Full Potential Consulting Ltd, trading as Full Potential, is the controller of personal data described in this policy. We provide M&A advisory, business sale and exit planning services. This policy explains how we use personal data relating to website visitors, business owners, professional advisers, prospective acquirers and other business contacts under the UK GDPR and Data Protection Act 2018, as amended.
Who we are
Full Potential Consulting Ltd, trading as Full Potential, is the organisation responsible for the personal data described in this policy.
Personal data we collect
We collect your name, business name, job role, business contact details, enquiry type, messages and correspondence. If you register acquisition criteria, this may include investment preferences, sector, geography and financial ranges where linked to you. We also process technical information such as IP address, browser and device information, access times and security logs, and cookie choices and website usage information where the relevant technology is enabled.
You provide information through forms, email, telephone and meetings. We may also receive business contact information from professional introductions, public company websites, Companies House and professional directories. Where we obtain data indirectly, we provide privacy information within the applicable legal timeframe, normally no later than one month and earlier if we first contact you or disclose it before then, unless a lawful exception applies.
Please do not send special category data, criminal offence information or sensitive transaction documents through the general enquiry form. A separate engagement notice and secure exchange arrangements will cover additional personal data required for a client assignment.
Why we use data and our lawful bases
Responding to enquiries. We use contact details and correspondence to understand and answer your enquiry, arrange meetings and follow up relevant discussions. Our lawful basis is legitimate interests in communicating with prospective clients and business contacts. Where you personally request steps before entering a contract with us, we rely on taking those pre-contract steps. For contacts acting for a company, legitimate interests normally applies.
Providing services and maintaining relationships. We use relevant contact and engagement information to deliver agreed services, manage introductions and maintain adviser or acquirer relationships. We rely on contract where you are personally party to the contract; otherwise we rely on legitimate interests in administering and delivering business services. Any legal obligation relied upon must be identified for the particular processing.
Security and administration. We process access logs, correspondence and necessary service information for website security, fraud prevention, service administration and establishing or defending legal claims. We rely on legitimate interests in protecting the business, website and users, and on legal obligation where a specific duty requires processing.
Optional website analytics and marketing. For the consent-based setup described in our Cookie Policy, we rely on consent for personal data processed through optional analytics or advertising technologies. We only send electronic marketing where permitted by applicable marketing rules and with an appropriate UK GDPR basis. Where consent is required, we obtain it separately. You can unsubscribe or object to direct marketing at any time.
When we rely on legitimate interests, we consider the necessity of the processing and its effect on your rights and reasonable expectations. You may ask us about our assessment or object to the processing. We do not treat submission of an enquiry as consent to unrelated marketing.
Information you need to provide
The enquiry form requires your name and email so we can identify and answer your enquiry. Other fields are optional unless explained at collection. There is no statutory obligation to use the website form. If essential information is missing, we may be unable to respond or provide the requested service. Contractual information requirements are explained before an engagement begins.
Who we share data with
We share personal data only where needed for the purposes above, including with approved website hosting and maintenance providers, email and cloud service providers, CRM and business administration providers, professional advisers and security providers. They must have an appropriate legal role and safeguards, and processors must act on our documented instructions.
We may share relevant details with a prospective transaction counterparty or another adviser when appropriate to your instructions and the engagement, with suitable confidentiality arrangements. We may disclose information where required by law, to protect legal rights, or as part of a business transfer with appropriate safeguards. We do not use the website enquiry process as permission to circulate confidential business details to buyers.
How long we keep data
We retain personal data only for as long as necessary for its purpose, including relevant legal, accounting and claims requirements. We consider the nature and sensitivity of the data, the relationship, the purpose, applicable duties and whether a dispute or legal hold requires longer retention. We then delete or anonymise it securely.
Security
We use appropriate technical and organisational measures to protect personal data, proportionate to its risks. Access is limited to those who need it, and suppliers must provide appropriate protection. No internet transmission is entirely risk-free. Contact us to arrange a suitable secure channel before sharing confidential deal documents.
Your rights
Depending on the circumstances, you can request access to your personal data, correction, erasure, restriction and portability. You can object to processing based on legitimate interests and have an absolute right to object to direct marketing. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing. Some rights are conditional and legal exemptions may apply; we explain any refusal and your options.
Use our contact form to exercise your rights or raise a privacy query. We normally respond without undue delay and within one month. The law permits extensions for complex or multiple requests; where used, we explain the extension and reasons within the initial period. We may ask for proportionate identity information. Requests are normally free, subject to the exceptions permitted by law.
Automated decisions and children
We do not make solely automated decisions about you that produce legal or similarly significant effects as part of the website enquiry process. If that changes, we will explain the processing and applicable safeguards before it begins. Our website and services are intended for business users and are not directed at children.
Cookies and other websites
See our Cookie Policy for information about cookies and similar technologies and how to change your choices. External websites have their own privacy information; review it when you follow an external link.
Complaints and changes
Please contact us using the contact form if you have a concern. We provide a way to raise complaints, acknowledge them within 30 days, investigate appropriately without undue delay, keep you informed and tell you the outcome without undue delay. This complaints process is separate from the time limits for rights requests. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.
We update this policy when our processing or legal requirements change, publish the revised date and communicate material changes where appropriate.