01Who is responsible for your information
Finetta Ltd operates the finetta website and is the controller of personal information used for website enquiries and initial business discussions. You can write to us at 49 Greek Street, Soho, London, W1D 4EG, United Kingdom, or email legal@finetta.com.
This notice concerns personal information: information identifying a person, including a founder, director, employee or professional contact. Company information is not always personal information, but accounts and supporting documents can contain it. This notice applies to that personal information too.
02Information we collect and where it comes from
Most information comes directly from you through correspondence or conversations. It can include your name, work contact details, position, company, business plans and the questions you ask. We keep correspondence and relevant meeting notes so we can follow up accurately.
An introduction may also come from a colleague, adviser or business contact. Where relevant to your enquiry, we may consult public company registers or your business website to understand your role and organisation. We do not treat publicly available personal information as unrestricted information.
Hosting services may record IP addresses, browser details, pages requested and access times for delivery and security. You are not legally required to submit an enquiry. Without suitable contact details or the information needed to understand it, we may be unable to respond meaningfully.
03Initial conversations and business documents
An initial enquiry does not require a full financial submission. Please avoid sending identity documents, bank statements, employee records or customer-level data through a general enquiry. We will explain what is needed and how it should be shared.
If a conversation progresses to an assessment, relevant material may include management accounts, cash forecasts, existing facilities, stock commitments and trading information. Before collecting additional personal information, we explain its purpose, who will receive it and any additional terms or privacy information that apply. Remove unnecessary personal details from business documents where possible.
If you provide another person’s details, make sure you are entitled to share them and direct them to this notice. We do not request sensitive personal information for initial enquiries.
04Purposes and lawful bases
We use professional contact details and correspondence to respond, arrange conversations and assess whether our services could be relevant. Our UK GDPR basis is our legitimate interest in responding to business enquiries and developing appropriate business relationships, balanced against the rights of the people involved.
Where you personally request steps before entering a contract with us, we may instead rely on those pre-contractual steps. A contract with your company does not automatically make that the lawful basis for every use of your personal information.
We use necessary technical information to deliver the site, investigate faults and prevent misuse, relying on our legitimate interest in a secure service. We may process records to meet a legal obligation or, where appropriate, our legitimate interest in establishing or defending legal claims.
If we introduce a new use requiring consent, we will ask separately. Making an enquiry does not subscribe you to marketing. You can object to direct marketing at any time.
05Sharing with providers and capital partners
People handling your enquiry may access it, together with providers supporting hosting, email, communications and secure document administration. Access is limited to what they need for their role and supported by appropriate confidentiality and data protection arrangements.
We discuss proposed introductions before forwarding your business information to a capital partner. We do not circulate an initial enquiry indiscriminately. A lender or investor receiving information for its own assessment will generally be responsible for its own processing; we will identify the proposed recipient and make its relevant privacy information available.
Professional advisers may receive information where needed for advice or legal claims. Authorities may receive it where disclosure is required by law. We do not sell personal information.
06Technology and human judgement
We may use tools to organise business information, prepare analysis and support our work. This does not mean that a website enquiry is automatically approved or rejected for funding. We do not make decisions about individuals with legal or similarly significant effects based solely on automated processing.
Any future use involving such decisions would require further explanation before it begins. Capital partners make their own funding decisions under their own assessment processes.
07International handling and security
Service providers may handle information outside the United Kingdom, including in the United States. Where a transfer requires safeguards under UK data protection law, we use an applicable adequacy arrangement or approved contractual safeguards and any necessary additional measures. Contact us for information about safeguards relevant to your data.
We use measures appropriate to the information and its risks, including controlled access and secure methods of exchange. No internet transmission or storage system can be guaranteed completely secure. If you believe information has reached the wrong person, contact us promptly.
08How long we keep information
Initial enquiry records are retained for up to 12 months after our last meaningful contact, unless an engagement follows or a longer period is needed for a legal obligation or claim. Routine website security logs are kept for up to 90 days, unless needed to investigate an incident.
If work proceeds, we explain the retention arrangements for engagement records separately. A relevant claim, legal requirement or investigation can justify preserving specific records longer; it does not justify retaining every enquiry indefinitely. Information no longer required is deleted or anonymised, subject to routine backup cycles.
09Your choices, rights and complaints
Depending on the circumstances, you may request access, correction, deletion, restriction or a portable copy of your information. You may object to processing based on legitimate interests. Where consent is the basis, you can withdraw it without affecting processing that was lawful before withdrawal. These rights have conditions and exceptions.
Write to legal@finetta.com with enough information to identify your request. We may ask for proportionate evidence of identity. We normally respond within one month; if a lawful extension applies, we explain the reason and timing.
You may raise a concern with us or complain to the Information Commissioner’s Office. You do not have to contact us first.
10Website services and changes
The homepage uses Google Fonts, which receives technical request information when your browser loads a font. Our cookie information explains this and the site’s current use of tracking technologies.
We update this notice as practices change. Where required, we bring significant new purposes or changes to your attention before using information in a new way.