Privacy Policy

1. About this policy

This Privacy Policy explains how Equiterra collects, uses, shares and protects personal data when you visit our website, contact us or correspond with us. We have written it in plain English. If anything is unclear, please email info@equiterra.co.uk and we will explain.

2. Who we are

Equiterra is a corporate finance and origination platform for hospitality and operational real estate, headquartered in London.

For the purposes of UK GDPR and the Data Protection Act 2018, Equiterra is the data controller for the personal data described in this policy.

Equiterra is registered with the UK Information Commissioner's Office (ICO).

3. What personal data we collect

We collect personal data in three ways:

a) Information you give us through the contact form on equiterra.co.uk

• Your name
• Your firm
• Your email address
• Your role (sponsor, investor, operator, lender, other)
• The content of any message you send us, including any opportunity, mandate or strategy details you choose to share

b) Information you give us by email or other direct correspondence

• Your name and contact details
• Any information you choose to share with us in the course of a conversation, mandate or transaction

c) Information we collect automatically when you visit equiterra.co.uk

• Your IP address
• Your browser type and operating system
• The pages you visit and the time spent on the site
• Aggregate usage data via our hosting provider's standard server logs

d) Information we collect when entering into a business relationship with you

Where we enter into a business relationship with you or your firm (for example, a mandate, partnership or transaction), we may need to collect additional identity and verification information. This may include:

• Identity documents and proof of address
• Beneficial ownership information for corporate entities
• Source of funds and source of wealth information
• Corporate documentation

We collect this information to comply with our internal due-diligence procedures and any applicable legal requirements relating to financial integrity, anti-money-laundering and counter-terrorism financing.

We do not knowingly collect personal data from anyone under 18.

4. How we use your personal data

We use your personal data to:

• Respond to enquiries and correspondence
• Discuss potential mandates, transactions or capital partnerships
• Manage and execute mandates we have agreed with you
• Maintain our network of capital partners, sponsors and operators
• Conduct due diligence and identity verification on prospective business relationships
• Send you occasional firm updates if you have asked to receive them
• Comply with our legal, accounting and record-keeping obligations
• Detect, prevent and address fraud, security and technical issues

5. Lawful basis for processing

Under UK GDPR, we rely on the following lawful bases:

Legitimate interests  for B2B correspondence, network-building and managing our business relationships. We have assessed that our interests do not override your rights and freedoms in this professional context.

Performance of a contract  where we are negotiating or delivering a mandate with you or your firm.

Consent  where you actively opt in to receive specific communications from us. You can withdraw consent at any time by emailing info@equiterra.co.uk.

Legal obligation  where we must process data to comply with UK law (anti-money-laundering, accounting, record-keeping).

6. Who we share your data with

We do not sell your personal data. We share it only with the following categories of recipients:

Recipient	Purpose
Microsoft (Microsoft 365)	Hosting our email mailboxes
Netlify	Hosting our website, DNS and contact form submissions
dmarcian	Email authentication monitoring
Professional advisors	Lawyers, accountants, auditors for legal and accounting compliance
Capital partners, sponsors, operators	Only with your explicit knowledge and where directly relevant to a mandate you have asked us to work on
Regulators or law enforcement	Where required by law

Each of these processors is contractually obliged to protect your data and only process it on our instructions.

7. International data transfers

Some of our processors are based outside the UK, including in the United States and the European Union (Microsoft, Netlify, dmarcian).

Where your data is transferred outside the UK, we rely on:

• The UK government's adequacy decisions for the EEA
• The UK International Data Transfer Agreement or equivalent contractual safeguards
• Standard Contractual Clauses approved by the UK Information Commissioner

8. How long we keep your data

We keep your personal data only as long as necessary for the purposes set out in this policy:

• Contact form submissions and general correspondence: up to 7 years from the date of last contact, in line with our accounting and record-keeping requirements
• Mandate and transaction records: for the duration of the engagement plus 7 years thereafter, to meet UK record-keeping standards
• Marketing communications opt-ins: until you unsubscribe or withdraw consent
• Website server logs: typically up to 90 days

We securely delete or anonymise data when these retention periods end.

9. Your rights

Under UK GDPR you have the following rights regarding your personal data:

• Right of access request a copy of the personal data we hold about you
• Right to rectification ask us to correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") ask us to delete your data, subject to our retention obligations
• Right to restrict processing ask us to limit how we use your data
• Right to data portability receive your data in a machine-readable format
• Right to object object to our processing based on legitimate interests
• Right to withdraw consent at any time, where consent is the lawful basis
• Right not to be subject to automated decision-making we do not currently use any

To exercise any of these rights, email info@equiterra.co.uk. We will respond within one calendar month.

If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

10. Cookies

Our website uses a minimal number of cookies and similar technologies.

Essential cookies (no consent required) used solely to make the site function, including form session handling. We do not use these for tracking.

Analytics cookies we currently do not use third-party analytics. If we add analytics in future, we will update this policy and (where required) ask for your consent through a banner.

Third-party cookies when you submit our contact form, Netlify may use minimal cookies to validate the submission and protect against spam.

You can block or delete cookies through your browser settings. Doing so may affect how the site functions.

11. Security

We take appropriate technical and organisational measures to protect your personal data, including:

• TLS encryption for all website traffic (HTTPS)
• Email authentication (SPF, DKIM, DMARC) to prevent spoofing
• Access controls and least-privilege principles for our internal systems
• Regular reviews of third-party processors' security postures

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but we follow industry-standard best practices.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent version. Material changes will be communicated by updating this page or, where appropriate, by direct email.

13. Contact us

For any privacy-related questions or to exercise any of your rights: