Privacy notice for company valuation

Optional Meta measurement and personalized advertising

Your Meta choice covers website page views, external application-link clicks and calculator measurement. You can change it through the cookie settings on any public page. Application data remains excluded.

With your separate consent, Buena uses Meta Pixel and the Conversions API for advertising measurement, campaign attribution and personalized advertising on Facebook and Instagram. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data can also be processed in the United States. See https://www.facebook.com/privacy/policy/.

Meta receives calculator page views, validated progress events, accepted requests and email confirmations. For consented requests, we send a normalized SHA-256 hash of your email, available browser and click identifiers, and technical request data such as IP address and browser information. Hashing does not make these identifiers anonymous. Financial answers, valuations, names, phone numbers and confirmation tokens are excluded.

Meta starts only after your explicit consent. Refusing consent does not affect the calculator or request processing. Meta website audiences can include consented visitors and questionnaire starters, and exclude completed requests. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google consent alone does not enable Meta.

Your browser stores consent for up to 180 days. Meta first-party cookies _fbp and _fbc identify browser and ad-click context and can remain for up to 90 days. Our backend stores a signed consent record. Matching context and delivery metadata are retained for at most 30 days or deleted earlier with the request. Delivered event payloads are removed within 24 hours. Consent evidence follows the related request retention policy.

You can withdraw Meta consent through the cookie settings. Withdrawal stops browser events, revokes the server receipt and cancels unsent events. If the network is unavailable, server revocation is retried after reconnection. Previously transmitted events cannot be recalled through the cookie settings. The email-confirmation page does not load Meta code; confirmation is reported from the backend only if the original consent remains valid.

Optional usage statistics with Google Analytics

If you consent through our cookie settings, we use Google Analytics 4 on the calculator's start and questionnaire page to analyse website usage. We record the steps visited, the choice between a short and full request, technical error categories and the successful acceptance of a request. This helps us identify steps we can improve. Your form answers, contact details, financial information, request identifiers and confirmation tokens are not sent to Google Analytics.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google also processes technical usage data, such as browser and device information, page views and visit times. Data may also be processed in the USA. Information about Google's processing is available at https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites.

Usage statistics are activated only after you consent. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. Without your consent to usage statistics, we do not load Google Analytics tags or set statistics cookies. Google Tag Manager is loaded only if you consent to at least one of the two Google measurement purposes. Your choice does not affect your use of the calculator or the processing of your request. The email confirmation page is not measured with Google Analytics.

We store your choice, its timestamp, expiry date and text version locally in your browser for 180 days. If this is technically impossible, your choice applies only to the current page. Statistics cookies use the prefix buena_nr and are set for no more than 180 days. You can withdraw your consent at any time in the cookie settings with effect for the future. We then stop recording data and remove these statistics cookies. Data already transmitted is not deleted retrospectively.

Optional advertising measurement with Google Ads

If you separately consent to advertising measurement, we use Google Ads from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We measure whether, after an advertising click, initial information is completed, the shared core data is fully entered, the contact step is reached or a request is successfully accepted. These events help us direct our advertising towards interested users. We send only the step reached, not your answers. Advertising click identifiers, permitted campaign parameters, technical usage data and a random identifier to prevent duplicate counts may be sent to Google. Contact details, financial information and valuation results are not sent to Google Ads. We use neither personalised advertising nor enhanced conversions with contact details.

The legal bases are your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Without consent, no Google Ads tags are loaded and no advertising measurement cookies are set. You can choose usage statistics independently. The confirmation and privacy pages are not measured. Google may also process data in the USA. Information is available at https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites.

With your consent, we retain the last attributed campaign in your browser tab's session storage. When you submit a request, we store the source, medium, campaign, ad variant and associated advertising keyword, together with the timestamp and version of your consent, in our request system and in Attio. The attribution data is subject to the same deletion periods as your request. Advertising click identifiers are not stored in Attio.

Google Ads cookies for the calculator use the prefix _gcl_buena_nr and are set for no more than 90 days. Random identifiers and requests already counted are stored for no longer than the browser session to prevent duplicate counts. You can withdraw your consent at any time in the cookie settings with effect for the future. We then delete the corresponding calculator cookies and campaign attribution that has not yet been transmitted. Data already transmitted is not deleted retrospectively.

1. Controller and data protection officer

The controller is Buena GmbH, Immanuelkirchstraße 26, 10405 Berlin, Germany. Email: datenschutz@buena.com. Telephone: +49 30 8878 9123.

You can contact our data protection officer at DataCo GmbH (DataGuard) by telephone at +49 89 45249900 or by email at info@dataguard.de.

2. Data we process

• Contact and identification data: first and last name, email address, phone number (if provided) and role in the company.
• Company and financial data: the information you enter about your company, particularly the number of managed units or properties and financial figures, and the indicative estimate derived from them. For sole traders and partnerships, this information may also constitute personal data.
• Evidence and metadata: the time of your request and email confirmation, the status of your confirmations, form version and IP address.
• Communication data: the contents of subsequent correspondence and conversations with you.

3. Purposes and legal bases

a) Preparing and sending the indicative estimate. We process your information to prepare the estimate you requested and send it to you by email. The legal basis is Article 6(1)(b) GDPR: providing the service you requested or taking pre-contractual steps at your request.

b) Contact about the result and a possible company sale. We subsequently contact you to discuss the result, clarify any interest in a sale, request further information if needed and initiate a possible acquisition of your company. The legal bases are Article 6(1)(b) and Article 6(1)(f) GDPR. Our legitimate interest is to initiate company acquisitions and contact potential sellers who have requested a valuation from us. Contact by email and, if you provided your phone number, by telephone is based on the consent you give in the form. You can withdraw this consent at any time with effect for the future. See Section 1 for contact details or email datenschutz@buena.com.

c) Evidence and documentation. We store the evidence data listed in Section 2 to demonstrate that you gave consent and that we processed your request correctly. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in legal defence and maintaining evidence.

d) Suppression list. If you object to further contact or withdraw your consent, we store the necessary contact details in an internal suppression list to respect your objection permanently. The legal basis is Article 6(1)(f) GDPR.

We do not use your data for general advertising, newsletters or other sales communications outside the purposes described here.

4. Providing your data

Your name, email address, role in the company and company information are necessary to prepare and send the estimate. We cannot process your request without this information. Providing a phone number is voluntary. You have no statutory or contractual obligation to provide the data.

5. Individual review of the estimate

The indicative estimate is individually reviewed before it is sent. We do not make decisions based solely on automated processing within the meaning of Article 22 GDPR.

6. Recipients of your data

Our succession team reviews your request. Members of our Buena workspace can access the request in our CRM. Your request is treated confidentially. We also use service providers that act on our instructions as processors under Article 28 GDPR. We do not disclose your data to other third parties for their own purposes.

• Vercel Inc., USA: website hosting and server-side processing of the calculator.
• Databricks, Inc., USA (Neon, with the involvement of its subsidiary Neon, LLC): PostgreSQL database in Frankfurt for requests, consent evidence and processing status.
• Plus Five Five, Inc., USA, trading as Resend: sending the double opt-in confirmation email, reviewed estimate and request-related notifications.
• Attio Limited, United Kingdom: customer management and documentation of your request, consent and reviewed estimate.

7. Transfers to third countries

When we use our service providers, personal data is also processed outside the European Union and European Economic Area, particularly in the USA and United Kingdom. A European server location does not prevent access from third countries or processing there by subprocessors.

Vercel also processes data in the USA. The European Commission's standard contractual clauses are included in the data processing agreement for these transfers.

The Neon database is located in Frankfurt. However, Databricks and its subprocessors may also process data in third countries, for example for operations and support. Databricks, Inc. and Neon, LLC are certified under the EU-US Data Privacy Framework. The European Commission's corresponding adequacy decision applies to covered transfers to the USA. For transfers not covered by an adequacy decision, the data processing agreement provides for standard contractual clauses.

Resend stores email contents and delivery logs in the USA. Selecting Ireland as the sending region does not change this storage location. Transfers are protected by standard contractual clauses in the data processing agreement. Resend also participates in the EU-US Data Privacy Framework.

The European Commission's adequacy decision applies to transfers to Attio in the United Kingdom. Attio also uses subprocessors, including in the USA. Contractual safeguards, particularly standard contractual clauses, are provided for transfers to countries without an applicable adequacy decision.

You can request a copy of the safeguards that apply to your data and further information about transfers at datenschutz@buena.com.

8. Retention periods

• While you enter your information, we store a draft only in your browser's local storage so you can resume the questionnaire. The draft is removed after successful submission. After 30 days without an update, it is discarded the next time you visit. You can delete it at any time through your browser's website data settings. You must give both confirmations again when resuming.
• When you submit, we also temporarily store your information and a request identifier in your browser's session storage. This prevents a retry after a connection error from creating a duplicate request. The entry is removed after successful submission and remains for no longer than the browser session.
• If you do not confirm your email address, we delete your information within 30 days.
• If you tell us you are not interested in a sale or object to contact, we delete your data within 90 days. The suppression list described in Section 3(d) is unaffected.
• If you do not respond to the estimate we send, we delete your data no later than 6 months after our last attempt to contact you.
• If specific discussions about a sale do not lead to an agreement, we delete your data no later than 12 months after the discussions end, unless statutory retention duties or the establishment, exercise or defence of legal claims require longer retention.

9. Your rights

Subject to the statutory requirements, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You can withdraw consent to contact at any time with effect for the future. This does not affect the lawfulness of processing before withdrawal.

Right to object (Article 21 GDPR): where we process your data under Article 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. You can object to processing for direct contact at any time without giving reasons. We will then cease contacting you. Send your objection, without any formal requirements, to the contact details in Section 1.

You also have the right to complain to a data protection supervisory authority under Article 77 GDPR, particularly the Berlin Commissioner for Data Protection and Freedom of Information, which is responsible for us.