Last updated October 2026
Privacy policy
Who we are
Acquilerate LTD is the controller of the personal data described in this notice. We are registered in Cyprus with the Department of Registrar of Companies and Intellectual Property under number HE 489688. Our registered office is at Stadiou 15, Oikos, 2867 Nicosia, Cyprus.
You can contact us about privacy at contact@acquilerate.com.
This notice covers acquilerate.com: our deal-sourcing and research pages, quote requests, meeting bookings, email you send us and sign-in to our client portal. The Acquilerate Marketplace has its own notice.
What we collect and why
- Visiting our website
- Our host, Vercel, receives your IP address and browser details when you load a page, to deliver the site and protect it against abuse (our legitimate interest in running a secure website, Article 6(1)(f)).
- Quote requests
- Your name, work email, organisation, the kind of buyer you are, the support you need, what you want to acquire and the countries involved, plus anything optional you add (target size, timing, further detail, phone number, how you found us). We also record which page you came from and any campaign tags in the link. We use this to reply, scope the search and prepare a proposal: as steps you ask us to take before a contract where you would contract with us yourself (GDPR Article 6(1)(b)), and otherwise for our legitimate interest in answering the organisation you represent (Article 6(1)(f)). To prevent abuse we limit how many requests can be sent; for this we keep a one-way, salted hash of your IP address, never the address itself (our legitimate interest, Article 6(1)(f)).
- Meeting bookings
- Meetings are booked through Google Calendar appointment scheduling and held on Google Meet. Google receives the name, email address and any answers you give in the booking form, and the booking appears in our calendar. We use it to hold the meeting you asked for (Article 6(1)(b), or our legitimate interest in meeting the organisation you represent, Article 6(1)(f)).
- Email you send us
- We keep correspondence so we can reply and follow up (our legitimate interest in running our business, Article 6(1)(f)). We use AI services from Google and Anthropic to help sort incoming email and draft replies. A member of our team reviews and sends every reply; nothing is sent automatically.
- Client portal sign-in
- Existing clients sign in through Clerk, which processes your name, email address and sign-in data so that you can access your portal. This performs our agreement with your organisation: Article 6(1)(b) where you are party to it yourself, otherwise our legitimate interest in providing the service your organisation contracted (Article 6(1)(f)).
- Website analytics
- On our deal-sourcing and research pages we use Vercel Web Analytics to count page views and clicks on booking buttons. It does not use cookies. Visits are counted through a hash of the incoming request that is discarded after 24 hours, and we only see aggregated figures: pages viewed, referring sites, approximate location, device type, browser and operating system. We use this to understand which pages help visitors (our legitimate interest, Article 6(1)(f)).
What you have to give us
You don't have to give us any personal data. To answer a quote request we need the fields the form marks as required; without them we can't process it. Everything marked optional is up to you.
Automated decisions
We don't make decisions about you based solely on automated processing, including profiling.
Who processes data for us
We use these providers to run the services above. They process personal data on our behalf and under our instructions. We do not sell personal data.
- Vercel
- website hosting and web analytics
- Supabase
- database for quote requests, client portal data and email records
- Clerk
- client portal sign-in
- email, calendar, appointment booking, Google Meet, and AI assistance with email (Gemini)
- Anthropic
- AI assistance with sorting and drafting replies to email
- Resend
- delivery of internal alerts to our team when a quote request arrives
Transfers outside the EEA
Our database (Supabase) is hosted in Ireland. Some of our providers process personal data outside the European Economic Area, mainly in the United States. Each of these transfers is covered by a safeguard recognised by the GDPR, listed below. You can ask us for a copy at contact@acquilerate.com.
- Google and Clerk
- the EU-US Data Privacy Framework, under which both are certified, with the European Commission's Standard Contractual Clauses as a fallback
- Vercel, Supabase, Anthropic and Resend
- the European Commission's Standard Contractual Clauses
How long we keep data
We keep personal data only for as long as we need it, using the periods below, and then delete it. If you ask us to delete your data sooner, we will, unless we must keep it to meet a legal obligation or to establish or defend legal claims.
- Quote requests, meeting bookings and email, unless you are a client
- 3 years from our last contact with you.
- Clients
- For the engagement and 6 years after the end of the year in which it ends. This covers the period in which contract claims can be brought and the time Cyprus law requires us to keep accounting records such as contracts and invoices. Client portal sign-in accounts are closed when the engagement ends.
Your rights
You can ask us for access to your personal data, and to correct, delete or restrict it, or to receive it in a portable format. To make a request, email contact@acquilerate.com. We reply within one month.
Your right to object: where we rely on our legitimate interests, you can object at any time. We will then stop, unless we have compelling legitimate grounds that override your interests or need the data for legal claims.
You can also complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the data protection authority where you live or work.
Changes to this notice
We will update this page when our practices change. The date at the top shows the latest version.