Privacy Policy

Data Controller

1.1 Who is responsible for your data

The data controller responsible for processing your personal data is:

1.2 Privacy Contact (not a DPO)

ExValu does not meet the threshold for mandatory appointment of a Data Protection Officer under BDSG §38, which requires 20 or more employees regularly involved in automated data processing. As a sole proprietorship, ExValu is below that threshold. All data protection enquiries should be directed to the Privacy Contact at [email protected] with the subject line "Privacy - [Your Name]".

1.3 What we do

ExValu helps SME founders and owners prepare their businesses for exit by building operational independence, improving EBITDA quality, and creating documented, transferable systems. Services include the Exit Readiness Program, Exit Readiness Certificate, Company Brain knowledge systems, AI Voice Receptionist (Ava), email automation infrastructure, and advisory diagnostics. This work involves handling business and personal information in order to deliver results.

1.4 Scope

GDPR applies to all personal data we process regardless of where our clients are located. Clients outside the EU/EEA also benefit from GDPR-equivalent protections as our baseline standard.

Personal Data We Collect

2.1 Data you provide directly

When booking a call or completing a diagnostic form

• First and last name
• Email address and phone number
• Company name and website URL
• Role in the company (founder, owner, director, etc.)
• Annual revenue range and EBITDA estimate
• Exit planning timeline
• Decision-making authority

When engaging our services

• Business process documentation and internal workflows shared with us
• Team member contact details where relevant to project delivery
• Billing and invoicing details (processed by payment providers - not stored by ExValu)
• Goals, challenges, and strategic information discussed during the engagement

When contacting us

• Email correspondence
• Call recordings (only with your prior explicit consent - see Section 3.1)
• Support messages and feedback

2.2 Data we collect automatically

When you visit the ExValu website, we may collect the following data - subject to your cookie consent choices:

• IP address (processed within Google Analytics in aggregated form only; see Section 9.2)
• Browser type, device type, and operating system
• Pages visited, time on site, and referral source
• Geographic location at country/city level only

2.3 Business research from public and licensed sources

To prepare effectively for discovery calls and diagnostic sessions, and to identify SME owners who may benefit from ExValu's services, we research business and firmographic information from:

• Your company website and published content
• Public company registrations (Handelsregister, Companies House UK, and equivalent registries)
• LinkedIn company page (public information only)
• Public press releases, news mentions, and industry reports
• Industry benchmarks and publicly available financial filings
• Licensed business-intelligence platforms (Apollo.io, Clay) - used in firmographic-only mode, restricted to company-level data (company name, website, revenue band, industry, headcount). Personal data enrichment (named individuals' contact details) is not activated pending completion of our Transfer Impact Assessments and final sign-off from our external data protection counsel.

We do not access private social media profiles, purchase third-party consumer data, scrape private databases, or monitor your employees or customers.

2.4 Data we do not collect

• Special category data (health, ethnicity, religion, political opinions) - we have no legitimate purpose for this
• Data from individuals under 18 - our services are for business owners only
• Automated credit or financial scoring data

How and Why We Process Your Data

3.1 Lawful basis by processing activity

We process personal data only where we have a valid lawful basis under GDPR Article 6. The following table sets out each processing activity, its purpose, and the legal basis we rely on:

3.2 Legitimate interest balancing

Where we rely on legitimate interest (Art. 6(1)(f)), we conduct a Legitimate Interest Assessment (LIA) documenting the balancing test between our interests and the rights and freedoms of data subjects. Specifically: pre-call research is limited to publicly available and firmographic information and is directly relevant to providing you with a useful, personalised service; CRM management enables us to follow up appropriately without pestering you; security processing protects both parties. You have the right to object to legitimate interest processing at any time - see Section 8. A copy of the applicable LIA can be requested at [email protected].

3.3 Call recording consent

Where knowledge capture sessions or consultation calls are recorded, we obtain explicit, documented consent from all participants before the recording begins. Participants are informed verbally and in writing that the session is being recorded, the purpose of the recording, how long it will be retained, and the right to withdraw consent at any time. Recordings generated during client engagements are the property of the Client and are deleted from ExValu systems at engagement close or on request.

3.4 Marketing communications

If you opt in, we may send 1-2 emails per month covering exit readiness insights, AI automation case studies, industry benchmarks, and service announcements. We never send daily emails, share your address with advertisers, or send unsolicited SMS. You can unsubscribe at any time via the link in any email, by replying STOP to any SMS, or by emailing [email protected].

Who We Share Your Data With

We do not sell, rent, or trade personal data. We share data only with the trusted sub-processors listed below who help us operate our business. All sub-processors have signed Data Processing Agreements (DPAs) and are required to comply with GDPR and equivalent laws. For payment processing, the listed providers act as independent controllers for payment-related personal data under their own privacy policies.

4.1 Legal disclosures

We may disclose personal data where required by law, including in response to court orders, regulatory investigations, or lawful law enforcement requests. We review all such requests for legal validity, provide only the minimum data required, and notify you where legally permitted to do so.

4.2 Business transfers

In the event of a merger, acquisition, or sale of ExValu's business or assets, personal data may be transferred to the new owner as part of that transaction. You will be notified at least 30 days before any such transfer. The new owner will be required to honour this Privacy Policy. You may request deletion of your data before any transfer takes effect.

International Data Transfers

Some of our sub-processors are based outside the EU/EEA (primarily the USA). We ensure your data is protected through the following mechanisms:

• Adequacy decisions: For the United Kingdom and other countries covered by European Commission adequacy decisions, transfers proceed on the basis of that adequacy finding.
• EU-US Data Privacy Framework (DPF): Where sub-processors have certified under the DPF, this provides an adequacy basis for US transfers. We re-verify DPF status quarterly at dataprivacyframework.gov.
• Standard Contractual Clauses (SCCs): Approved by the European Commission (Decision 2021/914). Legally binding agreements requiring equivalent data protection standards for all transfers to sub-processors in non-adequate countries.
• Transfer Impact Assessments (TIAs): For each US sub-processor, we conduct a Transfer Impact Assessment consistent with EDPB Recommendations 01/2020, evaluating the law and practice of the destination country and the supplementary measures in place. Copies are available on reasoned request.
• EU data centre preference: Where our sub-processors offer EU data centre options (Google Workspace, GoHighLevel, Notion), we use them to minimise cross-border transfers.

How Long We Keep Your Data

"Last interaction" means: last email reply from you; last website visit (if tracked with consent); last scheduled call date; or last support activity - whichever is most recent.

Data Security

7.1 Technical measures

• SSL/TLS encryption for all data in transit between your browser and our systems
• AES-256 encryption for stored data at rest
• Role-based access controls and principle of least privilege for all team access
• Two-factor authentication (2FA) required for all accounts with access to personal data
• Encrypted backups stored in separate geographic locations
• Device-level encryption on all workstations and storage media
• On-device voice dictation (Weesper Neon Flow) for sensitive client data; cloud-based voice tools only for non-sensitive content
• Regular vulnerability assessments and security reviews

7.2 Organisational measures

• Annual data protection awareness training
• Confidentiality agreements for all personnel with data access
• Data minimisation - we collect only what is necessary for defined purposes
• Documented incident response procedures meeting GDPR Article 33 (72-hour breach notification requirement)
• Regular review and audit of sub-processor compliance, including quarterly re-verification of DPF status

7.3 Data breach response

In the event of a personal data breach, ExValu will: immediately investigate and contain the breach; assess scope and risk to affected individuals; notify the relevant supervisory authority (BayLDA) within 72 hours where required under GDPR Article 33; notify affected individuals without undue delay where the breach is likely to result in high risk under GDPR Article 34; and document the breach in our breach register. We will provide you with details of the nature of the breach, data affected, mitigation steps taken, and our contact information.

Your Rights Under GDPR

Under GDPR Articles 15-22 and applicable national data protection law, you have the following rights. All requests should be sent to [email protected] with the subject line "[Right Name] Request - [Your Name]". We respond within 30 days. There is no charge for reasonable requests.

8.1 How to exercise your rights

Email: [email protected]
Subject: "[Right Name] Request - [Your Name]"
Include: your full name, email address used with ExValu, the specific right you wish to exercise, and any relevant details.

To protect your privacy, we may ask you to verify your identity via email confirmation, last interaction date, or other reasonable means. No fee is charged for reasonable requests. Excessive or clearly unfounded requests may incur a fee under GDPR Article 12(5).

8.2 Automated decision-making and profiling

ExValu does not use fully automated decision-making with legal or similarly significant effects (GDPR Article 22). We use limited lead scoring in our CRM to prioritise follow-up based on company size, exit timeline, decision authority, and engagement level. This scoring does not produce legal effects, does not affect your ability to book a call or access our services, and is reviewed by our team before any action is taken. You may object to this profiling by emailing [email protected].

8.3 Supervisory authorities

Cookies and Tracking Technologies

9.1 Legal framework

Cookie use on this website is governed by TDDDG §25 (Germany's implementation of the EU ePrivacy Directive) and GDPR. Under TDDDG §25, consent is required before setting or reading non-essential cookies. The German Consent Management Ordinance (EinwV, effective April 1, 2025) sets additional requirements for how consent is collected and managed.

9.2 Cookie categories

Essential (always active - no consent required)

• Session management: maintains your session while you browse
• Form functionality: preserves form data during multi-step processes
• Security: prevents CSRF attacks and maintains site integrity

Analytics (consent required - TDDDG §25 + GDPR Art. 6(1)(a))

• Google Analytics (GA4): page views, session duration, bounce rate, referral source
• GA4 does not store full IP addresses; session data is aggregated by Google
• Retention: 14 months
• Only activated after your explicit consent via the cookie banner
• Opt-out: tools.google.com/dlpage/gaoptout

Marketing (consent required)

• Retargeting and campaign tracking (only enabled if you have opted in to marketing)
• Retention: 90 days

9.3 Fonts - why we use Bunny Fonts not Google Fonts

Google Fonts transmit your IP address to Google servers on every page load, creating a data transfer to the USA without consent. The Munich Regional Court ruled in January 2022 that this constitutes a GDPR violation. ExValu uses Bunny Fonts (hosted in the Netherlands by bunny.net) as a privacy-compliant alternative. Bunny Fonts does not log or store IP addresses and processes no personal data. No consent is required for font loading.

9.4 Managing your cookie preferences

You can change your cookie consent choices at any time via our cookie banner (accessible from the footer of every page). You can also manage cookies via your browser settings, though disabling essential cookies may impact site functionality. We honour browser Do Not Track (DNT) signals for analytics cookies.

Full details are in our Cookie Policy at exvalu.com/cookie-policy.

9.5 Children

ExValu's services are directed at business owners and are not intended for individuals under 18. We do not knowingly collect data from minors. If we discover we have inadvertently collected data from a minor, we will delete it immediately and notify any known guardian. Contact [email protected] if you have concerns.

California Privacy Rights (CCPA / CPRA)

ExValu does not specifically target California residents, and our primary operations are in Germany under GDPR. However, if you are a California resident and believe we hold your personal information, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the right to know what personal information we hold, the right to request deletion, and the right to opt out of any "sale" of personal information. ExValu does not sell personal information as defined by CCPA/CPRA. To exercise these rights, email [email protected] with the subject "CCPA Request - [Your Name]". We will respond within 45 days. We will not discriminate against you for exercising your rights.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in applicable law, our services, or data practices. For material changes that affect your rights or how we process your data, we will notify active contacts by email at least 30 days before the change takes effect, and provide the option to withdraw consent if you disagree. Non-material clarifications or formatting changes will be made without direct notification; the "Effective Date" at the top of this page will be updated. We maintain a version history of this policy, available on request.

This Privacy Policy does not constitute a contract. It describes our current data protection practices. Continued use of our website or services after a material change constitutes acknowledgement of the updated policy, but not consent to any new processing that requires separate consent under GDPR.

Datenschutzerklarung - Deutsche Zusammenfassung

Dies ist eine Zusammenfassung der wichtigsten Punkte dieser Datenschutzerklarung auf Deutsch. Die vollstandige englische Version ist die rechtlich massgebliche Fassung. Bei Widerspruchen gilt die englische Version.

Joint Controllership with Clients

For certain processing activities that form part of our Exit Readiness work for business clients, ExValu and the business client jointly determine the purposes and means of processing. In those specific cases, ExValu and the Client are joint controllers within the meaning of GDPR Article 26.

13.1 Where joint controllership applies

Joint controllership applies when ExValu researches, enriches, or documents personal data relating to the Client's key personnel (founder, senior managers, officers named in the engagement) from sources outside the Client's own systems - for example, using public registers, LinkedIn public information, or licensed firmographic platforms. ExValu co-determines the purposes of this research (evaluating owner dependency, identifying succession risk); the Client co-determines the scope and the individuals in scope.

13.2 Essence of the joint-controller arrangement

As required by GDPR Article 26(2), the essence of the arrangement is made available to data subjects here:

• Primary contact point for data subject rights: The business client (the Client) is the primary point of contact for data subjects' rights requests under GDPR Chapter III. ExValu supports the Client in responding.
• Information obligations (Art. 13/14): The Client is responsible for informing its own key personnel that ExValu is processing their data as part of exit readiness preparation. ExValu provides the Client with standard notification text. See Section 15.
• Allocation of security and breach obligations: Each joint controller is responsible for security measures within its own systems. ExValu notifies the Client within 48 hours of any personal data breach affecting jointly processed data.
• Liability: Notwithstanding the internal allocation, data subjects may exercise their GDPR rights against either joint controller.

13.3 Relationship with the Data Processing Agreement

Joint controllership is distinct from the processor relationship governed by ExValu's Data Processing Agreement (DPA). For personal data that the Client provides to ExValu from the Client's own systems (customer records, CRM contacts, employee data originating within the Client), ExValu acts as a processor under Article 28 and the DPA applies. For personal data that ExValu researches externally about the Client's key personnel, the joint controllership framework described here applies. The two structures coexist for the same engagement.

Buyer Data-Room Disclosure (M&A Preparation)

Exit Readiness work includes preparing business clients for disclosure to prospective acquirers (strategic buyers, PE firms, family offices, M&A advisors). As part of this preparation, personal data relating to the Client's business may be disclosed to these third parties. ExValu applies a staged disclosure protocol to keep each stage lawful, necessary, and proportionate.

14.1 Staged disclosure

• Stage 1 - Teaser: Firmographic-only information (industry, revenue band, headcount band, location region, anonymised description). No personal data.
• Stage 2 - Post-NDA shortlist: Role descriptors and structural information about the Client's organisation. No named individuals unless strictly necessary.
• Stage 3 - Post-LOI preferred bidder: Named personal data relating to the Client's key personnel disclosed under NDA, supported by a stage-specific Legitimate Interest Assessment.
• Stage 4 - Closing: Full disclosure as agreed in the transaction documents.

14.2 Lawful basis

Disclosure in Stages 2-4 is conducted on a combined basis of legitimate interest (preparing the Client's business for a viable exit transaction) and contract (performing the services agreed with the Client). The balancing test for legitimate interest is documented in a Legitimate Interest Assessment kept on file and available for inspection.

14.3 Your role if you are the Client's key personnel

If you are a named employee or officer of a business that has engaged ExValu for exit readiness, your employer is responsible for informing you of this processing and its staged disclosure. You have the rights described in Section 8 (access, objection, rectification) and may exercise them against either joint controller (ExValu or the Client).

Notification of Client Personnel (Art. 14 GDPR)

Where ExValu processes personal data about a business client's employees, officers, or other personnel that the Client provides us directly or that we research from external sources, those individuals have the right to be informed of the processing under GDPR Articles 13 and 14.

15.1 Allocation of the notification obligation

Under our Joint Controllership Agreement (Section 13), the Client is responsible for notifying its own personnel of ExValu's involvement in exit readiness work within 30 days of the engagement starting. ExValu provides the Client with standard notification text in German and English as part of onboarding. ExValu does not rely on the Article 14(5)(b) exception for "disproportionate effort", because in practice the Client has direct contact with the individuals concerned and notification is straightforward.

15.2 What the notification covers

• Identity and contact details of ExValu and the Client as joint controllers
• Purposes of the processing (exit readiness preparation; operational documentation; knowledge capture)
• Categories of personal data concerned
• Recipients - including prospective acquirers at Stages 3-4 of the Buyer Data-Room Disclosure protocol
• Retention period and lawful basis
• Individual rights, including the right to object to legitimate interest processing

15.3 If you have not been notified

If you are an employee or officer of a business that has engaged ExValu and you have not received notification from your employer about this processing, contact [email protected] and we will work with your employer to ensure you receive the required information.