communications if you have opted out, though we may still contact you for service-related or contractual purposes.

The Site and our services are intended for business owners, acquirers, and professional advisers, and are not directed at, or intended for use by, anyone under the age of 18. We do not knowingly collect personal data from children.

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the UK's data protection regulator:

• Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Helpline: 0303 123 1113
• Website: ico.org.uk

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:

• Mayfair AI Ltd
• 2 Eversleigh Road, London, England, N3 1JB
• Email: james@mayfairai.co.uk

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. We will post any changes on this page and update the "Last updated" date above. We encourage you to review this policy periodically.