Privacy

Privacy Policy

Last updated: 27 August 2026

This policy explains what information Mandafy ("we", "us", "our") collects when you contact us or share acquisition criteria or a sell-side teaser, why we collect it, how long we keep it, and the rights you have over it. If anything here is unclear, email us at office@mandafy.com and we'll explain.

Who we are

Mandafy is a European M&A relationship network. We connect M&A buyers with sell-side advisors. We do not provide advisory services and we do not publish or list deals publicly. For any question about your data, or to make a request, contact us at office@mandafy.com. Mandafy is the controller of the personal data described below.

What we collect

We only collect what you choose to send us:

• Contact details — your name and email address.
• If you are a buyer — your acquisition criteria (region, industry, size) and any further detail you add.
• If you are an advisor or seller — the teaser or mandate documents you upload (PDF, Word or similar) and the information they contain.
• Anything else you write to us, for example in the message field or by email.

We do not use advertising cookies or build profiles about you. Our website analytics (Cloudflare) is privacy-first and cookieless: it does not set cookies, does not store data on your device, and does not track you across other websites.

Why we use it, and our legal basis

We use the information you send only to:

• compare buyer criteria with the mandates in our network and identify a possible fit;
• contact the relevant parties and make an introduction where there is a genuine match; and
• reply to you and follow up.

Our legal basis under the GDPR is our legitimate interest in operating the network and taking steps at your request, and, where you send us your details, your consent for us to use them for this purpose. You can withdraw that consent at any time (see "Your rights" below).

Who we share it with

We never sell your data, and nothing is published or listed publicly. We only discuss a deal with a counterparty where we see a relevant fit, and only to the extent needed to explore that fit.

We rely on a small number of service providers who process data on our behalf, under confidentiality: our website host, our email provider, and our privacy-first analytics provider (Cloudflare). We may also disclose information if the law requires it.

How long we keep it

We keep the information you send us for up to one year, after which we delete it, unless we are still in active discussions with you or you have asked us to keep it longer. You can ask us to delete it sooner at any time.

Your rights

Under the GDPR you can ask us to:

• access the personal data we hold about you;
• correct it if it is wrong;
• delete it;
• restrict or object to how we use it; and
• receive a copy in a portable format.

To exercise any of these, email office@mandafy.com and we'll take care of it. You also have the right to complain to your local data protection authority in the EU/EEA.

Security

We take reasonable measures to keep your information safe and limit access to it. No method of transmission or storage is completely secure, but we work to protect what you share with us.

Changes to this policy

We may update this policy from time to time. When we do, we'll change the "last updated" date above.