Privacy policy

Last updated: August 2026. Version: 1.0.

Who we are

Crystal Zest ("we", "us") is the controller of personal data collected through crystalzest.co.uk. Our office is at 86–90 Paul Street, London, England, EC2A 4NE. You can contact us at Admin@crystalzest.co.uk or on +44 20 3823 6471. [To be completed: registered company name, company number and registered office.]

What we collect

• Enquiry information. Name, email, telephone, company, and the commercial details you choose to provide through a form — sector, revenue, EBITDA, capital requirement, timescales and free-text messages.
• Attachments. Documents you upload, such as summary accounts or an investment deck.
• Consent record. The privacy notice version and the date and time you submitted the form.
• Technical data. IP address, browser type and pages visited, collected through server logs and, where you have agreed, analytics cookies.

Why we use it, and our lawful basis

• To respond to your enquiry and assess whether we can act — necessary for our legitimate interests in operating an advisory business, and to take steps at your request before entering a contract.
• To provide services where you become a client — performance of a contract.
• To meet legal obligations including anti-money-laundering and record-keeping requirements — legal obligation.
• To improve the website using analytics — consent, which you can withdraw at any time.

Confidentiality

Commercial information about a business you own, are buying or are seeking investment for is treated as confidential. It is shared internally only with those who need it for the enquiry, and it is not disclosed to third parties without your instruction, except where we are required to do so by law.

Who we share it with

• Our website host and email provider, as processors
• Professional advisers instructed on a matter, where you have asked us to coordinate with them
• Regulators, law enforcement or courts where we are legally required to disclose

We do not sell personal data and we do not use it for advertising.

International transfers

Where information is transferred outside the United Kingdom — for example to a service provider, or in connection with a cross-border matter involving our network in Zimbabwe, South Africa or Botswana — we put appropriate safeguards in place, such as the UK International Data Transfer Agreement or an adequacy decision.

How long we keep it

Enquiries that do not proceed are kept for [period to be confirmed] and then deleted. Client records are kept for the period required by our professional and legal obligations, generally six years after the end of the engagement. Attachments are deleted once the enquiry is closed unless an engagement begins.

Your rights

You have the right to access your personal data, to have inaccurate data corrected, to request erasure or restriction, to object to processing based on legitimate interests, to data portability in some circumstances, and to withdraw consent where processing is based on consent. To exercise a right, email Admin@crystalzest.co.uk.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

Security

The website is served over HTTPS. Form submissions are validated on the server, uploads are restricted by file type and size and are encrypted at rest, and access to enquiry mailboxes is limited to authorised people. No system is completely secure, so please do not send highly sensitive documents through a website form.

Automated confirmations

Automated acknowledgements are sent from noreply@crystalzest.co.uk. That address is not monitored. Replies should go to the monitored address given in the acknowledgement.