Privacy policy

This Privacy Policy explains how NA LEGAL CONSULTING LIMITED, trading as Nimius Advisory (“Nimius Advisory”, “we”, “us” or “our”), collects, uses, stores and shares personal information when you use the nimiusadvisory.com website, its forms and related online services that link to this Privacy Policy (together, the “Services”).

NA LEGAL CONSULTING LIMITED

• Company number: 16093708
• Registered office: 61 Rodney Street, Liverpool, England, L1 9ER
• Privacy contact: info@nimiusadvisory.com

For the processing described in this Privacy Policy, NA LEGAL CONSULTING LIMITED is generally the controller of your personal information.

The Services allow you to:

• browse listings of licensed companies, ready-made companies, banks and other businesses offered for sale;
• submit enquiries about buying a company or about our services;
• offer a company for sale;
• ask us to search for a suitable acquisition opportunity;
• request a consultation;
• apply for a vacancy; and
• communicate with us.

The website is principally an information and enquiry platform. It does not itself execute acquisitions, transfer ownership of businesses, process payments between buyers and sellers, or provide regulated financial or investment services.

Where an enquiry develops into a transaction, consultancy engagement, regulatory project, due diligence exercise or other professional service, those activities may be undertaken outside the website under separate agreements and may involve additional processing of personal information.

This Privacy Policy should be read together with any additional privacy information or notices that we provide to you in connection with a particular service.

The personal information we collect depends on how you interact with the Services and which forms you use.

Information you provide to us

Identity and contact information

• name;
• email address;
• telephone number;
• Telegram username or other messenger details;
• country;
• position or job title;
• company or organisation;
• preferred contact method and time; and
• other business contact details.

Enquiry information

This may include:

• listings in which you express an interest, with their reference numbers;
• the type of company or licence you ask about;
• enquiries regarding the purchase or sale of companies;
• custom search requests;
• information about a company you wish to sell, such as its jurisdiction, licences, status, activities, key assets, expected price and timeline;
• consultation requests, such as a desired company name, business activity and preferred language;
• messages sent through our forms; and
• other information you provide when communicating with us.

Business and professional information

Depending on the nature of an enquiry, this may include information relating to:

• companies;
• licences or regulatory permissions;
• directors and officers;
• shareholders and beneficial owners;
• business activities;
• professional experience;
• corporate ownership;
• counterparties;
• advisers; and
• proposed acquisitions or disposals.

Job applications

The vacancy you apply for, your contact details and your message.

Our forms do not accept file uploads. You should provide only information that is reasonably necessary for the relevant purpose.

Information about other people

Information submitted in connection with a company or transaction may relate to another individual, for example:

• a director;
• shareholder;
• beneficial owner;
• company representative;
• employee;
• adviser;
• buyer;
• seller; or
• other transaction participant.

If you provide personal information relating to another person, you should ensure that you are entitled to provide it and, where required, that the person has been appropriately informed.

We may also receive information about individuals from our clients, corporate representatives, professional advisers, counterparties or public sources.

Special category and criminal offence information

The Services are not designed to require users routinely to provide special category personal information, such as information concerning health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, biometric identification, sexual orientation or sex life.

The Services are also not intended routinely to collect criminal offence information.

However, information voluntarily submitted in connection with a company, individual, regulatory matter or due diligence enquiry may exceptionally contain this type of information.

Please do not submit special category or criminal offence information unless:

1. it is genuinely relevant to the purpose for which the information is being provided;
2. you are entitled to provide it; and
3. its disclosure is lawful.

Where we receive such information, we will process it only where we have a lawful basis and any additional condition required by applicable data protection law. Information that is unnecessary for our purposes may be deleted or redacted.

Information collected automatically

When you visit the website or send a form, we and our hosting provider automatically collect certain technical and usage information, including:

• Internet Protocol (IP) address;
• browser type and version;
• device type and operating system;
• approximate location inferred from IP address;
• language and regional settings;
• date and time of access;
• pages visited, including the page from which you send a form;
• error reports; and
• security and access logs.

We do not collect your precise location.

Information obtained from other sources

We may obtain personal information from:

• our clients;
• companies or their representatives;
• prospective buyers or sellers;
• professional advisers;
• service providers;
• public company registers;
• regulatory registers;
• company websites;
• professional profiles;
• other publicly available business sources; and
• other sources where obtaining and using the information is lawful and relevant to the Services.

We use personal information only where we have a lawful reason to do so.

Our principal processing activities are set out below.

When you send a form on our website, our server checks it and forwards it as a message to a Telegram chat used by our team, through the Telegram Bot API. The website does not store form submissions in a database.

Each message contains:

• every field you filled in on the form (long messages are shortened to fit Telegram's message size limit);
• which form you used;
• the address (URL) and language of the page you sent it from;
• the listing reference and link, or the licence you selected, if you opened the form from a listing or licence page; and
• the date and time of sending (UTC).

To limit repeated submissions, our server keeps a one-way hash of your IP address (never the address itself) for 10 minutes. Submissions rejected by our anti-spam checks are not forwarded.

Telegram stores the messages on its servers and processes them under its own terms and privacy policy.

We may share personal information where reasonably necessary for the purposes described in this Privacy Policy.

Technology and service providers

We use third-party providers to operate and support the Services.

These may include providers of:

• website hosting and content delivery;
• cybersecurity and spam protection;
• messaging and email;
• customer support;
• data backup; and
• technical development or maintenance.

Providers currently relevant to the Services include:

• our hosting provider, whose server runs the website and processes the technical information of each visit; and
• Telegram, which delivers form submissions to our team.

Some providers act as processors on our instructions, while others may process particular information as independent controllers under their own legal obligations and privacy terms.

Where a third party processes personal information for us as a processor, we require appropriate contractual protections and expect the provider to protect personal information to standards consistent with applicable data protection law and this Privacy Policy.

Buyers, sellers and other transaction participants

Where necessary to progress an enquiry about a company for sale, we may share relevant information with:

• listing owners;
• prospective sellers;
• prospective buyers;
• company representatives; or
• other persons directly involved in the relevant enquiry.

We aim to disclose only the information reasonably necessary at the relevant stage.

More extensive disclosure of confidential, due diligence or transaction information may be subject to separate confidentiality arrangements or transaction processes.

Professional advisers and service providers

We may disclose information to our:

• lawyers;
• accountants;
• auditors;
• consultants;
• insurers;
• corporate service providers;
• compliance advisers; and
• other professional advisers

where reasonably necessary.

Regulators and public authorities

We may disclose information where required or permitted by law to:

• courts;
• regulators;
• supervisory authorities;
• law-enforcement agencies;
• tax authorities;
• governmental bodies; or
• other competent authorities.

Corporate transactions

Personal information may be disclosed as part of negotiations or due diligence relating to:

• a merger;
• investment;
• financing;
• acquisition;
• restructuring;
• transfer of assets; or
• sale of all or part of our business.

Appropriate confidentiality and data protection arrangements will be used where necessary.

We work with clients in many countries and use technology and service providers, such as our hosting provider and Telegram, that may process personal information in different countries.

As a result, personal information may be transferred to or accessed from countries outside the United Kingdom or the country in which you are located.

Where UK-protected personal information is transferred outside the United Kingdom and applicable law requires a transfer mechanism, we will use an appropriate mechanism. Depending on the circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK International Data Transfer Addendum to approved European Commission Standard Contractual Clauses; or
• another lawful transfer mechanism.

Where required, we will also undertake the applicable assessment of the protection afforded to the information in the destination country.

For personal information protected by the EU GDPR, we may rely on:

• European Commission adequacy decisions;
• Standard Contractual Clauses; or
• another permitted transfer mechanism.

You may contact us if you require further information about safeguards used for a particular international transfer.

Our cookie notice explains which cookies and similar technologies the website uses, why, and the choices you have.

We may send you communications concerning:

• your enquiry or engagement;
• consultations;
• security;
• changes to the Services; or
• other administrative matters.

These are service communications and may be necessary for us to provide the Services.

Separately, where permitted by law, we may send marketing communications concerning Nimius Advisory services, relevant listings or similar business information.

Where consent is required, we will send such marketing only after obtaining the required consent.

You can opt out of marketing at any time by:

• using an unsubscribe facility contained in a marketing communication; or
• contacting us at info@nimiusadvisory.com.

Opting out of marketing does not prevent us from sending necessary security, transaction-related or administrative communications.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, regulatory, security, accounting and dispute-resolution requirements.

Our normal retention approach is:

You may ask us to delete your personal information at any time by contacting info@nimiusadvisory.com.

When you ask, we will delete or anonymise your personal information unless we have a lawful reason to retain particular information.

For example, we may retain limited records where necessary for:

• compliance with law;
• regulatory obligations;
• fraud or misuse prevention;
• security;
• completed transactions or professional engagements;
• accounting requirements;
• complaints;
• disputes; or
• establishing, exercising or defending legal rights.

Information retained for such purposes will not continue to be used for other purposes, such as marketing.

Where personal information has been provided to processors acting on our behalf, we will take reasonable steps to ensure that applicable deletion requirements are also implemented by those processors.

Information stored in backups may remain until it is removed through the normal backup rotation process.

We use technical and organisational measures designed to protect personal information against:

• unauthorised access;
• loss;
• alteration;
• disclosure;
• destruction; or
• misuse.

Depending on the information, systems and risks involved, these measures may include:

• encryption in transit;
• encryption at rest where supported and appropriate;
• authentication controls;
• access restrictions based on business need;
• restricted administrative permissions;
• security logging and monitoring;
• secure backup arrangements;
• system and website maintenance;
• security incident procedures;
• vendor due diligence and contractual controls; and
• measures intended to preserve the confidentiality, integrity and availability of systems and information.

No internet transmission, website or information-storage system can be guaranteed to be completely secure.

If you believe that your personal information has been compromised, please contact us promptly.

The Services are intended exclusively for persons aged 18 or over.

We do not knowingly collect personal information directly from children.

If we become aware that a person under 18 has provided personal information through the Services, we will take reasonable steps to delete the information unless retention is required by law.

If you believe that a person under 18 has provided personal information to us, please contact info@nimiusadvisory.com.

Depending on applicable law and the circumstances of the processing, you may have the right to:

• obtain confirmation that we process your personal information;
• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion of personal information;
• request restriction of processing;
• receive certain personal information in a portable format;
• object to particular processing;
• withdraw consent where processing is based on consent; and
• raise a complaint about our processing.

These rights are not absolute. Applicable law may allow or require us to refuse or limit a request in particular circumstances.

We may take reasonable steps to verify your identity before acting on a request.

Right to object

Where we process your personal information on the basis of legitimate interests, you may have the right to object to that processing on grounds relating to your particular situation.

You have the right to object at any time to the use of your personal information for direct marketing.

Withdrawal of consent

Where processing is based on consent, you can withdraw that consent at any time.

Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

Exercising your rights

You may exercise your rights by contacting us at info@nimiusadvisory.com.

We will respond in accordance with the time limits and requirements imposed by applicable data protection law.

If you have concerns about how we use your personal information, we encourage you to contact us first so that we can investigate the matter.

Data protection complaints can be submitted to info@nimiusadvisory.com or by post to NA LEGAL CONSULTING LIMITED, 61 Rodney Street, Liverpool, England, L1 9ER.

We will:

• provide a reasonable means of making a data protection complaint;
• acknowledge receipt of a complaint within 30 days as required by applicable UK law;
• investigate the complaint appropriately and without undue delay;
• keep appropriate records; and
• inform you of the outcome.

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO), the United Kingdom’s data protection supervisory authority.

If you are located outside the United Kingdom and another data protection authority has jurisdiction over the processing, you may also have the right to lodge a complaint with that authority.

The Services are available to users in jurisdictions outside the United Kingdom.

Depending on:

• where you live;
• where we offer the Services; and
• which privacy laws apply to the relevant processing,

you may have additional rights concerning your personal information.

Where applicable legislation provides rights beyond those described in this Privacy Policy, we will comply with those requirements to the extent they apply to our processing.

Nothing in this Privacy Policy is intended to limit rights that cannot lawfully be limited.

Where legally required due to the scale or nature of our activities in another jurisdiction, we may publish a jurisdiction-specific supplement or additional privacy notice.

The Services contain links to third-party websites, such as event organisers' websites on our events pages, and rely on third-party services such as Telegram.

This Privacy Policy governs processing carried out by us. It does not govern processing independently carried out by third parties under their own privacy policies.

We encourage you to review the privacy information provided by relevant third parties.

We may update this Privacy Policy from time to time, including where:

• the Services change;
• our technology providers change;
• our data practices change; or
• legal or regulatory requirements change.

The date at the beginning of this Privacy Policy indicates when it was last updated.

Where a change materially affects how we use personal information, we may provide additional notice on the website, by email or through another appropriate communication where required.

We will not use personal information for a materially incompatible new purpose without taking the steps required by applicable law.

Questions concerning this Privacy Policy, our processing of personal information, data protection rights or data protection complaints can be sent to:

NA LEGAL CONSULTING LIMITED

• Company number: 16093708
• Registered office: 61 Rodney Street, Liverpool, England, L1 9ER
• Privacy contact: info@nimiusadvisory.com