Privacy Policy

1. Who we are

K3 Deal Advisory is a trading name of K3 Advisory Group Limited, a company registered in England and Wales. Our registered office is at 20 St. Andrew Street, London EC4A 3AG.

K3 Advisory Group Limited is registered with the Information Commissioner's Office (ICO) as a data controller. Registration reference: [to confirm before launch].

References in this policy to “we”, “us” or “our” are references to K3 Advisory Group Limited operating as K3 Deal Advisory.

2. Scope of this policy

This policy explains how we collect, use, store and share personal data in connection with your use of k3da.net(the “Site”) and any communications you have with us through the Site. It does not cover data processed by third-party websites that may be linked from the Site.

This policy should be read alongside our Cookie Policy and our Terms of Use.

3. Information we collect

We may collect the following categories of personal data:

• Contact and enquiry data — name, organisation, job title, email address, and the content of any message you submit via our contact form or by direct email.
• Website analytics data — aggregated and, where applicable, pseudonymous data about how visitors use the Site, including pages visited, referral source and device type. See our Cookie Policy for further detail.
• Correspondence — records of emails and other communications you send to us directly.

We do not knowingly collect personal data from persons under the age of 18. The Site is directed at business users and professional advisers.

4. How we use the information

We use the personal data we collect for the following purposes:

• To respond to enquiries and requests you submit via the Site.
• To follow up on enquiries or expressions of interest in our advisory services, where we have a legitimate basis to do so.
• To maintain records of our business contacts and interactions in the ordinary course of our advisory practice.
• To improve the Site and understand how it is used, using aggregated analytics data.
• To comply with any applicable legal or regulatory obligations.

5. Legal bases for processing

We process personal data under the following legal bases set out in Article 6 of the UK General Data Protection Regulation (UK GDPR):

• Legitimate interests (Article 6(1)(f)) — responding to business enquiries, maintaining contact records, and operating our advisory practice in the normal course of business, where those interests are not overridden by your rights.
• Consent (Article 6(1)(a)) — where we have obtained your agreement before processing, for example where you opt in to receiving communications from us.
• Performance of a contract or pre-contractual steps (Article 6(1)(b)) — where processing is necessary to take steps at your request prior to entering into an engagement with us.
• Legal obligation (Article 6(1)(c)) — where processing is required to comply with a legal or regulatory requirement applicable to us.

6. Sharing your information

We do not sell personal data. We may share it in the following limited circumstances:

• Quantuma group entities — we may share data internally within the Quantuma group where necessary for business and administrative purposes.
• Regulated advisers and investors — only where you have asked us to progress an advisory mandate on your behalf and such disclosure is necessary to do so.
• Service processors — we use a small number of technology providers who process data on our behalf, including Vercel (website hosting) and Resend (transactional email delivery). These providers are subject to data processing agreements and are not permitted to use your data for their own purposes.
• Legal and regulatory — where we are required to disclose data by law, court order or regulatory authority.

7. International transfers

Some of our service providers, including Vercel (hosting) and Resend (email delivery), may process data outside the United Kingdom or the European Economic Area. Where such transfers occur, we ensure that appropriate safeguards are in place, including reliance on the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) approved under UK data protection law, or an adequacy determination by the Secretary of State.

Details of the specific transfer mechanisms in place are available on request at capitaladvisory@quantuma.com.

8. How long we keep your information

We retain personal data only for as long as necessary for the purpose for which it was collected or as required by applicable law or regulation. Our standard retention periods are:

• General enquiry data — 24 months from the date of last contact, unless the enquiry progresses to a formal engagement.
• Engagement and matter records — retained for the duration of the engagement and for a further period as required by applicable professional and regulatory obligations, typically [to confirm with compliance before launch] years thereafter.

We periodically review data we hold and delete or anonymise data that is no longer required.

9. Your rights

Under UK data protection law, you have the following rights in relation to personal data we hold about you:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to ask us to correct inaccurate or incomplete data.
• Right to erasure — to ask us to delete your personal data in certain circumstances.
• Right to restriction of processing — to ask us to limit how we use your data in certain circumstances.
• Right to object — to object to processing based on our legitimate interests or for direct marketing.
• Right to data portability — to receive your data in a structured, commonly used format in certain circumstances.
• Rights related to automated decision-making — we do not use solely automated processes to make decisions that have a significant legal or similar effect on you.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by telephone on 0303 123 1113, if you believe we have not handled your personal data in accordance with applicable law.

We ask that you contact us in the first instance so we can address any concern directly.

10. Contact

To exercise any of your rights, to ask a question about this policy, or to raise a data-related concern, please contact us at:

We will respond to all legitimate requests within one calendar month. In cases of complexity or volume we may extend this period by a further two months, in which case we will notify you of the extension.