Confidentiality/Privacy Policy
of the Widoowin Corporate Finance Entities 

Widoowin Corporate Finance Entities, as detailed in Section 2 below (hereinafter "Widoowin Entities" , " we ", " us ", " our "), are financial and investment services companies that assist their clients in the implementation of cross-border domestic small and mid-cap transactions between Asia and Europe. The Widoowin Entities operate a tailor-made M&A solution, called the " M&A System ", with a powerful CRM and an integrated international network, enabling its partners to identify new markets, attract additional clients and enable a number of transactions to be completed.

In this context, the Widoowin Entities are committed to protecting the privacy and personal data of the persons whose data is processed via the M&A System in compliance with the applicable legal requirements and in particular Regulation n°2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter " General Data Protection Regulation " or " GDPR ") and/or any other provisions arising from applicable national legislation, in particular law n°78-17 of January 6, 1978, known as the "IT and Liberties law” (together the " Applicable Regulations "). 

Summary 

1. Who is this Policy for? 
2. Who are the Data Processors?
3. What Contact data do we process?
4. How do we use Contact’s data?
5. On what legal basis do we process data?
6. How is data security ensured?
7. To whom do we disclose data? Who can access your data?
    7.1 Communication and access to the Contacts’ data by employees of Widoowin Entities
    7.2 Access to the Contacts’ personal data by third parties
        7.2.1 Access by service providers
        7.2.2 Access by the Partner of the Widoowin Entities who has integrated your personal data on the M&A SystemTM
        7.2.3 Access by third parties in the course of a transaction
        7.2.4 Other types of communication
8. Transfer of data outside the European Union
9. How long do we keep data?
10. What are your rights?
11. Amendments to the privacy policy
12. How to contact us?

1.  Who is this Policy for?

This privacy policy (hereinafter the " Policy ") applies to any person whose personal data has been inserted into the M&A System (hereinafter the " Contacts " or " you ", " your ", " yours "): 

  • either directly by the Widoowin Entities, when the Contacts are in direct relationship with the Widoowin Entities;

  • or by partners of Widoowin Entities (hereinafter "Partners") with whom the Contacts are in a commercial and/or contractual relationship.

The purpose of the Policy is to provide the best possible information to Contacts on how the Widoowin Entities process and protect their personal data in the context of: 

  • The use of the M&A System by Widoowin Entities and their Partners, which use allows for the initiation and/or completion of cross-border domestic small and mid-cap transactions between Asia and Europe.

  • The execution of the mandate missions entrusted to them.

The Policy is in no way intended to apply to: 

  • to the processing carried out by the Partners of the Widoowin Entities who have a commercial and/or contractual relationship with certain Contacts . Indeed, the Partners each implement their own processing of personal data using the data of the Contacts, for purposes and according to means that they alone determine (whether through their own tools or through the M&A System). To find out more about the processing that Partners may carry out using your data, we invite you to contact them.

  • the processing that is carried out by Widoowin Entities with the personal data of Partners . To learn more about this processing, Partners are invited to consult Article 10.1 of the Partnership Agreement. 

2. Who are the Data Controllers?  

In order to initiate and/or enable cross-border domestic small and mid-cap transactions between Asia and Europe, the Widoowin Group of Companies entities have chosen to pool their resources and use the M&A System centrally and jointly to process your data.

In this context, the Widoowin group entities identified below (" the Widoowin Entities ") act as joint controllers within the meaning of the Applicable Regulation:

Widoowin CF Limited, a limited liability company incorporated under the laws of Hong Kong, registered under the number: 

  • Widoowin CF Limited, a limited liability company incorporated under the laws of Hong Kong, registered under the number 316095 whose registered office is situate at Hollywood Centre, Room 1305, 13F, 233 Hollywood road, Sheung Wan, Hong Kong SAR (hereinafter « Widoowin CF Limited »),

  • WIDOOWIN CORPORATE FINANCE, a simplified joint-stock company, registered with the Business and Companies Registry of Bordeaux under the number 823 984 034, whose registered office is situate at 12 cours de l’Intendance, 33000 Bordeaux, (hereinafter « Widoowin CF FR »), 

You may obtain more information regarding the joint liability agreement between the Widoowin Entities by sending a request to the primary point of contact.

In order to comply with the Applicable Regulations, the Widoowin Entities have entered into a joint liability agreement that accurately reflects their respective roles, obligations, and relationship to the Contacts. Under the terms of this agreement, the Widoowin Entities have jointly decided:

  • To use third-party providers to develop, host and maintain the M&A System;

  • That Widoowin CF FR shall be the sole provider of the data necessary for the proper functioning of the M&A System and the duration of the retention of such data;

  • that Widoowin CF Limited would be the main point of contact and the entity in charge of responding to the requests of the Contacts based on their rights mentioned in Article 10 below;

  •    that Widoowin CF Limited would be responsible for the security and confidentiality of the data

  • collected and processed.

You may obtain more information about the joint liability agreement between the Widoowin Entities by sending a request to the main contact point.


3.  What Contact data do we process?

Widoowin Entities process Contact data that their Partners enter into the M&A System or that they themselves enter into the M&A System in order to initiate or generate transactions.

As indicated above, your data have been inserted into the M&A System: 

  • either directly by Widoowin Entities (with which you have or have had a commercial and/or contractual relationship), who have considered that the insertion of your data on the M&A System would allow them to identify, initiate and/or generate transactions that could be profitable for you;

  • or indirectly by the Partners of the Widoowin Entities who are in a commercial and/or contractual relationship with you (for example, your insurance agent, your banker, your broker, your asset manager, etc.), who have considered that the insertion of your data on the M&A System would make it possible to identify, initiate, and/or generate transactions that could be profitable for you.

Thus, your data is processed in particular during the following operations: 

  • when Widoowin Entities insert your data on the M&A System;

  • when your data is inserted into the M&A System by the Partners of Widoowin Entities;

  • during the adaptation, modification, and/or restructuring of your data by Widoowin Entities;

  • when using some of the functionalities of the M&A System allowing the identification, initiation or generation of transactions (i.e., the " matching " functionality of the M&A System allowing the analysis of the data present in the M&A System in order to identify potential transactions that could be of interest to some of the Contacts present in the platform, in particular the acquisition of a company, the identification of buyers who could be interested in the sale of a company or an asset, the identification of potential partners in the context of a capital increase, etc.);

  • when the Partner and/or Widoowin Entities contact you to propose a transaction that may be of interest to you;

  • when a mandate is signed between you and one of the Widoowin Entities, as well as when all of the operations that follow the signing of this mandate are carried out, including the support provided by one of the Widoowin Entities during due diligence operations, until the prospective conclusion of a transaction;

  • when you contact and/or exchange with the Widoowin Entities by any means.

In this context, Widoowin Entities may, in particular, be required to process the following categories of personal data of Contacts, depending on the data entered in the M&A System: 

  • identity of the Contact: given name, surname, title, date of birth ;

  • Contact's contact details: email address, correspondence address, telephone number and/or

  • mobile phone number;

  • languages spoken, sector of activity concerned, geographical area of activity;

  • professional capacity(ies) or position(s) held, company to which they belong;

  • link to the LinkedIn profile;

  • wechat or WhatsApp ID;

  • interests or intentions expressed by the Contact: e.g. intention to sell, search for partners, search for funds, intention to buy a company or a business, intention to invest in an industry or a company, etc;

  • potential transactions identified;

  • transactions completed; 

If the Contact entrusts a mandate to one of the Widoowin Entities, then the following additional data may be processed: 

  • billing data and financial information in the context of the payment of the remuneration due to one of the Widoowin Entities in the context of the mandate;

  • documentation transmitted in the context of due diligence operations: tax and accounting documentation of the company involved in the transaction, contracts, various policies and procedures, etc.

  • valuation note produced by one of the Widoowin Entities. 

4.  How do we use the Contacts’ data?

The Contacts’ personal data are subject to IT processing and are stored and processed by the Widoowin Entities for the following purposes: 

  • to identify, initiate, and generate transactions that may be of interest to some of the Contacts through the functionalities of the M&A System;

  • in case of interest expressed by the Contact for the transaction suggested by the M&A System for :

    • the signing of a mandate contract between one of the Widoowin Entities and the Contact; o the management of the remunerations due to one of the Widoowin Entities as a result of the mandate's missions and the management of the invoicing and accounting related to these remunerations;

    • the performance of all acts that will be made necessary in the context of the mandate entrusted. The acts and processes implemented by Widoowin Entities shall differ depending on whether the Mandate is a Buy-Side Mandate (“ Buy-side ”) or a Sell-Side Mandate (“ Sell- side ”), a capital raising, or a capital increase (« Funds raising »). They include conducting due diligence, drafting valuation reports, conducting discussions related to a transaction and the final closing of the transaction between the Contact and a third party;

    • responding to all requests from Contacts. 

The Contacts’ personal data are never used for commercial prospecting purposes and are not sold to third parties. 


5.  On what legal basis do we process data?  

The processes implemented by the Widoowin Entities are for some:

  • based on the legitimate interest of the Widoowin Entities (and in particular their economic interest) as long as there is no contractual relationship between one of the Widoowin Entities and the Contact, i.e., prior to the signing of any agency agreement between one of the Widoowin Entities and the Contact: these are the processes implemented thanks to the M&A System to identify, initiate or generate a transaction thanks to the data of the Contacts that are integrated into the M&A System by the Partners and/or the Widoowin Entities. Indeed, these processes, which are intended to analyze the data of the Contacts present in the M&A System in order to initiate and possibly generate transactions, benefits both the Contact and the Widoowin Entities without infringing upon the interests, rights and fundamental freedoms of the Contacts;

  • necessary for the execution of pre-contractual measures or for the execution of the contract binding the Contact to one of the Widoowin Entities when a mandate contract has been signed between one of the Widoowin Entities and the Contact:
    this includes processing for the following purposes:

    • management of the mandate contract and performance of all operations made necessary by the mandate, including performance of due diligence operations, performance of discussions relating to a transaction and the final conclusion of the transaction between the Contact and a third party.

    • processing remunerations due under the mandate;

    • responding to requests for information or generally making contact;

  • necessary to comply with a legal obligation : this includes processing for the purpose of managing invoicing and accounting

6.  How is data security ensured?

Widoowin Entities undertake to take all technical and organizational measures to ensure the protection and security of personal data, in particular against any loss, alteration, distribution, or illegal use.

Widoowin Entities ensure that such measures are implemented for all operations carried out in the context of its processing, and in particular during the collection of personal data, their storage, and their hosting.

In this regard, Widoowin Entities also ensure that the third parties they may call upon (technical service providers, suppliers) comply with this requirement to protect the Contacts’ personal data by implementing appropriate measures, in accordance with Applicable Regulations. 


7  To whom do we disclose data? Who can access your data?

    7.1 Communication and access to Contacts’ data by employees of the Widoowin Entities

The Contacts’ personal data are accessible to the employees, representatives, and managers of the Widoowin Entities, if these persons need to have access to them for the execution of the purposes mentioned in Article 4 above and/or to provide training, support, and assistance services related to the use of the M&A System to the employees of the Widoowin Entities and/or the Partners.

    7.2 Access to the personal data of Contacts by third parties

        7.2.1 Access by service providers

Widoowin Entities may give access to and/or allow processing of the personal data of Contacts by third-party service providers, acting as subcontractors within the meaning of the Applicable Regulations, to perform services relating to the M&A System or more broadly for the processing of the Contacts’ data, and in particular hosting, storage, analysis, data processing, or IT maintenance and support services. These service providers act only on the instructions of Widoowin Entities and will have access to personal data only to perform these services. Widoowin Entities require these service providers hosting and processing your data to take, in accordance with the Applicable Regulations, all organizational and technical measures to ensure a level of security and confidentiality of the personal data of Contacts. 

        7.2.2 Access by the Partner of the Widoowin Entities who has integrated your personal data on the M&A SystemTM

As mentioned above, your personal data may have been integrated into the M&A System by one of the Widoowin Entities' Partners with whom you are in contact and/or in a commercial or contractual relationship.

In this context, the Partner of the Widoowin Entities has access to the personal data that it has itself integrated into the M&A System and the transactions generated through it.

In this regard, it is specified that the Partner of the Widoowin Entities implements its own processing of personal data by means of these data, thus acting as a separate data controller, for purposes and according to means that it alone determines. Widoowin Entities invite you to contact this Partner to obtain precise information on the processing of personal data implemented in this context.  

        7.2.3 Access by third parties in the course of a transaction

Due to the very essence of the activity of the Widoowin Entities, data of Contacts shall be used in the context of the mandate that the latter will have entrusted to one of the Widoowin Entities (depending on whether it is a Buy-Side (“Buy-Side”) or Sell-Side Mandate (“Sell-Side”) , or a capital raising, or a capital increase (“Funds Raising”) in order to allow the third party to analyze a certain number of documents and data in order for the Contact to decide whether or not to conclude the transaction. These third parties have access to the necessary information about the Contacts in the context of the transaction, but they do not have access to the M&A System. 

        7.2.4 Other types of communication

In addition, Contacts’ personal data may be shared with third parties for the following reasons

  • i n the context of a merger, acquisition, or sale of all or part of the assets of the Widoowin Entities, which the Contact hereby acknowledges having been informed of;

  • in response to a judicial or administrative procedure of any kind or to law enforcement measures requested by the competent authorities;

  • to comply with legal obligations, to protect the rights and/or safety of an individual, to protect the rights and property of Widoowin Entities, including the need to prevent fraud, security, or technical issues.

8. Transfer of data outside the European Union

The M&A System, which processes and stores the Contacts' data, is hosted in France on secure servers provided by third party service providers. The M&A System is subject to maintenance and support services provided by third-party providers also operating from the European Union.

However, insofar as some of the Widoowin Entities and one of the Widoowin Entities' service providers are established in Hong Kong, Contacts’ data may be accessible from Hong Kong, which, in certain cases, constitutes a transfer of data within the meaning of the Applicable Rules.

In order for these data transfers outside the European Union to comply with the Applicable Regulation, in particular Article 46 of the GDPR, the Widoowin Entities have put in place appropriate safeguards, namely the signing of standard contractual clauses between the Partners and Widoowin CF Limited, as well as between the Widoowin Entities (based on the model approved by the European Commission available via the following link:  https ://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en) . 


9.  How long do we keep data?

Widoowin Entities shall only keep the personal data of Contacts for a limited period of time, necessary for the realization of the purposes for which they were collected and processed in accordance with the description in Article 4 of this Policy. This duration is determined according to the nature of the data in question, the purpose of the processing concerned, the legal obligations applicable in each country in which Widoowin Entities are established, as well as the applicable prescription periods that vary in each country according to the data and the purposes of the processing.

The Contacts’ personal data are kept for the following periods:

  • for data of Contacts with whom a mandate contract has been entered into:

    • data necessary for the execution of the mandate are kept for the duration of the mandate. They are then archived in accordance with the applicable limitation periods (in France, this period is five years, in Hong Kong, it is 10 years);

    • data necessary for invoicing and accounting purposes are kept for the period set by the applicable legal obligations (in France and Hong Kong this period is ten (10) years);

  • for Contacts with whom no mandate contract has been entered into:

    • Contacts’ data inserted by Partners on the M&A System are kept for the entire period during which the Partner maintains a contractual relationship with the Widoowin Entities and uses the M&A System. At the end of the contractual relationship between the Widoowin Entities and the Partner, the Contact’s data are deleted;

    • Contacts’ data inserted by the Widoowin Entities on the M&A System are kept for the entire period during which the Widoowin Entity maintains a commercial relationship with the Contact. At the end of the commercial relationship between the Widoowin Entity and the Contact, the Contact's data are deleted; 


10.  What are your rights?

In accordance with the Applicable Regulations, as a Contact whose data is inserted in the M&A System and, more generally, as a principal entrusting a specific mandate to one of the Widoowin Entities, you have the following rights regarding your personal data:

  • right to information: you have the right to obtain clear, transparent, understandable and easily accessible information on how Widoowin Entities use your personal data and on your rights. This is why we provide you with the information in this Policy.

  • right of access: you have the right to access the personal data that Widoowin Entities have about you (provided that the request is not manifestly unfounded or excessive, in particular because of its repetitive nature), and to obtain a copy thereof. If you wish to access the data that Widoowin Entities holds about you, please contact us at the address specified below.

  • right of rectification: you have the right to request that your personal data be rectified if it is inaccurate or out of date and/or that it be completed if it is incomplete (provided that the request is not manifestly unfounded or excessive, in particular because of its repetitive nature). If you wish to modify your personal data, you can contact us at the address specified below

  • right to deletion: in some cases, you have the right to have your personal data erased or deleted. This is not an absolute right, as we may be required to retain your personal data for legal or legitimate reasons. If you would like us to delete your data, please contact us using the details below.

  • right to restrict processing: this right means that our processing of your data is restricted, so that we can keep the data, but we cannot use or process it. This right applies in specific circumstances, namely:

    • In cases where the accuracy of the personal data is disputed by the data subject (i.e. you). Processing is then restricted for a period of time to allow the Entities to verify the accuracy of the personal data;

    • In cases where the processing is unlawful and the data subject (i.e. you) objects to the deletion of the personal data and demands instead the restriction of their use;

    • In cases where the Widoowin Entities no longer need the personal data for the purposes of the processing, but the data are still necessary to the data subject for the establishment, exercise or defence of legal claims;

    • In cases where the data subject (i.e. you) has objected to the processing on the basis of the legitimate interests pursued by Widoowin Entities during the verification regarding whether the legitimate grounds pursued by Widoowin Entities prevail over those of the data subject or not.

If you wish to obtain the limitation of the processing, please contact us at the address specified below.

  • the right to object to the processing of your personal data when the processing is based on the legitimate interests of Widoowin Entities (to determine what processing is involved, please refer to Article 5 of this Policy): you may at any time object to the processing of your personal data on grounds relating to your particular situation, unless Widoowin Entities assert compelling legitimate grounds for the processing of such data that override your interests, rights and freedoms, or where such data is necessary for the establishment, exercise or defence of legal claims. If you wish to exercise your right to object or obtain more information on how to exercise this right, please contact us using the details below. 

  • right to data portability: you have the right to receive the personal data concerning you that you have provided to Widoowin Entities, in a structured, commonly used and machine- readable format. This applies only to data that you have provided directly or indirectly and only when the processing is based on your consent or the performance of a contract and is carried out using automated processes. We invite you to consult the list of legal bases for our processing of personal data (please refer to Article 5 of this Policy) to find out whether our  processing is based on a contract or on consent. To exercise your right to data portability or to obtain further information, please contact us using the details specified below.

  • If you are a Contact residing in France, you have the right to send Widoowin Entities specific instructions concerning the fate of your personal data after your death.

  • right to lodge a complaint with a supervisory authority : you have the right to lodge a complaint with the data protection authority in your country (https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm) to challenge the practices of Widoowin Entities in terms of personal data protection and respect for privacy. However, we invite you to contact us at the contact details specified below before lodging any complaint with the competent data protection authority.

To exercise all these rights, you can send a request by e-mail to the following address:  RGPD@Widoowin.com

This address is the main contact address that the Widoowin Entities have set up in order to facilitate the exercise of your rights and more generally to answer any question you may have about the processing of your data.

In accordance with the Applicable Regulations, you may also exercise your rights directly with each of the Widoowin Entities acting as joint data controllers, by sending a request to the correspondence address of each of the entities listed in Article 2 of the Policy. 

11.  Amendments to the privacy policy

This Policy may be amended by Widoowin Entities at any time. In this case, the date of the Policy update shall be updated and shall indicate the day on which the amendments were made.

If Widoowin Entities make material amendments, the Partners shall be notified by means of a notice on the home page of the M&A System, and the Partners may then communicate a new version of this Policy to their respective Contacts whose contact information is included in the M&A System. 

12.  How to contact us?

As indicated in article 2 above, should you have any questions or comments regarding this Policy, or regarding Widoowin Entities' use of your data, you may contact the following address:
WIDOOWIN CORPORATE FINANCE, RGPD, 12 cours de l’Intendance, 33000 Bordeaux