Legal

Privacy Policy

Last updated: 27 October 2026

Who we are

Helmshore Consulting Limited ("Helmshore", "we", "us") provides sell-side readiness and M&A advisory services. We operate Helmshore LaunchPad, a web platform used by clients and their nominated team members during an engagement.

We are the data controller for the personal data described in this notice, except where section 08 says otherwise.

Contact details:
Email: adam@helmshoreconsulting.com
Address: 71–75 Shelton Street, London, WC2H 9JQ

This website

You can read every page of this website without giving us anything.

We set no cookies and run no analytics, advertising or tracking scripts.
We have no contact forms. If you email us, we hold that email.
The site makes no requests to any third party. Typefaces, images and everything else are served from this site, so no other company learns that you visited it.
Screenshots shown on this site use invented data. No client information appears anywhere on it.

The Helmshore LaunchPad platform

The platform is invite-only. Accounts are created only for people we, or a client lead, have explicitly invited to a specific engagement.

About you as a user

Name and email address
Your role on the engagement and the organisation you belong to
Passkey credentials, or the one-time sign-in codes we send by email. We never set, receive or store passwords.
A record of your sign-ins and of every change you make

The engagement content

The answers your team writes to the Fact Finder, and the correspondence between your team and Helmshore about those answers
Responses recorded against actions in the preparation plan
Documents uploaded as evidence that an action is complete
Documents your team places in the data room we prepare with you, and the notes Helmshore and your team record against them
The readiness report, preparation plan and data room index we produce

Engagement content is commercial information about a business. It can also contain personal data about individuals, for example employees named in a share-award schedule, a pension analysis or an employment contract. Section 08 explains who is responsible for that.

Why we hold it, and on what legal basis

Purpose	Lawful basis
Delivering the engagement you have appointed us for	Performance of a contract
Creating and managing your account, and signing you in	Performance of a contract
Keeping an audit trail of who changed what and when	Legitimate interests — integrity and accountability of professional work product
Securing the platform and investigating misuse	Legitimate interests — security
Meeting our own legal, regulatory and professional obligations	Legal obligation

How we use AI, and what that means for your data

Helmshore LaunchPad uses Claude, a large language model made by Anthropic, which we reach through Amazon Web Services (AWS). The model we use may change over time. How we reach it, where it runs and the zero retention described below do not.

We use it to help draft our work from your team's answers, and to review the documents your team adds to the data room.

What this means in practice:

Nothing is kept. Our AWS account is set to zero data retention. What we send, and what comes back, is not stored once the response is returned.
It stays in the UK and EU. Every request goes to AWS in London and is processed only within the UK and the European Union.
Your content is not used to train models, by AWS or by Anthropic, and is not shared with Anthropic.
A person decides. Every draft is reviewed, edited and approved by a person at Helmshore before it becomes a document you see. When a document is added to the data room, anything the check notices about it, such as a missing signature, is shown straight away to the people who can see that document so it can be put right. It is a prompt to look, never a decision. There is no automated decision-making that produces legal or similarly significant effects.

AWS acts as our processor and may only handle the data on our instructions.

Who else processes your data

We use a small number of service providers. Each acts on our instructions under a written contract.

Provider	What they do	Where
Supabase	Database, authentication and file storage for the platform	London (UK)
Netlify	Serves this website and the platform's pages	Global content network
Resend	Sends sign-in codes and notification emails	United States
Amazon Web Services	Runs the Claude model that drafts our documents and checks data room documents (section 04), and keeps a backup copy of stored documents	London (UK), processing within the UK and EU
Microsoft	Holds our working files for an engagement, such as documents sent to us outside the platform, and our email, calendar and Teams	United Kingdom

We do not sell personal data, and we do not share it for anyone else's marketing.

Transfers outside the UK

Your engagement content is stored in the United Kingdom. Some of the providers above operate outside the UK. Where personal data is transferred out, we rely on UK adequacy regulations where they apply, and otherwise on an International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework.

How long we keep it

During the engagement, for as long as the engagement is live.
After it ends, for up to six years, to meet legal, tax and professional obligations and to answer questions about work we did. The written content of an engagement (Fact Finder answers, reports, plans and contents lists) is deleted at the end of that period, six years after we record the engagement as ended, unless we agree otherwise with you in writing.
Uploaded documents, in the data room and as plan evidence, are deleted twelve months after your data room closes, unless your engagement letter sets a different period, you ask us to keep them or we are required to.
Backup copies. Every stored document is also copied each hour to a private store held by AWS in London. When a document is deleted, its copy is removed too, but that store protects earlier versions of a file for 35 days, so a deleted document can remain in it for up to 35 days before it is gone. Our database is also backed up daily, and those backups are kept for 7 days, so a deleted record can remain in a backup for up to 7 days. We cannot delete from a backup before its time is up.
Working files and correspondence. Documents sent to us outside the platform, and our email, calendar and Teams messages about an engagement, are kept in Microsoft 365 for six years after the engagement ends, then deleted. This is longer than the period for documents held on the platform.
Audit records. Our audit records are append-only: nobody can edit or delete them. They record who changed what and when, and they keep a copy of what was changed. They are kept for the whole retention period above. For that reason a request to delete personal data cannot reach the audit records while that period runs; they exist so that professional work can be shown to be accurate and unaltered. When written content is deleted at the end of the period, the copies of that content held in the audit records are blanked at the same time. The record that events happened, and when, is kept.

We delete or anonymise personal data when it is no longer needed.

How we protect it

Sign-in is passwordless: a passkey held on your own device, or a single-use code sent to your invited email address and valid only briefly.
Access is invite-only. The platform will not create an account for an address nobody has invited.
Every read and every write is checked in the database itself, not merely in the interface. Advisers, client leads and contributors each see only what their role allows.
Every change is written to an append-only audit log.
Everything is served over HTTPS, and the site restricts what the browser is allowed to load and connect to.
Sessions expire after fourteen days of inactivity and after thirty days regardless.

Where we act as a processor, not a controller

When your team enters information about other people — your employees, directors, shareholders or counterparties — into the platform, your organisation decides what goes in and why. In that respect your organisation is the controller and Helmshore is your processor: we handle that information only on your instructions and only to deliver the engagement.

Our engagement terms include the data processing provisions required by UK GDPR Article 28. If you need a standalone data processing agreement, ask and we will provide one.

For your own account details — your name, your email address, your sign-in records — we are the controller.

Your rights

Under UK data protection law you have the right to:

ask what personal data we hold about you and receive a copy
have inaccurate data corrected
ask us to delete data, where no legal obligation requires us to keep it. A request to delete cannot reach our audit records during the retention period (see section 06). We will tell you plainly if that is the case for your request
restrict or object to how we use it
receive certain data in a portable form
withdraw consent, where we relied on consent

To exercise any of these, email adam@helmshoreconsulting.com. We will respond within one month.

If you are unhappy with how we have handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113.

Changes to this notice

We update this notice when the platform changes. The current version is always published here, with the date it took effect.