Effective date: 21 September 2026 · Version 1.0
Governing law: France · Cape Partners SAS (SIREN-verified)
This notice explains how Cape Partners processes personal data in connection with the Cape Partners platform (the "Platform") — an invitation-driven technology venue connecting vetted sellers and buyers of French and European lower-middle-market businesses. It is the privacy counterpart to our Terms of Service. The Terms govern your use of the Platform; this notice governs our handling of personal data.
We do not currently operate a mandatory Data Protection Officer. Where one is appointed, its contact details will be published here.
2. SCOPE — WHO THIS NOTICE COVERS
It covers two distinct populations, on different bases:
Registered users — sellers, buyers, advisers, and their authorised representatives who join the Platform.
Third-party data subjects — company officers, directors, shareholders, advisers, and professional contacts whose details appear in company profiles and deal listings, including people who have never interacted with us and who therefore have no contractual relationship with Cape Partners.
3. WHAT WE PROCESS, AND FROM WHERE
Data you give us directly (users):
Identity and professional details: name, role, company, entity name, SIREN/SIRET, corporate email, and — where required for verification — LinkedIn presence and domain-email confirmation.
Deal profile data you submit: sector, activity/solution description, financial indicators (revenue, EBITDA, growth, headcount), preferences, and any documents you upload.
Communications: in-app messages, introduction requests, and correspondence with us.
Data generated by your use of the Platform:
Activity and audit logs: timestamped actions, access records, NDA executions, data-room access records, message histories, and IP logs. These serve the evidentiary function described in Sections 6 and 7 of the Terms of Service (attribution, tail periods, and breach).
Verification signals: anti-bot challenge tokens used at human entry points.
Data about third-party data subjects, obtained from public and professional sources:
Company officers, directors, and representatives, together with professional contact details, collected from public registers and open data (including the INPI Registre national des entreprises / RNE, INSEE, and BODACC), from company websites, and from professional data providers.
Company financial data filed publicly or supplied by the company itself, including annual accounts.
We do not knowingly collect sensitive data (as defined in Article 9 GDPR), and we do not collect personal data of minors.
4. WHY WE PROCESS IT, AND OUR LEGAL BASIS
To operate the Platform and perform our agreement with you — account creation, identity verification, matching, listings, deal workflow, notifications. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
To identify, enrich, and present companies and their officers and professional contacts for deal-evaluation purposes. Legal basis: our legitimate interests (Art. 6(1)(f)) in operating a business-to-business deal venue — assessed so as to concern professional, publicly-sourced information only, and subject to your rights (Section 8).
To maintain security, prevent circumvention, and evidence attributions and tail periods under the Terms. Legal basis: legitimate interests (Art. 6(1)(f)) in protecting the integrity of the venue and our contractual entitlements, and establishment/exercise of legal claims (Art. 6(1)(f) and Art. 9(2)(f) if applicable).
To meet legal, accounting, and tax obligations. Legal basis: legal obligation (Art. 6(1)(c)).
To improve the Platform (aggregate analysis, matching quality, data-quality measurement). Legal basis: legitimate interests (Art. 6(1)(f)).
Where we rely on legitimate interests, we have carried out a balancing assessment and record it. You may ask us for information about it.
5. CONFIDENTIALITY: TWO TIERS, TWO LEVELS OF EXPOSURE
Personal data in a listing is not exposed uniformly. Pre-NDA, listings are anonymised or banded and withhold identities, contacts, and granular financials. Identities and contacts are revealed only to a counterparty that has executed the relevant NDA. This tiering limits, but does not eliminate, disclosure to platform users.
6. WHO RECEIVES IT
Other platform users — a counterparty that has signed the relevant NDA, strictly for evaluating that deal.
Service providers (processors) — hosting and network infrastructure, email delivery, document/workflow tooling, anti-bot verification, and data-enrichment providers that supply the registry and professional data described above. Each is bound by a data-processing agreement.
Professional advisers and authorities — where necessary to enforce the Terms, establish or defend legal claims, or comply with law.
We do not sell personal data.
7. RETENTION
User account and profile data — for the duration of the relationship, then deleted or anonymised, subject to any applicable legal retention.
Activity / audit logs and evidence records — retained for twenty-four (24) months, aligned with the Protected Period defined in the Terms of Service, because they constitute the evidentiary record of attribution; then deleted. This alignment is deliberate and supersedes any shorter default retention for those records.
Third-party data subject records (officers, professional contacts) — retained while relevant to an active or potential deal, and deleted on request or when no longer relevant, absent a legal-claim need.
Accounting and tax records — retained for the period required by French law (currently ten (10) years).
8. YOUR RIGHTS
You have the right to access, rectify, erase, restrict, and object to the processing of your personal data, and to data portability where applicable. You may also withdraw consent where consent is the basis.
To exercise any right: email [email protected], marked "Privacy". We respond within one (1) month, extendable by two (2) months for complex requests, with notice.
If your details appear in a listing but you are not a user — you have the same rights. Write to us at the address above; we will identify the record, and where it is no longer relevant to an active or potential deal, erase it.
Objection to legitimate-interest processing — you may object at any time; we will stop unless we can demonstrate compelling legitimate grounds that override your interests, or a legal-claim need.
Supervisory authority — you may lodge a complaint with the CNIL (www.cnil.fr) if you consider our handling infringes the GDPR, though we ask you to contact us first.
9. SECURITY
We apply access control, identity gating, NDA-gated disclosure, and audit logging. No system is perfectly secure; where a personal-data breach creates a risk to your rights, we will notify the CNIL and, where required, you, in accordance with Articles 33–34 GDPR.
10. INTERNATIONAL TRANSFERS
The Platform is hosted within the European Union. Where a service provider processes data outside the EEA, we rely on an adequacy decision or an appropriate safeguard (standard contractual clauses), and we can tell you which on request.
11. COOKIES AND SIMILAR TECHNOLOGIES
We use only what is necessary to operate and secure the Platform — session storage and an anti-bot verification token. We do not use advertising or cross-site tracking cookies. Where non-essential cookies are introduced, they will be subject to prior consent.
12. CHANGES TO THIS NOTICE
We may update this notice. Material changes will be notified on the Platform or by email. The effective date above will be revised accordingly. This notice is not the Terms of Service and does not modify them.