Privacy
Contact us at hello@attainer.co.uk about anything on this page. You can download or delete everything we hold about you from your account.
Who is responsible
Attainer is operated by Byter, which is the data controller for the personal data described here. Contact hello@attainer.co.uk about anything on this page, including a request to exercise any of the rights below.
Cookies and measurement
There is still no cookie banner, because there is still nothing to consent to. The only cookie we set is the one that keeps you signed in, which is strictly necessary and exempt from the consent requirement. We count page views using Vercel Web Analytics, which is served from this domain and sets no cookie, stores no identifier and builds no profile: it records that a page was viewed, not who viewed it. We run no advertising pixels and no third-party trackers, and we do not share anything for advertising.
What we collect
For visitors: nothing beyond what is needed to serve the page. For people who set an alert: an email address and the search it applies to. For people who enquire about a listing: name, email, optional telephone number and the message. For people who fill in the valuation, contact or broker form: name, email, optional telephone number, company, the message, and the page you filled it in on. A valuation form also records the figures you entered about your own business and the range we showed you, because that is a record of what you were told and we would otherwise be unable to answer sensibly when we call. For sellers and brokers: account details, the listing content, and the results of identity and authority checks.
Why we are allowed to
Filling in one of our forms and asking us to come back to you is a request to take steps before entering a contract, which is what allows us to hold what you typed and to reply to it. Running your account, your listings and your enquiries is necessary to perform our contract with you. Keeping records of signed agreements, offers and document access is our legitimate interest and yours: it is what lets either party rely on them later. Alerts are consent, which you can withdraw at any time. Where a check is run at your request, that is also contract.
Verification evidence
Where an identity, authority or funding check is carried out, we store the provider's result and the date, not the underlying documents or bank data. Raw identity documents are never stored on this platform. A trust badge renders only from a result returned by a real provider: a rehearsal against our test adapter is stamped as such and earns nothing.
How we know which page you came from
When you submit one of our forms we record the page it was on, and the referring address your browser sent. That is how we tell which of our articles is worth writing more of, and it is why we have not installed an advertising pixel or an analytics product that follows you: the answer is already in the form you chose to fill in. It is attached to that submission only. It is not a profile, it does not follow you around the site, and it is not shared with anyone.
Alerts
Alerts are double opt-in: an address receives nothing until its owner clicks the confirmation link. Every alert carries a one-click unsubscribe, and unsubscribing removes the address rather than flagging it.
Messages and confidentiality
Messages between buyers and sellers are stored so both sides have an audit trail. Before an NDA is signed, email addresses, telephone numbers and links are removed from message bodies on the server before the message is written, so the raw detail is never held at all.
Data rooms and watermarking
Documents are held in a private bucket that no browser can read. Every PDF released to a buyer is stamped, as it is served, with the name and email address of the person opening it, and every opening is recorded for the seller. If you open a document in somebody's data room, your name is on the copy you receive and the seller can see that you opened it. Files that cannot carry a stamp are released on a link that expires after a minute.
Who we share with
Our hosting, database and email providers, each acting on our instructions and within the UK or the European Economic Area. Verification providers, where you ask us to run a check. Stripe, where you pay for something. We do not sell personal data and we do not share it for advertising.
How long we keep it
Listing and deal records are kept while the account is open and for six years afterwards, which is the ordinary limitation period for a contractual claim. Unconfirmed alert signups are deleted after 30 days. Form submissions are kept for two years unless you ask for them sooner, or until the conversation they started has plainly finished.
Your rights, and how to use them
You can download everything we hold about you, as a file, from your account: no request and no waiting. That includes any form you filled in before you had an account, matched to the address you signed in with. If you filled in a form and never made an account, there is nothing to sign in to, so email us and we will send or delete it. You can also close your account from there, which removes your sign-in, your contact details, your alerts, any form you submitted, and your check results. Signed confidentiality agreements, offers, messages and document-access records are kept and unlinked from you, because they are evidence the other party is entitled to rely on and UK GDPR permits keeping records needed to establish or defend a legal claim. Your account page shows exactly what would be removed and what would be kept before you confirm anything.
Correction, objection and complaints
Email hello@attainer.co.uk to have anything corrected, or to object to how we use your data, and we will respond within one month. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk.