How we handle personal information, on this website and when we approach a business about a transaction.
Version 2.0. In effect from 3 October 2026. Applies to verticalstack.io and go-verticalstack.com.
VerticalStack Ltd is the controller of the personal information described in this policy. We buy and build software businesses in the United Kingdom, and we approach the owners of those businesses directly.
This site describes our platform, our model and our team, and has a section for the owners of software businesses. Most people who contact us through it are investors, partners, advisers or prospective colleagues, or founders considering a sale or a partnership, or simply asking what their business might be worth.
For anything in this policy, including a request to stop hearing from us, write to founders@go-verticalstack.com. That reaches the VerticalStack founders team.
We are registered with the Information Commissioner under reference ZC169249, registered on 8 June 2026 and due for renewal on 7 June 2027.
We collect your name, your email address, your company or organisation where you give it, and anything you choose to write in the message field. If you use the form in the founders section, we also collect the vertical you operate in and whether you are exploring an exit or looking to grow. You give us this information directly.
We hold your name, your role, your business email address and telephone number, the name of your company, and publicly reported information about that company such as its filings, its size and the markets it serves. We record whether we have contacted you, when, and what you said.
You did not give us this information, so you are entitled to know where it came from. It comes from the Companies House public register, from your own company website, from your public professional profile such as LinkedIn, and from commercial business information services including PitchBook. We do not buy consumer data and we do not use personal email addresses.
Our hosting provider records the usual technical information in its server logs, including the IP address making the request, the pages served, and the date and time. We use this to keep the site running and secure.
| What we do | Lawful basis |
|---|---|
| Reply to an enquiry you send us | Steps taken at your request before entering a contract, and our legitimate interests in responding to enquiries |
| Approach a business owner about a possible transaction | Our legitimate interests in identifying and contacting businesses we may wish to acquire or partner with |
| Progress a transaction, including diligence | Legitimate interests, and where a contract is in place, performance of that contract |
| Keep records of who asked us to stop | Legal obligation, and legitimate interests in honouring your request |
| Keep the site available and secure | Legitimate interests in operating our own systems |
Where we rely on legitimate interests we have carried out a balancing assessment, which weighs our interest in making contact against your interest in not being contacted. We keep that assessment on file and will share a summary of it if you ask.
Your right to stop hearing from us is absolute
If you tell us you do not want to be contacted, we stop, immediately and permanently. We do not require a reason and we do not ask you to reconsider. We keep only the minimum record needed to make sure we do not contact you again by mistake, which is your name, your company and the fact that you asked us to stop.
We do not sell personal information and we do not share it for anyone else’s marketing.
Google Workspace and our form handler may process information outside the United Kingdom. Where that happens, transfers are covered by the International Data Transfer Addendum to the European Commission standard contractual clauses, or by adequacy regulations.
| Information | Kept for |
|---|---|
| An enquiry you send us that does not lead anywhere | Two years from your last contact with us |
| Records of a live or completed transaction | Seven years from completion, or from the date talks ended |
| A record that you asked not to be contacted | Indefinitely, because deleting it would mean contacting you again |
| Website server logs | Twelve months |
This website uses only the cookies that are strictly necessary to serve the pages and keep the site secure. These do not require your consent and cannot be switched off without breaking the site.
We do not currently run analytics, advertising or social media tracking on this website. If that changes, this section will be replaced and a consent banner will appear before any non essential cookie is set. Links we use in our own correspondence may carry a tracking parameter so that we can tell which company a click came from. That parameter identifies the company, not the individual, and it sets no cookie on your device.
Under United Kingdom data protection law you have the right to ask us for a copy of the information we hold about you, to have it corrected, to have it deleted, to restrict how we use it, to object to our using it, and to receive it in a portable form where that applies. You may also object at any time to being contacted, and we will always agree.
Write to the address in section 1. We will respond within one month. There is no charge.
If you are not satisfied with our response you can complain to the Information Commissioner’s Office at ico.org.uk, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you came to us first, but you do not have to.
We will post any new version on this website with a new version number and date. If a change materially affects how we use information we already hold about you, we will tell you directly.