Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Westfälische Corporate Finance GmbH
Mathias Westerbarkei
Am Lotteberg 26
33790 Halle (Westfalen)
Phone: +49 (0) 5201 / 73 43 073
Email: mathias.westerbarkei@westfaelische-corporate-finance.de

As a rule, we process personal data of our users only to the extent necessary to provide a functional website and our content and services. We state the respective legal basis in the following sections. We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations.

As a data subject, you have the following rights:

• Right of access (Art. 15 GDPR): You have the right to request information about your personal data processed by us.
• Right to rectification (Art. 16 GDPR): You have the right to request the rectification of inaccurate personal data or the completion of your personal data stored by us.
• Right to erasure (Art. 17 GDPR): You have the right to request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.
• Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data.
• Right to data portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR): You have the right to object to the processing of your personal data at any time.
• Right to withdraw consent (Art. 7(3) GDPR): You have the right to withdraw any consent you have given at any time.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW, State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia).

Each time our website is accessed, our system automatically collects data and information from the accessing computer. The following data is collected:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• IP address
• Time of the server request

The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR.

Our website is hosted on Microsoft Azure (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). When the website is accessed, the hosting provider processes, on our behalf, the data listed under “Provision of the website and creation of log files” (Section 4). We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR.

Our website does not use cookies or any analytics or advertising services. For this reason, we do not ask for consent when you visit.

Only if you use the chat does your browser store a random identifier of the conversation in session storage (Section 8). It is deleted when you close the tab. This storage is strictly necessary for the service you have requested (§ 25(2) no. 2 TDDDG).

We only load the Microsoft booking calendar when you request it with a click on the contact page (Section 10).

If you send us enquiries via the contact form, the details from the enquiry form, including the contact details you provide there, are stored by us for the purpose of processing the enquiry and in case of follow-up questions. The forms transmit your details to us by email via Microsoft 365 (Microsoft Ireland Operations Ltd., Section 5); you receive a confirmation of receipt at the address you provided. We do not pass on this data without your consent.

The data entered in the contact form is processed on the basis of your consent (Art. 6(1)(a) GDPR) or on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

On our website, we offer an AI-supported chat in which you can ask general questions about M&A, business valuation and our services. The chat only begins after you have actively started it with a click.

The answers are generated by a language model that we operate on our own hardware in Germany. Your questions are not transmitted to external AI providers and are not used to train AI models. The answers are general information without guarantee and are no substitute for advice or an offer.

In doing so, we process the text of your questions, the answers, the page visited and the time. This data is held only in the working memory of the server on which this website runs (Section 5) and is deleted after two hours at the latest. To provide an answer, our own computer in Germany retrieves the question in encrypted form and passes it to the language model; questions and answers are not stored there either. We do not store your IP address; to prevent misuse, we derive from it an irreversible hash value with which the number of questions per sender can be limited. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by starting the chat.

So that answers are matched to the right question, your browser stores a random identifier of the conversation in session storage for the duration of your visit; it is deleted when you close the tab. This is strictly necessary for the chat you have requested (§ 25(2) no. 2 TDDDG). The chat does not set any cookies.

Please do not enter any personal data of third parties or any confidential company data in the chat. Optionally, you can forward the chat history to us together with your name and email address so that we can contact you. This transmission only takes place at your express request (Art. 6(1)(a) and (b) GDPR); we then process it like an enquiry via the contact form (Section 7).

We evaluate the Sale Readiness Check entirely in your browser. Your answers are not transmitted to us and are not stored.

Only if you expressly send your result to us at the end do we transmit your answers, together with your name, email address and the voluntary details (phone, company), to our transaction portal, which is also hosted on Microsoft Azure (Section 5). We use this data exclusively to process your enquiry and to get in touch with you. The legal basis is your consent (Art. 6(1)(a) GDPR) and the performance of pre-contractual measures (Art. 6(1)(b) GDPR). You can withdraw your consent at any time with effect for the future.

To arrange meetings, we embed the Microsoft Bookings service of Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, on the contact page. If you book an appointment via the booking window, Microsoft processes the data you enter (name, email address, selected appointment, optional details) on our behalf. Processing by Microsoft in third countries is possible; it takes place on the basis of the EU Standard Contractual Clauses and the EU-US Data Privacy Framework. The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR).

The calendar is only loaded when you click “Load calendar” on the contact page. Only then does your browser connect to Microsoft, transmitting technical data such as your IP address. By clicking, you consent to this transmission (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without a click, no connection to Microsoft Bookings is made.

When you register as an investor, partner, successor or MBI candidate, we collect the data provided in the respective form. It is stored in our transaction portal, which is hosted on Microsoft Azure (Section 5). The processing is carried out for the performance of pre-contractual measures (Art. 6(1)(b) GDPR) and on the basis of our legitimate interest (Art. 6(1)(f) GDPR). The data is not passed on to third parties unless you give your express consent to this.

During your visit to the website, we use the widely adopted TLS protocol (Transport Layer Security) in conjunction with the highest level of encryption supported by your browser.

This privacy policy is currently valid and is dated October 2026. As a result of the further development of our website or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy.