A. Information You Provide to Us

• Identity & Contact Data: Full name, job title, company name, email address, and telephone number submitted through registration, contact forms, or valuation requests.
• Financial & Business Data: Annual recurring revenue, EBITDA, employee count, customer count, industry vertical, and ownership structure submitted through our valuation and intake forms.
• Transaction Data: Information relating to your divestiture or acquisition interest, investment thesis, target parameters, and deal history.
• Account Credentials: Username, password, and account preferences you establish on our platform.
• Communications: Records of correspondence between you and our advisory team, including emails, messages sent through the platform, and meeting notes.
• Signature Data: When you execute NDAs or agreements on our platform, we collect your name, title, company, and electronic signature.

B. Information Collected Automatically

• Usage Data: Pages visited, features accessed, session duration, and clickstream data.
• Device & Technical Data: IP address, browser type, operating system, and device identifiers.
• Cookies: Session and preference data collected through cookies (see Section 7).

• Service Delivery: To operate our platform, process your requests, and provide investment banking advisory services.
• Valuation Analysis: To generate preliminary valuation assessments and market analysis based on the financial data you provide.
• Deal Facilitation: To identify and, with your explicit consent, introduce you to qualified counterparties under strict confidentiality agreements.
• Communication: To respond to inquiries, send service-related notifications, and provide market insights with your consent.
• Platform Improvement: To analyze usage patterns and improve our technology and services.
• Legal Compliance: To comply with applicable laws and regulations, including AML and KYC requirements applicable to financial advisory firms.
• Security & Fraud Prevention: To detect, prevent, and address fraud, abuse, and security risks.

We recognize that the business and financial information you share, including the very fact that you are considering a divestiture, is among the most sensitive information a business executive can disclose. We operate under the following strict principles:

• We never disclose the identity of any client or the existence of any engagement to third parties without your explicit written consent.
• Our advisors are bound by professional confidentiality obligations as a condition of employment.
• Any third party who receives information in connection with a potential transaction executes a legally binding NDA before receiving any identifying information.
• We do not sell, rent, or otherwise monetize your business or personal information to any third party for commercial purposes.
• All staff and contractors with access to client information are subject to binding confidentiality agreements.

Note: A formal confidential advisory relationship is established only upon execution of a written engagement letter. However, these confidentiality principles apply from your first interaction with our platform.

We share your information only in the following limited circumstances:

• With Your Consent: When you explicitly authorize us to share information with potential buyers, sellers, or other parties in connection with a transaction.
• Trusted Service Providers: With third-party vendors who help operate our platform (cloud hosting, email delivery, analytics), each bound by strict confidentiality contracts and prohibited from using your data for any other purpose.
• Legal Requirements: When required by law, court order, or regulatory authority, or to protect our legal rights or user safety.
• FIH.com (Parent Company): As the technology divestiture practice of FIH.com, we may share information with our parent company for operational oversight and compliance purposes, subject to the same confidentiality standards in this policy.
• Business Transfers: In the event of a merger or acquisition of Divestitures.com, your information would transfer as a business asset, subject to the same privacy obligations.

We will never sell personal data to data brokers, advertisers, or commercial third parties.

We implement institutional-grade security measures to protect your information, including:

• End-to-end encryption for all data transmitted through our platform (TLS 1.2+)
• Encryption at rest for all stored data and documents
• Role-based access controls limiting internal access on a strict need-to-know basis
• Private access controls for all uploaded files, with no public URLs for confidential documents
• Regular security audits and vulnerability assessments
• Formal incident response procedures and breach notification protocols
• Multi-factor authentication for platform access

While we employ industry-leading security practices, no digital system is entirely immune to risk. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law.

We retain your information only as long as necessary for the purposes outlined in this policy:

• Active Client Records: Retained for the duration of the engagement plus a minimum of 7 years for regulatory and legal compliance.
• Inquiry & Valuation Data (Non-Clients): Retained for up to 2 years, then deleted or anonymized.
• Account Data: Retained until account deletion, subject to applicable legal retention requirements.
• Platform Usage Logs: Retained for up to 12 months.

You may request deletion of your personal data at any time by contacting us. Deletion requests are processed within 30 days, subject to our legal obligations to retain certain records.

We use cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for platform functionality, including authentication and security. Cannot be disabled.
• Analytics Cookies: Help us understand platform usage to improve the user experience (e.g., page views, session duration).
• Preference Cookies: Remember your settings for future visits.

You can control cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to use core platform features.

Depending on your jurisdiction, you may have the following rights:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete information.
• Right to Deletion: Request deletion of your personal information ("right to be forgotten"), subject to legal retention requirements.
• Right to Portability: Receive your personal data in a portable, machine-readable format.
• Right to Object: Object to processing of your personal information for certain purposes, including direct marketing.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent, without affecting prior processing.
• California Residents (CCPA): Additional rights including the right to know what data we collect and the right to opt out of sale (we do not sell personal data).

To exercise these rights, contact us through the Contact page. We respond to all verifiable requests within 30 days.

Divestitures.com operates primarily in the United States. If you are located outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our infrastructure and service providers are located.

We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses and data processing agreements, in compliance with applicable data protection laws including GDPR where applicable.

Our Service is intended exclusively for business professionals and is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately for prompt deletion.

Our platform may contain links to third-party websites, including FIH.com and other professional resources. This Privacy Policy applies solely to our Service. We are not responsible for the privacy practices of third-party sites and encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending an email notification to registered users for material changes
• Displaying a prominent notice on the platform for significant updates

Your continued use of our Service after any changes constitutes acceptance of the updated policy.