LEGAL

Privacy Policy

Last updated: 1 September 2026

This Privacy Policy explains how Valtaris collects, uses, and protects your personal data when you visit our website or engage with us in connection with a potential business acquisition. We are committed to handling your data responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Valtaris ("we", "us", "our") is a direct acquirer of established UK businesses. Our registered address is in London, United Kingdom.

We are the data controller for personal data collected through this website and through our business acquisition enquiry process. If you have any questions about how we handle your data, please contact us at enquiries@valtaris.co.

2. What Data We Collect

We may collect the following categories of personal data:

— Contact information: your name, email address, telephone number, and business name, when you submit an enquiry through our contact form or correspond with us directly.

— Business information: details about the business you are considering selling, including financial and operational information you choose to share with us.

— Technical data: IP address, browser type, device type, pages visited, and time spent on pages, collected automatically when you visit our website.

— Communications: records of correspondence between you and Valtaris.

3. How We Use Your Data

We use your personal data for the following purposes:

— To respond to your enquiry and assess whether your business meets our acquisition criteria.

— To progress and complete a business acquisition transaction.

— To comply with legal and regulatory obligations.

— To improve our website and understand how visitors use it.

We do not use your data for marketing purposes without your explicit consent, and we do not sell or rent your data to third parties.

4. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

— Legitimate interests: to respond to business enquiries and conduct our acquisition activities.

— Contractual necessity: where processing is necessary to take steps at your request prior to entering into a contract.

— Legal obligation: where we are required to process data to comply with applicable law.

— Consent: where you have given us explicit consent, for example to receive communications from us.

5. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law.

Enquiry data from contacts that do not proceed to a transaction is typically retained for up to 24 months. Data relating to completed transactions is retained for a minimum of 7 years in accordance with legal and accounting obligations.

You may request deletion of your data at any time (see Section 8).

6. Sharing Your Data

We may share your personal data with:

— Professional advisers (solicitors, accountants, financial advisers) engaged in connection with a transaction, under strict confidentiality obligations.

— IT and infrastructure service providers who support the operation of this website, under data processing agreements.

— Regulatory authorities or law enforcement where required by law.

We do not transfer your personal data outside the United Kingdom or European Economic Area without appropriate safeguards in place.

7. Cookies and Analytics

Our website may use cookies and similar technologies to understand how visitors use the site. These may include session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a set period).

You can control cookies through your browser settings. Disabling cookies may affect the functionality of certain parts of this website.

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

— Right of access: to request a copy of the personal data we hold about you.

— Right to rectification: to request correction of inaccurate or incomplete data.

— Right to erasure: to request deletion of your data in certain circumstances.

— Right to restriction: to request that we limit how we use your data.

— Right to data portability: to receive your data in a structured, machine-readable format.

— Right to object: to object to processing based on legitimate interests.

To exercise any of these rights, please contact us at enquiries@valtaris.co. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. All data transmitted via our contact form is encrypted in transit.

Despite these measures, no transmission over the internet is completely secure. If you have concerns about the security of your data, please contact us.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page reflects when it was last revised. We encourage you to review this page periodically.

Continued use of our website following any changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

Email: enquiries@valtaris.co

Post: Valtaris, London, United Kingdom