Privacy Notice

The data controller for the personal information described in this notice is Bizworks Online Limited, a company registered in England and Wales (company number 11958108) with its registered office at The Studio, Brentmoor Road, Woking, Surrey GU24 9NE, United Kingdom, trading as BusinessWanted.com.

General and privacy correspondence should be sent to info@businesswanted.com. The person responsible for data protection matters is Mr Tony Vaughan, reachable at the same address.

Depending on how you interact with us, we may collect:

• Identity and contact information: name, business or firm name, role, email address, telephone number.
• Enquiry content: the message you send us, the mandate reference you quote, and any other information you choose to include.
• Buyer and acquirer information: where you have registered an acquisition requirement, the structured criteria of that requirement (sector, geography, scale, transaction type, funding position and similar), and background about you or your organisation as the acquirer.
• Business owner and adviser information: where you contact us in connection with a possible sale or on behalf of a client, the information you provide about that opportunity.
• Account and authentication records: where an account is created, the identifiers and credentials required to operate it securely.
• Technical and security information: request metadata used to protect the service, including a keyed short-term identifier derived from your IP address (never the raw IP), request timestamps and general device information exposed by your browser.
• Cookies and equivalent storage: see our separate Cookie Notice.
• Correspondence: the substance of emails and other messages exchanged with us, and any documents you attach.

Some of this information may, in due course, become part of a formal client, mandate or transaction record if a matter progresses.

We obtain personal information:

• directly from you when you submit an enquiry, register a requirement, correspond with us, or interact with the site;
• from professional advisers or introducers acting with your authority;
• from publicly available sources (such as Companies House, professional bodies or your own public materials) to verify information you have provided; and
• automatically, in the case of limited technical and security information generated by your interaction with the site.

We use personal information to:

• respond to enquiries received through the site or by email;
• review and, where appropriate, publish confidential acquisition requirements in the register;
• make discreet introductions between reviewed and approved acquirers and business owners considering a private sale, only where each side has agreed;
• operate, secure and improve the service, including protection against abuse, spam and fraudulent submissions;
• maintain proper business, accounting, regulatory and legal records; and
• manage any matter that becomes a client, mandate or transaction record.

We rely on the following lawful bases under the UK GDPR:

• Steps taken at your request before entering a contract, where applicable : for example, where an enquiry could reasonably lead to an engagement between you (or your organisation) and us or a party we introduce.
• Legitimate interests: in responding to genuine business enquiries, operating the acquisition register, matching demand with willing sellers, protecting the service from abuse, and maintaining accurate business records. We have considered the interests, rights and freedoms of individuals and consider that these activities do not override them.
• Legal obligation: where we are required to keep or disclose information (for example, tax, anti-money-laundering or court-ordered disclosures).
• Consent: for optional marketing communications, where we ask for it separately. We do not rely on consent as the basis for responding to an enquiry.

Personal information is accessed by authorised BusinessWanted.com staff and by carefully selected service providers acting on our instructions. These currently include:

• our platform and database provider, which hosts the site and its data;
• our transactional email provider, which delivers enquiry confirmations and internal notifications; and
• professional advisers such as our accountants and lawyers, where reasonably necessary.

Where we introduce an acquirer to a business owner (or vice versa), we do so only with the agreement of the side being introduced. We do not sell personal information, and we do not share it for the direct marketing purposes of third parties.

Some of our service providers may process personal information outside the United Kingdom. Where this happens, we rely on appropriate safeguards recognised under UK data protection law (such as UK adequacy regulations or the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses).

We apply administrative, technical and organisational measures appropriate to the nature of the information we hold, including access controls, encryption in transit, least-privilege data access, isolation of confidential enquiry records from the public site, and regular review of our security posture.

We retain personal information for no longer than necessary:

• Ordinary enquiries that do not progress, 12 months after the last meaningful contact.
• Security and rate-limit identifiers (such as the IP-derived keyed identifier described above), 6 months.
• Enquiries that become a client, mandate or transaction record, transferred or linked to the relevant formal record and retained under the applicable business and legal retention schedule, normally up to 6 years after the relationship or matter closes, where justified.
• Authentication and security records: retained only for the period necessary for account operation, security and legal obligations.
• Cookie-consent evidence: retained for as long as necessary to demonstrate the current consent choice and to manage renewals.

We do not retain the same personal data indefinitely in both the enquiry table and a later client record; where a matter progresses, the enquiry record is superseded by the formal record.

Subject to the conditions in UK data protection law, you have the right to request access to your personal information, correction of inaccurate information, erasure, restriction of processing, portability, and to object to processing carried out on the basis of legitimate interests. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details in section 13. We may need to verify your identity before acting on a request.

We do not send unsolicited marketing. Where we have specifically obtained your consent to receive optional communications, you may withdraw that consent at any time: for example by replying to any such message or by writing to us at the address in section 13. You may also object to processing carried out on the basis of legitimate interests by contacting us.

If you are not satisfied with how we have handled your personal information, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk. We would appreciate the opportunity to address any concern before you do so.

Bizworks Online Limited trading as BusinessWanted.com
The Studio, Brentmoor Road, Woking, Surrey GU24 9NE, United Kingdom
General and privacy: info@businesswanted.com
Data protection contact: Mr Tony Vaughan

We may update this Privacy Notice from time to time. The current version and effective date are shown at the top of the page. Material changes will be communicated through the site or by other appropriate means.