This is our privacy policy and any relevant details, contact points, etc.
Last updated: 23rd September 2026.
1. Introduction
1.1 This policy explains how we collect, use, share and protect personal data when you visit this website, submit an enquiry, book a meeting, or contact us by email or telephone.
1.2 It also explains the cookies this website uses and how you can control them.
1.3 We are committed to handling personal data lawfully, transparently and securely, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
1.4 This policy applies to ellistonveda.com and to enquiries made through it. It does not apply to third-party websites we link to, which operate their own policies.
2. Who we are and how to contact us
2.1 Elliston Veda Ltd is a company registered in England and Wales. We acquire established UK businesses from owners planning retirement, succession or a step back.
2.2 Elliston Veda Ltd is the data controller for the personal data described in this policy. This means we determine why and how your personal data is processed.
2.3 Our details are Elliston Veda Ltd, and is registered in England and Wales (Company no. #########). Registered office address is 10C New Street, West Midlands, B70 7PN, UK. If you wish to get in touch, please contact us via email at office@ellistonveda.com, or call us on 0121 630 1330.
2.4 Our ICO number is ########.
2.5 We have not appointed a Data Protection Officer, and are not required to do so. Data protection matters are handled directly by the company at the contact details above.
3. Personal data we collect
3.1 We collect the following categories of personal data.
| Category | Data | Source |
|---|---|---|
| Enquiry data | Name, email address, telephone number, and the content of your message | Provided by you via our website contact form |
| Booking data | Name, email address, meeting time, and any information you provide when booking | Provided by you to Cal.com, our booking provider, and passed to us |
| Correspondence data | The content of emails, letters and telephone calls between us, and the contact details used | Provided by you |
| Business information | Information about your company that you choose to share, which may identify you as its owner or officer | Provided by you |
| Technical data | IP address, browser type and version, and access times, recorded in standard server logs | Collected automatically by our hosting provider |
| Consent data | Your cookie preferences | Collected automatically when you make a choice |
3.2 We do not purchase personal data, and we do not obtain it from data brokers or list vendors.
3.3 You do not need to provide any personal data to browse this website. You provide personal data only if you choose to contact us, and we use those details to provide a response.
4. Special category data
4.1 Our contact form includes a free-text field. We do not ask for, and do not require, any special category data as defined in Article 9 UK GDPR, such as information about health, disability, racial or ethnic origin, religious belief, or sexual orientation.
4.2 We recognise that people considering the sale of a business sometimes explain personal circumstances, including matters of health or family, in the course of doing so.
4.3 Please do not include such information in your initial enquiry. If you do, we will hold it in confidence, restrict it to what is necessary to respond to you, and delete it as soon as it is no longer needed.
5. Why we use your personal data, and our lawful bases
5.1 We process personal data for the purposes set out below. Under UK GDPR we must have a lawful basis for each purpose.
| Purpose | Personal data used | Lawful basis |
|---|---|---|
| Responding to your enquiry and corresponding with you about it | Enquiry, correspondence and business information | Legitimate interests – Article 6(1)(f). Our interest is in responding to a business enquiry you initiated |
| Arranging and holding meetings | Booking and correspondence data | Legitimate interests – Article 6(1)(f). Our interest is in arranging a meeting you requested |
| Progressing a potential transaction, including instructing our professional advisers | Enquiry, correspondence and business information | Legitimate interests – Article 6(1)(f). Our interest is in evaluating and negotiating an acquisition, with your knowledge |
| Keeping records of transactions for tax, accounting and legal purposes | Correspondence and transaction records | Legal obligation – Article 6(1)(c) |
| Maintaining the security and availability of this website | Technical data | Legitimate interests – Article 6(1)(f). Our interest is in operating a secure website |
| Recording your cookie preferences | Consent data | Legal obligation – Article 6(1)(c), PECR |
| Setting non-essential cookies | Consent data | Consent – Article 6(1)(a) |
5.2 Our legitimate interests assessment. Where we rely on legitimate interests, we have considered whether our interests are overridden by your interests, rights and freedoms. We have concluded they are not, because: the processing is limited to what you have asked us to do; it is what you would reasonably expect when submitting a business enquiry; we do not use your data for any unrelated purpose; and you may object at any time under clause 10.
5.3 We do not send marketing communications of any kind. We operate no mailing list, we do not add enquirers to one, and we do not use your data for advertising or promotional purposes.
5.4 We do not carry out profiling or automated decision-making that produces legal or similarly significant effects concerning you.
6. How we collect your personal data
6.1 Directly from you, when you complete our contact form, book a meeting, send us an email, or telephone us.
6.2 Automatically, through standard server logs and, where you consent, through cookies. See clause 11.
7. Who we share your personal data with
7.1 We do not sell personal data. We do not share it for advertising purposes. We do not pass enquiries to brokers, intermediaries or other buyers.
7.2 We share personal data only with the following categories of recipient.
| Recipient | Role | What they receive | Why |
|---|---|---|---|
| Website host | Processor | Data stored on the website, including enquiry submissions | Hosting and technical operation |
| SMTP | Processor | Enquiry emails in transit | Email delivery |
| Cal.com, Inc. | Independent controller | Booking details you provide to it directly | Operation of our booking calendar. Governed by Cal.com’s own privacy policy: https://cal.com/privacy |
| Our professional advisers – solicitors, accountants and finance brokers | Controllers or processors, as applicable | Only what is necessary, and only where a transaction progresses | Professional advice on a potential transaction |
| Regulators, law enforcement and courts | Controllers | Only what we are legally required to disclose | Compliance with legal obligations |
7.3 Where a recipient acts as our processor, we have a written contract in place requiring it to process personal data only on our instructions and to apply appropriate security measures.
7.4 Use of artificial intelligence tools. We use AI-assisted tools in the administration of this website. Access is restricted to what is necessary, enquiry content is not used to train third-party models, and no automated decision-making is carried out in relation to you.
8. International transfers
8.1 Cal.com, Inc. is established in the United States. If you use our booking calendar, the personal data you provide to it is processed outside the United Kingdom.
8.2 That transfer is made subject to appropriate safeguards under Article 46 UK GDPR, as set out in Cal.com’s data processing terms. You may request further information using the contact details in clause 2.
8.3 If you would prefer that your data is not transferred outside the UK, do not use the booking calendar. Contact us by email or telephone instead. It makes no difference to how we respond to you.
8.4 Where any other recipient processes personal data outside the UK, we ensure an appropriate safeguard under Chapter V UK GDPR is in place.
9. How long we keep your personal data
9.1 We keep personal data only for as long as necessary for the purposes set out in clause 5.
| Record | Retention period | Reason |
|---|---|---|
| Enquiry that does not lead to further contact | 12 months from receipt | To recognise and respond to any follow-up |
| Enquiry or correspondence relating to an ongoing discussion | Duration of the discussion, plus 12 months | To conduct the discussion and handle any queries arising |
| Records relating to a completed transaction | 6 years from completion | Statutory and professional record-keeping requirements |
| Booking records held by us | 12 months from the meeting | Record of contact |
| Server logs | As set by our hosting provider, typically short | Security and technical operation |
| Cookie preference | 180 days | To avoid asking you again on each visit |
9.2 At the end of the applicable period, personal data is securely deleted.
9.3 You may ask us to delete your data earlier under clause 10. We will do so unless we are required to retain it.
10. Your rights
10.1 Under UK data protection law you have the following rights.
| Right | What it means |
|---|---|
| Access | To be told whether we hold personal data about you and to receive a copy |
| Rectification | To have inaccurate personal data corrected and incomplete data completed |
| Erasure | To have your personal data deleted, where there is no overriding reason to keep it |
| Restriction | To limit how we use your personal data in certain circumstances |
| Portability | To receive certain personal data in a structured, commonly used, machine-readable format |
| Object | To object to processing based on legitimate interests, including all processing described in clause 5 on that basis |
| Withdraw consent | To withdraw consent at any time, where consent is our lawful basis. This applies to cookies. Withdrawal does not affect processing carried out before withdrawal |
| Complain | To lodge a complaint with the Information Commissioner’s Office. See clause 13 |
10.2 How to exercise your rights. Contact us using the details in clause 2. There is no charge.
10.3 We will respond within one month of receiving your request. If a request is complex, we may extend this by up to two further months and will tell you if we do.
10.4 We may ask you to verify your identity before acting on a request.
11. Security
11.1 We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure.
11.2 These include encryption of data in transit (HTTPS), access controls on the website and its administration, and restricting access to enquiry data to those who need it.
11.3 We keep enquiries confidential as a matter of course. Discretion is fundamental to how we work.
11.4 We have procedures to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to do so.
12. Complaints
12.1 If you are concerned about how we have handled your personal data, please contact us first using the details in clause 2. We will investigate and respond.
12.2 You also have the right to complain to the UK’s supervisory authority at any time.
| Information Commissioner’s Office | |
| Address | Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
| Telephone | 0303 123 1113 |
| Website | https://ico.org.uk/make-a-complaint/ |
13.3 Contacting us first does not affect your right to complain to the ICO.
13. Children
13.1 This website and our services are directed at business owners. We do not knowingly collect personal data relating to anyone under the age of 18.
14. Third-party websites
14.1 This website contains links to third-party websites. We are not responsible for their content or their privacy practices. We encourage you to read the privacy policy of any website you visit.
15. Changes to this policy
15.1 We review this policy regularly, and update it whenever our processing changes.
15.2 The date at the top of this policy shows when it was last updated.
15.3 Where a change is significant and we hold your contact details, we will notify you directly.
This is a full list of our cookies as we test them, if we add more, they will be shown here.
Get in touch
Want to meet on video or in person? We are based in the West Midlands, and you can book a meeting here.
Elliston Veda
© 2026 Elliston Veda. All rights reserved.