The Business Acquisitions Group Ltd (trading as The Acquisitions Group)
Registered in England & Wales, company number 17038316
Registered office: The Point, Granite Way, Mountsorrel, Loughborough, Leicestershire, LE12 7TZ
ICO registration number: ZC152704

Version 1.0  |  4 September 2026

1. Who we are and how to contact us

The Business Acquisitions Group Ltd ("we", "us", "our") is the data controller of the personal data described in this notice. We trade as The Acquisitions Group and operate the websites acquisitionsgroup.co.uk and valuation.acquisitionsgroup.co.uk.

We are registered with the Information Commissioner's Office (ICO) under registration number ZC152704.

If you have any question about this notice or how we handle your personal data, or you want to exercise any of your rights, please contact us:

• Email: [email protected]
• Post: Data Protection, The Business Acquisitions Group Ltd, The Point, Granite Way, Mountsorrel, Loughborough, Leicestershire, LE12 7TZ
• Telephone: 0800 652 8088

2. Who this notice covers

This notice applies to personal data about:

• Website visitors — anyone who uses our websites, including the business valuation tool.
• Enquirers and prospective clients — business owners, directors and their representatives who contact us, request a valuation or ask about buying or selling a business.
• Clients — the individuals who engage us, and the people acting for a client business, under our Terms of Business.
• Buyers, sellers and counterparties — owners and representatives of businesses we introduce to, or approach on behalf of, our clients, including the individuals recorded in our database of buyers, sellers and prospects.
• Business contacts and professional advisers — accountants, solicitors, lenders, franchisors, suppliers and other people we deal with in the course of our work.
• Job applicants — people who apply for roles with us.

Much of the data we hold relates to people in their business capacity (for example, the director of an estate agency). That is still personal data and this notice applies to it.

3. The personal data we collect

Depending on your relationship with us, we may collect and use the following categories of personal data:

• Identity and contact data — name, job title or role, business name, business address, email address, telephone number, LinkedIn or other professional profile.
• Business and financial data — information about the business you own or represent, such as turnover, profit, fee income, number of managed properties, staff numbers, ownership structure, Companies House filings, and any figures you enter into the valuation tool or provide to us during an engagement.
• Transaction data — details of your intentions, timescales and requirements for buying or selling a business, offers, negotiations, heads of terms and completion details.
• Correspondence and communications — the content of emails, messages, forms, calls and meetings with us, including recordings and transcripts where section 8 applies.
• Identity verification data — where we are required to carry out anti-money laundering or know-your-client checks, copies of identity documents, proof of address and information about sources of funds.
• Marketing and engagement data — your marketing preferences, and whether you have opened or clicked emails we have sent you.
• Technical and usage data — IP address, browser type and version, device type, pages viewed, time on page, how you arrived at our site, and interactions with our websites (see section 14 and our Cookie Policy).
• Recruitment data — CV, application details and interview notes if you apply for a role with us.

We do not intentionally collect special category data (such as health, religion, ethnicity or political opinions) or criminal offence data, except to the limited extent that a legally required anti-money laundering check may disclose it. Please do not send us such information unless we ask for it.

4. Where we get personal data from

We collect personal data:

• Directly from you — when you complete a form on our website, use the valuation tool, email or call us, connect with us on LinkedIn, book a meeting, engage our services or apply for a job.
• From the business you represent — for example, where a client provides details of its shareholders, staff or advisers, or a buyer provides details of its acquisition team.
• From publicly available sources — Companies House, the Land Registry, business websites, property portals, industry directories, trade press and professional networking sites such as LinkedIn.
• From third parties — licensed business-to-business contact data providers, professional advisers who refer you to us, franchisors or networks you belong to, and counterparties in a transaction.
• Automatically — from your device when you use our websites (see section 14).

Where we obtain your personal data from a source other than you, we will tell you about it either when we first contact you or, if we do not contact you, within one month of obtaining it, unless providing that information would be impossible or involve disproportionate effort. This notice forms part of that information.

5. How and why we use personal data

UK data protection law requires us to have a lawful basis for each use of personal data. The table below sets out the purposes for which we use personal data and the lawful basis we rely on.

Purpose	Lawful basis
Responding to enquiries, requests for information and valuation requests	Our legitimate interest in responding to people who contact us, and steps taken at your request before entering into a contract.
Providing our M&A advisory and brokerage services to clients, including preparing sale materials, approaching and qualifying counterparties, managing negotiations and supporting completion	Performance of our contract with the client. Where you are a counterparty or a representative of a client rather than the client, our legitimate interest in delivering the services we have been engaged to provide.
Maintaining our database of buyers, sellers and prospects so that we can match businesses for sale with suitable acquirers and identify owners who may wish to sell	Our legitimate interest in operating our business and in facilitating transactions in the sectors we serve. We keep this data at a business-contact level and you can object at any time (section 13).
Telling business owners and acquirers about our services, market insights and opportunities	Our legitimate interest in promoting our services to businesses, or your consent where the law requires it. See section 7.
Carrying out anti-money laundering, sanctions and know-your-client checks	Compliance with our legal obligations, and our legitimate interest in preventing fraud and financial crime.
Managing our relationship with clients, counterparties and advisers, including invoicing, accounting and record keeping	Performance of a contract and compliance with legal obligations (for example, tax and company law).
Running, securing and improving our websites and IT systems, and understanding how our websites are used	Our legitimate interest in keeping our systems secure and improving our services. Where cookies or similar technologies are used, your consent where required (see our Cookie Policy).
Measuring the effectiveness of our advertising	Our legitimate interest in understanding which advertising works, or your consent where required.
Establishing, exercising or defending legal claims, and enforcing our Terms of Business	Our legitimate interest in protecting our legal position.
Recruitment	Steps taken at your request before entering into a contract, and our legitimate interest in assessing candidates.

Where we rely on legitimate interests we have considered whether those interests are outweighed by your interests, rights and freedoms and concluded that they are not, given the business context in which we operate and the safeguards we apply. You can ask us for more information about that assessment.

6. The business valuation tool

Our valuation tool at valuation.acquisitionsgroup.co.uk asks for information about you and your business (for example, your name, email address, telephone number, business name, sector and financial figures such as turnover and profit) in order to produce an indicative valuation range. We use that information to:

• generate and send you your indicative valuation and, where offered, allow you to create an account to save and revisit it;
• follow up with you about your valuation and discuss whether our services could help you, which may include a call or email from a member of our team;
• understand market conditions in the sectors we serve, using aggregated figures that do not identify you or your business.

The valuation is indicative only and is generated by a formula applied to the figures you provide. It is not a decision that has legal or similarly significant effects on you (see section 15). By submitting the form you understand that we may contact you about your valuation. You can ask us to stop at any time.

7. Marketing and how to opt out

We may contact business owners, directors and decision-makers by email, telephone, post or LinkedIn about our services, market insights, events and businesses for sale or acquirers seeking businesses. We do this because it is central to how a broker works: matching people who want to sell a business with people who want to buy one.

Where we send electronic marketing to a corporate subscriber (for example, an email to a named director at a limited company address), we rely on our legitimate interests. Where the law requires consent — for example, for sole traders, partnerships and individual subscribers — we will ask for it first.

Every marketing email we send includes an unsubscribe link. You can also opt out of any or all marketing at any time by emailing [email protected], replying to the message you received, or telling the person who contacted you. We will act on your request promptly and keep a suppression record so that we do not contact you again for marketing purposes.

Opting out of marketing will not affect messages we need to send you about a live engagement or transaction.

8. Calls, meetings and recordings

We may record or transcribe telephone calls, video calls and meetings, using note-taking and transcription tools, so that we have an accurate record of what was discussed and can act on it. Where we do this we will tell you at the start of the call or meeting. Recordings and transcripts are treated as confidential, are used only for the purposes in section 5, and are kept in line with section 11.

9. Who we share personal data with

We do not sell personal data. We share it only where necessary, with:

• Counterparties to a transaction — where you are selling, we share information about your business with vetted prospective buyers, normally under a non-disclosure agreement and with your agreement to the level of detail disclosed; where you are buying, we share your acquisition criteria and, at the appropriate stage, your identity with sellers.
• Professional advisers — solicitors, accountants, lenders, valuers and other advisers involved in a transaction, where you have asked us to work with them or they are acting for a counterparty.
• Our service providers (data processors) who act on our instructions and are bound by contract to protect your data. These include our customer relationship management, email, telephony and marketing platforms; website hosting and form providers; analytics and advertising measurement providers; meeting recording and transcription tools; business data and enrichment providers; document, e-signature and file storage services; task management and internal communication tools; and our outsourced marketing agency.
• Identity verification and screening providers for anti-money laundering and sanctions checks.
• Our accountants, auditors, insurers and legal advisers.
• Regulators, law enforcement, courts and other authorities where we are required or permitted to do so by law.
• A purchaser or prospective purchaser of our business or its assets, and their advisers, subject to confidentiality obligations.

A current list of the categories of service providers we use, and the countries they operate in, is available on request.

10. International transfers

We are based in the United Kingdom and most of our processing takes place here. Some of our service providers (for example, our CRM, analytics, transcription and data enrichment platforms) are based in, or store data in, the United States or other countries outside the UK. Where personal data is transferred outside the UK we ensure it is protected by one of the safeguards recognised by UK law — an adequacy regulation issued by the UK Government (including the UK–US Data Bridge, where the recipient is certified), the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — together with appropriate security measures. You can ask us for more information about the safeguards that apply.

11. How long we keep personal data

We keep personal data only for as long as we need it for the purposes described above, which depends on the type of data and why we hold it:

Type of data	Retention period
Website enquiries and valuation tool submissions that do not lead to an engagement	Up to 3 years from our last meaningful contact with you, so that we can follow up if your plans change.
Client engagement files, transaction records, correspondence and invoices	7 years from the end of the engagement or completion of the transaction, to meet our legal, tax and limitation-period obligations.
Anti-money laundering records	5 years from the end of the business relationship, as required by the Money Laundering Regulations.
Buyer, seller and prospect database records	For as long as the business remains a relevant prospect and the data is accurate; reviewed periodically and removed if you object or the data becomes out of date.
Marketing suppression records	Indefinitely, so that we can honour your opt-out.
Call and meeting recordings and transcripts	Up to 12 months, unless they form part of an engagement file.
Recruitment records for unsuccessful applicants	6 months from the end of the recruitment process.
Website analytics and advertising data	See our Cookie Policy for cookie lifetimes; analytics reports are retained for up to 14 months.

We may keep data for longer where necessary to deal with a complaint, claim or investigation. When data is no longer needed it is securely deleted or anonymised.

12. How we keep personal data secure

We apply appropriate technical and organisational measures to protect personal data, including access controls and multi-factor authentication on our systems, encryption of data in transit, use of reputable cloud providers with independent security certifications, confidentiality obligations on our team and suppliers, and non-disclosure agreements before confidential business information is shared with prospective buyers. No system is completely secure, but we will notify you and the ICO where the law requires if a breach affects your data.

13. Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Rectification of inaccurate or incomplete data.
• Erasure of your data in certain circumstances.
• Restriction of processing in certain circumstances.
• Object to processing based on legitimate interests, and to direct marketing at any time — if you object to marketing we will stop.
• Data portability — to receive data you provided to us in a machine-readable format where processing is based on consent or contract and carried out by automated means.
• Withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us using the details in section 1. We do not normally charge a fee. We may need to confirm your identity before we act on a request. We will respond within one month, which we may extend by up to two further months for complex or multiple requests, in which case we will tell you.

These rights are not absolute. For example, we may need to retain data to comply with a legal obligation or to establish, exercise or defend legal claims, and we will explain if that is the case.

14. Cookies and website analytics

Our websites use cookies and similar technologies to make the sites work, to understand how they are used and to measure the effectiveness of our advertising. Our sites currently use Google Tag Manager, Google Analytics, Google Ads conversion measurement and Microsoft Clarity, and our enquiry forms are provided by a third-party form platform. Full details of the cookies used, how long they last and how to control them are in our Cookie Policy.

15. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. The valuation tool applies a formula to the figures you provide to give an indicative range; it does not make any decision about you, and any assessment of whether and how we can help is made by a member of our team.

16. Children

Our services and websites are directed at businesses and business owners. We do not knowingly collect personal data from anyone under 18. If you believe we have done so, please contact us and we will delete it.

17. Third-party websites

Our websites and communications may contain links to other websites, including LinkedIn, YouTube, Companies House and property portals. We are not responsible for the privacy practices of those sites and encourage you to read their privacy notices.

18. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at [email protected] so that we can try to resolve it. You also have the right to complain to the Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

19. Changes to this notice

We may update this notice from time to time. The version number and date at the top show when it was last changed. Where a change is significant we will take reasonable steps to bring it to your attention, for example by email if we hold your address or by a notice on our website.