DealFlow

Privacy Policy

Version 2026-10-02, effective 2 October 2026. Read the Terms of Service

This Privacy Policy explains how DealFlow collects, uses, and protects your personal data, and the rights you have under the EU General Data Protection Regulation (GDPR). It complements our Terms of Service.

1. Data controller

The controller of your personal data is DealFlow.Business (KvK 42163831), Rockplein 41, 2033 KK Haarlem, the Netherlands. For any privacy matter, contact us at [email protected].

2. What data we collect

  • Account data — name, email address, hashed password, and (if you use LinkedIn sign-in) your LinkedIn identifier.
  • Profile data — phone, address, firm/company name, website, role, and (for buyers) investment criteria and preferences.
  • Listing and business data — information you publish about a business, including financial figures.
  • Transactional data — expressions of interest, NDAs (including a snapshot of the agreed terms), the messages you exchange with other Users, and a record of the introductions you send to advisors through the directory (which firm, and when — the introduction itself is emailed to the firm and not kept).
  • Uploaded files — documents and images you upload.
  • Document access records — when you download a document attached to a Listing we record who you are, which document it was, and when, together with the IP address the request came from. This applies to public documents as well as those behind an NDA. The Business that published the Listing sees only the documents opened by a counterparty who has signed its NDA; the full record, including downloads of public documents, is visible to our staff and is used to investigate misuse of confidential material.
  • Deal room data — content shared inside a deal room, including documents and any files a member uploads, due-diligence checklists, contracts and their signatures, chat messages, and an access log recording who viewed or downloaded each document. Deal-room content is retained for a limited period after the room is closed and then permanently deleted.
  • Advisor directory statistics — how often each firm's directory entry is shown in results, opened, and has its website link followed, counted by our server as daily totals. To count each member's view or click only once a day, we keep which entries a member opened for two days, then delete it. A firm sees totals only, never who looked. Nothing is stored in your browser for this.
  • People on a firm's directory entry — an advisory firm can show people from its own team on its entry in the advisor directory: their name, the role the firm gives them and their profile photo. The firm's owner chooses who is shown. Signed-in members see it on the entry's own page, never with an email address or phone number. Someone who leaves the firm's team is no longer shown, and you can ask your firm's owner to take you off at any time.
  • Preferences — your email/notification settings.
  • Technical data — authentication and session tokens, a throttled "last active" timestamp, and administrative audit logs recording actions taken on the Platform.

3. How and why we use your data (legal bases)

  • To provide the Platform — create your account, publish Listings, enable messaging, NDAs and document sharing. Legal basis: performance of a contract.
  • To verify Users and keep the Platform safe — review buyers and listings, prevent fraud and abuse, maintain audit logs. Legal basis: legitimate interests / legal obligation.
  • Transactional emails — verification, password reset, and activity notifications. Legal basis: performance of a contract / legitimate interests.
  • Marketing emails — only where you have opted in. Legal basis: consent (withdrawable at any time).
  • Legal compliance — to meet our legal and regulatory obligations. Legal basis: legal obligation.

4. Cookies

We use strictly necessary cookies only: they keep you signed in and secure your session, and the Platform cannot function without them. We set no analytics, advertising or tracking cookies, so there is nothing optional to consent to. If that changes we will ask you first.

5. Who we share data with

We do not sell your personal data. We share it only with service providers (processors) that help us run the Platform, and with other Users where you choose to interact (e.g. messaging, NDAs, or an introduction to an advisor, which carries your name and email address). Our processors include:

  • Cloudflare R2 — storage of uploaded documents and images.
  • Resend — delivery of transactional and notification emails.
  • LinkedIn — if you choose to sign in with LinkedIn, it provides us your basic profile and email; this is governed by LinkedIn's own privacy policy.

We may also disclose data where required by law or to protect our rights and the safety of Users.

6. Firms in the advisor directory

Most firms in the advisor directory created their entry themselves. Some we compiled from public records instead, so that buyers, investors and businesses looking for an advisor can find them. This section is about those.

  • What we hold — the firm's name, what kind of firm it is, where it is based, the services it lists, its website, its registration number and legal form, and the page we took this from, with the date we checked it. We also hold the firm's general email address, which we use only to tell the firm about its entry and never show. We compile firms, not people, and we don't add a summary, logo or phone number.
  • Where it comes from — public business registers and the firm's own website. Each entry links to its source.
  • Why, and on what basis — to help the people looking for an advisor find one. Legal basis: legitimate interests (Art. 6(1)(f) GDPR), limited to what the firm itself has made public for the purpose of being found.
  • Who sees it — signed-in members only, with the entry marked as unclaimed. It is not part of the public page, and members can't contact the firm through us until it has claimed its entry.
  • Telling the firm — an entry is published only once we have emailed the firm about it. That email says what the entry shows and where it came from, and has two links: one to remove the entry, one to claim it.
  • Objecting — the firm may object at any time (Art. 21 GDPR). The removal link in our email deletes the entry at once, with no account needed. Without the link, email [email protected].
  • What we keep after a removal — a one-way fingerprint (a SHA-256 hash) of the firm's web domain, email address and registration number, and nothing readable. It lets us recognise the firm if it turns up in a later import, so it is never listed again. We keep it for as long as we compile the directory.
  • Claiming — a firm registered on DealFlow as an intermediary can claim its entry. Once we approve the claim, the firm's intermediary profile takes its place and the entry we compiled is no longer shown. We keep it, unpublished, so that a later import recognises the firm, and the removal link in our email still deletes it.
  • How long — a compiled entry stays until the firm removes it, or we take it down.

7. International transfers

Some of our processors may handle data outside the European Economic Area. Where this happens, we rely on appropriate safeguards under Chapter V of the GDPR, such as European Commission adequacy decisions or Standard Contractual Clauses.

8. Retention and security

We keep your personal data for as long as your account is active and as long as needed to provide the Platform and comply with legal obligations. Some content is soft-deleted and removed or anonymised thereafter. We protect your data with measures including strong password hashing (Argon2), rotating session tokens with reuse detection, and access controls. No system is completely secure, but we work to protect your information.

9. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • rectify inaccurate or incomplete data;
  • erase your data ("right to be forgotten");
  • restrict or object to certain processing;
  • data portability;
  • withdraw consent at any time (e.g. for marketing emails).

To exercise these rights, email [email protected]. You also have the right to lodge a complaint with your supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will publish the updated version with a new version number and effective date, and notify you of material changes where appropriate.

11. Contact

For privacy questions or to exercise your rights, contact us at [email protected].