Privacy Notice

1. Who we are

Proplexo Advisory is a trading name of Proplexo Limited, a company registered in England and Wales (company number 15522252), registered office Proplexo House, Unit 118, Golborne Enterprise Park, Greater Manchester, England, WA3 3GR.

Proplexo Limited is the controller of the personal information described in this notice. We are registered with the Information Commissioner's Office (ICO), registration number ZC251531.

If you have any questions about this notice or your information, please email privacy@proplexo.co.uk.

2. What this notice covers

This notice explains how we use personal information when you visit our website, contact us through it, enquire about an opportunity or register your acquisition criteria. If you become a client, this notice continues to apply where relevant. We will provide any additional privacy information required for our client services as part of onboarding, including information about anti-money-laundering checks and other service-specific processing.

Our website and services are intended for business users and are not directed at children. We do not knowingly seek to collect personal information from children through the website.

3. Information we collect and why

3.1 When you send us an enquiry

This covers general, accounting, advisory, acquisition, funding and confidential sale enquiries.

Information: your name, email address, the type of enquiry and your message; optionally your phone number, company and an approximate turnover band; and, for some enquiries, broad details such as sector, region, turnover band or timescale. Please do not include detailed financial figures in an initial enquiry.

Why we use it and our lawful basis: to respond to and assess your enquiry. Where you ask us to take steps towards providing a service to you personally, we rely on taking steps at your request before entering into a contract. For general or business enquiries, or where you contact us on behalf of a company, we rely on our legitimate interests in responding to and assessing enquiries. When you send an enquiry, we email you an acknowledgement with your enquiry reference. It does not repeat what you told us.

How long we keep it: 24 months from our last meaningful contact with you, if no engagement results.

3.2 When you enquire about an opportunity

We use the information described in 3.1, together with the opportunity you are interested in, so that we can respond and, where appropriate, discuss confidentiality arrangements. The lawful basis and retention period are the same as in 3.1.

3.3 When you register your acquisition criteria

Information: your contact details and acquisition criteria (for example sectors, regions, size ranges, available equity, funding requirement, transaction type and timescale).

When we speak or correspond with you about your registration or acquisition criteria, we also keep a short record of your most recent relevant interaction: the date, whether it was a call, email or meeting, and a brief factual note of the outcome, for example “criteria unchanged” or “still looking”.

We keep only the latest interaction record. It is held with your buyer registration and is deleted with that registration in accordance with the retention period described above.

Why we use it and our lawful basis: to keep a register of buyers and contact you when we identify an opportunity that may be relevant. Matching is carried out by a person – no automated decisions are made about you. We rely on taking steps at your request before entering into a contract where this applies; otherwise we rely on our legitimate interests in maintaining an active buyer database. We may send you notifications about opportunities that match the criteria you asked us to use. Separate promotional or wider marketing communications are only sent where the law allows, including asking for your consent where required. You can ask us to stop at any time.

How long we keep it: we ask you to confirm or update your criteria at least every 12 months, counted from when you last confirmed them or last had a meaningful interaction with us about them. About 30 days before the 12 months are up, we email you a link to confirm them. If your criteria are not confirmed by the end of the 12 months, we mark your registration as inactive and don't use your criteria to match you with opportunities or contact you about them until you confirm. We delete or anonymise it 24 months after the last meaningful interaction or confirmation, unless we have an active relationship with you.

3.4 Updates by email (optional)

If you tick the separate, optional box on our forms, we record your consent so that we can send you occasional Proplexo insights and updates about accounting, tax, funding and M&A by email. We record when and how you gave your consent and the wording you agreed to. The box is never ticked for you.

Our lawful basis is your consent. You can withdraw it at any time by contacting us, and by using the unsubscribe link in any marketing email we send; we will stop sending marketing emails when you withdraw your consent. We keep evidence of your consent while we rely on it, and a minimal record of any opt-out, or of a request not to be contacted, so that we continue to respect it. This record contains only a scrambled (hashed) version of your email address.

If you unsubscribe from our emails, or ask us not to contact you, we record that in both HubSpot and our application. The record we keep to respect your choice contains only a scrambled version of your email address, created with a secret key that we hold, so that it can't be turned back into your address.

3.5 Website security and technical information

Information and why we use it: when you visit the website, our hosting provider processes limited technical and server information – such as your IP address, browser type, the page requested and the time – for hosting, security and troubleshooting. On our form pages we use Cloudflare Turnstile to protect against spam and automated abuse (see section 5). We keep a scrambled (hashed) version of your IP address to prevent abuse. We also record when you submitted a form, which version of this notice was shown to you, and how you found us – limited to campaign labels (such as the source or campaign name) and the name of the website that referred you, never its full address.

Our lawful basis: our legitimate interests in website security, reliability, abuse prevention and technical troubleshooting, in keeping a record of the privacy information shown to you, and in understanding which of our marketing works.

How long we keep it: hashed IP addresses and spam submissions: 30 days. Our hosting provider keeps server logs for 1 day. The submission time, notice version and source details are kept with your enquiry and deleted with it. We also keep a record of whether our emails to you were delivered (not their content), with your enquiry, and delete it with your enquiry. We do not keep Turnstile security signals ourselves beyond checking the form submission.

3.6 How we manage our relationship with you (our CRM system)

We keep enquiries and registrations in our own secure application (section 6). To manage our commercial relationships – following up enquiries, organising conversations and proposals, and keeping track of who is responsible – we also keep a limited copy in our customer relationship management (CRM) system, HubSpot.

What we copy to HubSpot: your name, email address, phone number, job title and company name (if you gave them); your enquiry reference and type; how you found us (campaign labels and the name of the referring website only); the stage your enquiry has reached; and whether you have agreed to receive updates or have asked us not to contact you.

What we never copy to HubSpot: your messages; financial information about you or your business; detailed information about a business you may sell or buy, or your acquisition criteria; and our compliance records (for example anti-money-laundering checks).

If you enquire confidentially about selling your business, HubSpot never shows your business's name or anything that identifies it. It shows the business only under a reference code, together with broad descriptions such as its sector and region, so that we can manage the work. Your email address – whether a business or a personal address – is not copied unless we have agreed with you that it is safe to do so.

Updates in both directions: if we correct your name, phone number or job title in HubSpot, the correction is copied back into our application. A change to your email address is checked by a person first and is never copied automatically. If you unsubscribe or ask us not to contact you – in either system – we record it in both.

Our lawful basis: our legitimate interests in managing and following up our business relationships and enquiries efficiently; and, where you have asked us to take steps towards providing a service to you, taking those steps before entering into a contract. We do not use HubSpot to make automated decisions about you, and we do not use automated scoring. We do not track whether you open the emails we send you or click the links in them.

How long we keep it: the HubSpot copy follows the retention periods in this notice. When we delete your enquiry from our application, we review the HubSpot record and remove it unless we still have an active relationship with you (for example you are a client, or we are discussing a proposal with you).

Reporting: we keep a simple record of how enquiries progress – for example the date an enquiry moved to a proposal – using reference codes rather than names, to understand which of our services and marketing work. When the records it relates to are deleted, this history is anonymised so that it no longer identifies anyone.

4. If you become a client

Once you become a client, relevant information moves into our practice records and is governed by our engagement terms. It is retained in accordance with Proplexo's service-specific legal, tax, anti-money-laundering and professional record-retention schedule. We also keep a client record in our secure application to manage our ongoing relationship with you. This includes your client reference and status, the people we deal with, the services we provide, and the relevant dates and enquiries connected with those services. We keep this information in accordance with the retention periods described in this notice and our applicable professional and legal obligations.

5. Who we share information with

We do not sell personal information. We use the following service providers. Processors are subject to appropriate contractual safeguards where applicable. Any supplier acting as an independent controller for particular processing is identified separately below.

Cloudflare Turnstile: Turnstile processes security signals such as your IP address and browser and connection information to distinguish people from automated bots. Turnstile does not access, store or transmit the information you enter into our forms or other page inputs. Cloudflare acts as our processor when providing Turnstile, and may separately act as a controller when using Turnstile signals to improve its bot-detection capabilities. More information: Cloudflare Turnstile privacy information.

Website emails: our website emails contain only what is needed to identify an enquiry – not your financial details or your message. Buyer reconfirmation emails also contain a link you can use to confirm your criteria.

We may share personal information where reasonably necessary with our professional advisers, insurers, legal advisers, auditors, regulators and other service providers, subject to appropriate confidentiality, contractual and legal safeguards. We may also disclose information where the law requires it.

6. Where information is stored and international transfers

• Our application database (where enquiries and registrations are stored) is hosted by Supabase in London, UK. Our contractual service provider is Supabase Pte. Ltd., a Singapore entity. Supabase and its authorised sub-processors may access or process information outside the UK where required to provide the service, including for support and operations. Its data processing terms include appropriate international-transfer safeguards, including the UK International Data Transfer Addendum where applicable.
• Our website is hosted and delivered by Vercel. Relevant server-side functions are configured to run in London, while website content may be delivered through Vercel's global network. Vercel is a US company. Vercel's data processing terms incorporate the applicable standard contractual clauses and UK International Data Transfer Addendum for restricted transfers.
• Cloudflare operates a global network. Transfers to the US rely on the UK Extension to the EU–US Data Privacy Framework, with standard contractual clauses and the UK Addendum as a fallback.
• Resend stores email data in the United States, including message content and delivery logs, and keeps it for 30 days. Transfers rely on standard contractual clauses with the UK Addendum and the UK Extension to the EU–US Data Privacy Framework.
• Google Workspace (our business email) may process information outside the UK – Google's affiliates and sub-processors operate in many countries. We have accepted Google's Cloud Data Processing Addendum, which includes Google's commitments for transfers of personal data subject to the UK GDPR.
• HubSpot stores our CRM data in its European Union data centre in Germany. HubSpot and its affiliates and sub-processors may access or process information outside the UK where required to provide and support the service. Where this involves a restricted international transfer, HubSpot uses recognised transfer safeguards under its Data Processing Agreement, including the UK Extension to the EU-US Data Privacy Framework where applicable and contractual safeguards such as the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum where required.

7. Cookies

Our public website does not use analytics, advertising or tracking cookies. It only uses technologies that are strictly necessary, such as Cloudflare Turnstile on form pages. See our Cookie Notice.

8. Keeping information secure

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. Our primary application database is encrypted at rest and network communications are encrypted in transit. Information we delete may remain in our database provider's encrypted backups for up to 7 days before it is overwritten. No internet-based system can be guaranteed to be completely secure.

9. Your rights

You have the right to: be informed; access your information; have it corrected; have it erased; restrict how we use it; object to our use of it (including any use based on legitimate interests and, at any time, to direct marketing); receive it in a portable format where applicable; and withdraw consent at any time where we rely on consent (this does not affect processing before you withdrew it). Some rights apply only in certain circumstances.

When you exercise your rights, we act on them in both our application and HubSpot – for example, an erasure request is carried out in both, and a request not to be contacted is respected in both.

You can object at any time to our use of your personal information for direct marketing. If you do, we will stop using it for that purpose.

To exercise any of these rights, please email privacy@proplexo.co.uk. We will respond without undue delay and normally within one month. Where the law allows us additional time because a request is complex or you have made a number of requests, we will tell you within the initial one-month period and explain why.

10. Complaints about how we handle your information

You can complain to us directly about how we use your personal information. Please email privacy@proplexo.co.uk (or contact us in any other way) and tell us what has happened. We will acknowledge your complaint within 30 days, look into it, keep you informed and tell you the outcome without undue delay. This is separate from our general complaints procedure for our services.

You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office
4th Floor, No.3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL

Helpline: 0303 123 1113
Make a complaint to the ICO

11. Changes to this notice

We will update this notice when our use of personal information changes. The version and date at the top show when it was last updated.