Privacy notice
Last updated 10 August 2026
This notice explains what Chivvy Ltd does with personal data in connection with the Acquisition Engine website and platform. Chivvy Ltd is the data controller, registered in England and Wales under company number 17040454.
Who this covers
There are two different groups, and they are treated differently.
People who use the platform
Staff of our clients, and our own staff, who sign in to Acquisition Engine. We hold your name, work email address, job title, the client you belong to, and a record of what you did in the system — deals you changed, documents you opened, messages you sent. We hold this to run the service and to keep an audit trail, which is a legitimate interest of ours and of our clients.
People at firms that may be acquired
Acquisition Engine builds and scores lists of accountancy, audit and tax practices. Where those firms are companies or limited liability partnerships, most of what we hold is company information rather than personal data. Some of it is personal: the names and ages of directors and members as published by Companies House, publicly listed work contact details, and a business email address published on the firm's own website.
We rely on legitimate interests to identify and approach firms that may want to sell. We think that is a fair use because the data is business contact information, published by the firm or by a statutory register, and used to make a business proposition to that firm. You can object at any time and we will stop.
Where the data comes from
- Companies House, including filed accounts and officer records.
- The Register of Statutory Auditors, published by the recognised supervisory bodies.
- The firm's own website, where we confirm the site belongs to that firm before we record anything from it.
- Information our clients give us about firms they already know.
- Replies you send us.
We do not buy contact lists and we do not generate email addresses by guessing a pattern.
Marketing approaches
Approaches about selling a practice are sent to businesses. We check the Privacy and Electronic Communications Regulations position before sending, and we hold back approaches to sole traders and partnerships, who are treated as individual subscribers. Every message tells you who it is from and how to stop. Ask us to stop and the firm is suppressed across every mandate we run, not just the one that wrote to you.
Who we share it with
| Who | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | EEA |
| Netlify | Website and application hosting | EEA / UK edge |
| Brevo | Sending and tracking outreach email | EU |
| Anthropic | Drafting outreach letters | US, under standard contractual clauses |
| Mailbox connection, where a client links one | EEA / US, under standard contractual clauses |
We also share deal information with the client whose mandate the deal belongs to. We do not sell personal data.
How long we keep it
- Platform user accounts: while the account is active, then two years.
- Deal records, including documents and correspondence: seven years from completion or from the deal being closed, which reflects the record-keeping expected of a corporate transaction.
- Firms we researched but never approached: reviewed annually and removed when the mandate they were scored against ends.
- Suppression records: kept indefinitely, because that is the only way to honour a request to stop.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we are using it, or ask us to restrict it. Where we rely on legitimate interests you have an absolute right to object to direct marketing and we will stop immediately.
Email privacy@acquisitionengine.uk. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk.
Changes
If this notice changes materially we will change the date at the top and, for platform users, tell you in the application.