Privacy Policy

1. Privacy at a glance

General information

The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. You will find detailed information on data protection in the privacy policy set out below this text.

Data collection on this website

Who is responsible for data collection on this website?

Data on this website is processed by the website operator. You will find the operator’s contact details in the section “Information on the controller” in this privacy policy.

How do I collect your data?

Some of your data is collected because you provide it to me. This may be, for example, data you enter in a contact form. Other data is collected by my IT systems automatically or with your consent when you visit the website. This is mainly technical data (e.g. internet browser, operating system or time of the page request).

What do I use your data for?

Part of the data is collected to ensure the website is provided without errors. Other data may be used to analyse your user behaviour.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data.

2. Hosting

This website is hosted by Vercel Inc. The server location is Frankfurt am Main, Germany (EU). Vercel processes the data on my behalf and is contractually obliged to take appropriate technical and organisational measures to protect your data.

Data processing agreement: I have concluded a data processing agreement (DPA) with Vercel. Vercel is certified under the EU-US Data Privacy Framework.

Company logos in the Deal-Radar: On the Deal-Radar pages, the logos of the companies involved appear next to their names. The logos come from each company’s own website and are stored at Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992) in the Frankfurt region (eu-central-1). When you open such a page, your browser loads the images directly from Supabase. Supabase delivers them via the Cloudflare network and in doing so processes your IP address and technical details such as browser and time, to the extent needed for delivery. The legal basis is the legitimate interest in a clear presentation of the transactions (Art. 6 (1) (f) GDPR). A data processing agreement is in place with Supabase. No other services are used for the logos.

3. General information and mandatory information

Data protection

The operator of these pages takes the protection of your personal data very seriously. I treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Information on the controller

The controller responsible for data processing on this website is:

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, email addresses or similar).

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data remains with me until the purpose of the processing no longer applies. If you make a justified request for erasure or withdraw your consent to data processing, your data will be erased unless I have other legally permissible reasons for storing your personal data.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the address bar of your browser changing from “http://” to “https://” and by the lock symbol in your browser bar.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Right to object to data collection in special cases (Art. 21 GDPR)

If data processing is based on Art. 6 (1) (e) or (f) GDPR, you have the right at any time to object to the processing of your personal data on grounds relating to your particular situation. If your data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing.

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged breach. The authority competent for the controller is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg.

Right to data portability

You have the right to have data that I process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this is done only where technically feasible.

Access, rectification, erasure and restriction

Within the applicable statutory provisions, you have the right at any time to information free of charge about your stored personal data, its origin and recipients and the purpose of the processing, and where applicable a right to rectification, erasure or restriction of the processing of this data. You can contact me at any time about this and any other questions on personal data.

Data transfers to third countries (USA)

Some of the service providers I use (Vercel, Resend, Google, Apollo.io) are based in the USA or process data there. Where your data is transferred to the USA, this is done on the basis of the EU-US Data Privacy Framework, under which the providers named are certified, and additionally on the basis of the EU Standard Contractual Clauses. Despite these safeguards, it cannot be completely ruled out that US authorities access the data when it is transferred to the USA. Where processing requires consent, the transfer is additionally based on your consent under Art. 49 (1) (a) GDPR.

4. Data collection on this website

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser transmits to me automatically. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not combined with other data sources. The data is collected on the basis of Art. 6 (1) (f) GDPR.

5. Analytics tools

Vercel Analytics (only with consent)

I use Vercel Analytics only if you have expressly agreed via my cookie consent banner (Art. 6 (1) (a) GDPR). Vercel Analytics collects anonymised usage data such as page views, referrers and device type. The data is processed by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). Vercel is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time via the cookie settings in the footer of this website.

Google Analytics 4 (optional, only with consent)

I use Google Analytics 4 only if you have expressly agreed via my cookie consent banner (Art. 6 (1) (a) GDPR). Google Analytics uses cookies that enable an analysis of your use of the website. Data is transferred to the USA on the basis of the EU-US Data Privacy Framework. You can withdraw your consent at any time.

6. Marketing tools

Apollo.io website tracking (only with consent)

I use the Apollo.io website tracker only if you have expressly agreed to the “Marketing” category via my cookie consent banner (Art. 6 (1) (a) GDPR). Apollo.io collects information about your usage behaviour on my website (e.g. pages visited, time spent, referrer) and, where possible, links it to a company profile to support my sales communication.

Provider: Apollo.io Inc., 535 Mission St, Suite 1100, San Francisco, CA 94105, USA. Apollo.io is certified under the EU-US Data Privacy Framework.

Data processed: IP address (truncated), browser type, pages visited, timestamp, referrer URL. It is combined with other personal data only where you have provided that data to me separately (e.g. via a contact form).

You can withdraw your consent at any time via the cookie settings in the footer of this website. Further information is available in the Apollo.io privacy policy.

7. Newsletter

If you would like to subscribe to the newsletter offered on the website, I need your email address and your express consent via a declaration of consent (checkbox). After signing up, you will receive a confirmation email at the address provided. Your email address is then added to the mailing list.

Newsletter service provider: The newsletter and all transactional emails (confirmations, reports) are sent via Resend (Resend Inc., 2261 Market Street #4059, San Francisco, CA 94114, USA). Resend processes your email address and, where applicable, your name solely for the purpose of sending emails on my behalf. Resend is certified under the EU-US Data Privacy Framework. I have concluded a data processing agreement with Resend.

You can unsubscribe from the newsletter at any time via the unsubscribe link in every newsletter email or by email to deals@sourcingclub.de. The lawfulness of the processing carried out until the withdrawal remains unaffected. Legal basis: Art. 6 (1) (a) GDPR.

8. Contact form

If you send me enquiries via the contact form, the details from the enquiry form, including the contact details you provide there, are stored by me for the purpose of handling the enquiry and in case of follow-up questions. I do not pass this data on without your consent.

This data is processed on the basis of Art. 6 (1) (b) GDPR where your enquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, the processing is based on my legitimate interest (Art. 6 (1) (f) GDPR).

The data you enter in the contact form remains with me until you ask me to erase it, withdraw your consent to its storage or the purpose of the storage no longer applies. Mandatory statutory provisions, in particular retention periods, remain unaffected.

9. Valuation calculator, report and lead forms

On my page “Unternehmenswert berechnen” (business valuation, in German) I offer a free valuation calculator. The calculation itself runs entirely in your browser. Your financial data (sector, revenue, EBIT) is not transmitted to my server.

In various places on my website I offer optional forms that you can use to request a PDF report, a download or a personal enquiry. Depending on the form, I collect the following data:

• Business valuation report: Name, email address, phone number (optional) and the financial figures you enter (sector, revenue, EBIT, calculated business value).
• Optimisation report: Name, email address, phone number (optional).
• Valuation aid for tax advisers: Email address, name of the firm, name of the client and the valuation data entered.
• Buyer match: Name, email address, phone number, your message and the search profile generated from your details.
• M&A adviser enquiry: Name, email address, phone number, sector, revenue, EBITDA, region, your role, time horizon, occasion and your message.
• Whitepaper, NDA and LOI downloads: Email address, name, firm, job title and phone number (some optional, depending on the download).

This data is transmitted to my server and processed via the email service provider Resend (Resend Inc., 2261 Market Street #4059, San Francisco, CA 94114, USA) to send you the requested report or download by email or to handle your enquiry. Resend is certified under the EU-US Data Privacy Framework, and a data processing agreement is in place with Resend. The legal basis is your consent under Art. 6 (1) (a) GDPR, which you give by submitting the form, and, where your enquiry is aimed at initiating a business relationship, Art. 6 (1) (b) GDPR.

The data is used solely to prepare and deliver the report or download, to handle your enquiry and, where applicable, to get in touch with you. It is erased as soon as the purpose of storage no longer applies, but no later than after 90 days, unless there is a statutory retention obligation or a business relationship going beyond this is established.

9.b Multiplier partner application and partner directory

If you apply via the form at /partner-werden (in German) I process the following data to review your admission to the SourcingClub multiplier network:

• Name, firm or partnership
• Email address, phone number
• Job title, years in practice, client base, desired partner level
• Region, professional chamber number and chamber location (optional)
• Specialisations (optional)
• Optionally uploaded documents (chamber ID card, business card)
• Remarks

The data is stored in my database at Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992) in the Frankfurt region (eu-central-1). A data processing agreement has been concluded with Supabase. Optional file uploads (chamber ID card, business card) are stored in a private storage area that is not publicly accessible and are used solely for identity verification.

The legal basis is your consent under Art. 6 (1) (a) GDPR and my legitimate interest in carefully reviewing network applications under Art. 6 (1) (f) GDPR. Uploaded proofs of identity are erased no later than 90 days after processing is completed. If the application is rejected, all application data is erased 6 months after the rejection, unless there is a statutory retention obligation.

If the application is accepted, the following data is added to the publicly accessible partner directory (in German): name, firm, job title, region, specialisations, tier assignment, voluntarily provided contact details (email, phone, website, LinkedIn) and a short profile description. Publication is based on a written standard agreement and can be revoked at any time on request.

9.c Confidential buyer match (seller enquiries)

Via the form /vertraulicher-buyer-match (in German) owners and managing directors can confidentially submit their company for introduction to suitable prospective buyers. Because this involves sensitive company and transaction data, I describe the processing separately here. I collect:

• Company data: Company name, commercial register number, registered office (federal state), sector, website, year founded, number of employees, short description of the business model
• Financial figures: Revenue for the current year and the two previous years, EBITDA, EBITDA margin
• Transaction details: Reason for sale, timing, buyer preference, desired role of management after the sale, advisers already involved, buyer talks already under way and any notes on discretion
• Contact details: Name, role in the company, email address, phone number
• Consents and technical data: Your data protection consent, your confirmation of confidentiality and a non-reversible hash of your IP address (to prevent abuse and spam)

Storage: The data is stored in my database at Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992) in the Frankfurt region (eu-central-1). A data processing agreement is in place with Supabase. I also send a notification of the receipt of your enquiry by email via Resend (see section 9).

Purpose: The data is used solely to review your enquiry and to confidentially prepare a possible company transaction. Identifying data is passed on to specific prospective buyers only after your separate approval. Where possible, potential buyers are first approached in anonymised form.

Legal basis: Your consent under Art. 6 (1) (a) GDPR and the performance of pre-contractual measures at your request under Art. 6 (1) (b) GDPR. You can withdraw your consent at any time with effect for the future and request the erasure of your data. The data is erased as soon as the purpose no longer applies or you object to its storage, unless statutory retention obligations prevent this.

10. Mandate portal for prospective buyers

For mandated prospective buyers (private equity funds, family offices and comparable investors) I operate a password-protected mandate portal. Through it they can view the status of a search mandate released to them (longlist of potential target companies, status of market outreach). Access is mandate-specific. Each user sees only the data of the mandates assigned to them.

Data processed

To provide and secure access, I process the following data of portal users (contacts at the prospective buyers):

• Name and business email address
• Organisation or company of the contact
• Login data (the password is stored only as a cryptographic hash)
• Time of the last login and technical log data of the login

Processing and processors

Accounts, access rights and the mandate data shown in the portal are processed in my database at Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992) in the Frankfurt region (eu-central-1). Authentication runs via the Supabase authentication service. A data processing agreement (Art. 28 GDPR) is in place with Supabase. Access and password emails are sent via Resend (see section 7).

Purpose and legal basis

The purpose of the processing is the provision, authentication and mandate-specific access control of the portal within my mandate relationship with the respective prospective buyer. The legal basis is the performance or initiation of the contractual relationship with the prospective buyer under Art. 6 (1) (b) GDPR and my legitimate interest in providing confidential mandate content securely and traceably under Art. 6 (1) (f) GDPR.

Storage period

Portal access is deactivated and the associated accounts are deleted as soon as the mandate has ended or the access is no longer needed, but no later than after any statutory retention periods have expired.

11. Self-initiated sourcing of target companies (deal origination)

The core of my work is identifying potential target companies for mandated prospective buyers. To do this, I research and process data about companies and about the natural persons acting for these companies (in particular managing directors, shareholders and owners). As a rule, this data is not collected from the data subject directly but from publicly accessible sources and from specialised data providers. I provide information about this processing under Art. 14 GDPR as follows.

Categories of data subjects and data

Data subjects are managing directors, shareholders and owners of potential target companies. In particular, I process:

• Name and function or role in the company
• business contact details (email address, phone number)
• professional profile (e.g. LinkedIn profile)
• shareholdings (e.g. shareholder status, percentage shareholding)
• year of birth or age, where evident from public registers
• company-related characteristics and indications of a possible succession or sale situation
• status of the business outreach and objection and blocking notes

Source of the data

I obtain this data from publicly accessible sources and from specialised service providers. Sources are in particular the commercial register and other publicly accessible registers, company websites, publicly accessible internet sources, professional networks and specialised B2B data providers and research or email verification services. Where such service providers process personal data on my behalf, data processing agreements under Art. 28 GDPR are in place where required. Any transfers to third countries take place on the bases named in section 3.

Purpose and legal basis

The purpose of the processing is to identify and, at a later stage, approach potential target companies on behalf of mandated prospective buyers (deal origination). The legal basis is my legitimate interest and the legitimate interest of the prospective buyers who have mandated me in initiating company transactions in a business (B2B) context under Art. 6 (1) (f) GDPR. I process only data with a professional connection. I will provide you with a balancing of your interests against my legitimate interests on request.

Recipients

I make selected company data available to the respective mandated prospective buyers (private equity funds, family offices) via the mandate portal (section 10) or in report form. As a rule, I do not pass personal details of managing directors, shareholders and owners (e.g. name, contact details, year of birth, percentage shareholding) on to the prospective buyers. They are passed on only where this is necessary for the specific mandate and legally permissible. Otherwise, these details are used solely for my internal assessment and outreach.

Information at first contact

If I contact data subjects directly for the first time, I additionally inform them about the processing of their personal data no later than at the first contact, unless they already have this information or a statutory exception applies.

Objection and suppression list

Because the processing is based on Art. 6 (1) (f) GDPR, you have the right to object to the processing of your data at any time on grounds relating to your particular situation (Art. 21 GDPR). If you object, I will no longer process your data unless I can demonstrate compelling legitimate grounds. To respect your objection permanently, I may store the contact details required for this in an internal suppression list. The legal basis for this is my legitimate interest in permanently respecting your objection (Art. 6 (1) (f) GDPR). You also have a right of access (including the source of your data) and to rectification and erasure (see section 3). Please send enquiries and objections to deals@sourcingclub.de.

Storage period and third-country transfers

I store this data only as long as it is needed to assess and approach a target company. If a company drops out as a target or you object, the associated personal data is erased unless statutory retention obligations prevent this. Where data providers based outside the EU/EEA are used, any data transfer takes place on the bases named in section 3 (“Data transfers to third countries”).

12. Cookies

My website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user’s computer system.

Technically necessary cookies

To operate the website, I use technically necessary first-party cookies:

• Cookie consent cookie: Stores your cookie settings (lifetime: 365 days)

The legal basis for the use of technically necessary cookies is Art. 6 (1) (f) GDPR.

Optional cookies

Optional cookies and similar technologies are set only after your express consent via my cookie consent banner. These include cookies in the “Analytics” category (Google Analytics, including _ga, _gid; and Vercel Analytics) and in the “Marketing” category (Apollo.io website tracker). Some of these are third-party cookies. You can withdraw or adjust your consent at any time with effect for the future via the “Cookie settings” link in the footer of my website. Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (German Telecommunications Digital Services Data Protection Act).

13. Automated decision-making and profiling

There is no automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

As part of my deal origination work (section 11), company-related information may be structured, assessed and prioritised to judge the business relevance of potential target companies for a mandate. This assessment serves solely my internal market and mandate analysis and the preparation of business contacts, and it has no legal effect on the data subjects.

14. Changes to this privacy policy

I reserve the right to amend this privacy policy if the legal situation, my website, my technical systems, my service providers or my data processing change. The current version published on this website applies in each case.