Privacy Notice

Last updated: 3 November 2026

1. Who we are

Sequence Advisers LLP is a corporate finance advisory firm registered in England and Wales under number OC411948 and authorised and regulated by the Financial Conduct Authority under reference 768168. Henrietta Street Capital is a trading name of Sequence Advisers LLP. In this policy, “we”, “us” and “our” refer to Sequence Advisers LLP, including when we operate under that trading name.

We are normally the controller of the personal data described in this policy, meaning that we decide why and how it is used.

Our privacy contact is the partner responsible for data protection. You can contact us at contact@sequenceadvisers.co.uk or write to Sequence Advisers LLP, Floor 3, Orion House, 5 Upper St Martin’s Lane, London WC2H 9EA.

This policy covers our website, corporate finance services, professional relationships, buyer and investor databases, marketing and recruitment. It applies to clients, prospective clients, transaction participants, professional contacts, suppliers, applicants and website visitors. Separate privacy information applies to employment and partnership relationships where appropriate.

We handle personal data under the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended. We also take account of other applicable data protection and marketing laws. Our GDPR Policy explains your rights and how to exercise them.

2. The information we collect

We collect information relevant to our relationship with you. This may include:

• Identity and contact information: names, titles, email addresses, telephone numbers, postal addresses, signatures and identification documents where verification is needed.
• Professional information: employers, roles, qualifications, employment history, directorships, ownership interests and authority to act for an organisation.
• Buyer and investor information: acquisition criteria, investment interests, sector and geographic preferences, relevant transaction history and records of discussions and introductions.
• Client and transaction information: shareholdings, management arrangements, relevant financial information, offers, negotiations, correspondence, due diligence materials and transaction documents.
• Compliance information: identity and beneficial ownership checks, nationality and residence, source of funds or wealth, politically exposed person status, sanctions results and information relevant to conflicts or financial crime.
• Administrative information: invoices, bank and payment details, supplier records, meeting notes and records relating to complaints or legal claims.
• Marketing information: the source of your details, requests for updates, interests, permissions, objections, delivery results and engagement information where tracking is used.
• Recruitment information: applications, CVs, qualifications, references, interview notes and right-to-work information.
• Website and security information: IP addresses, browser and device information, pages visited, referring pages, approximate location, cookie identifiers, consent choices and information used to identify automated form abuse.

A business email address or public professional profile can still be personal data. Corporate information that does not relate to an identifiable individual falls outside data protection law, although professional confidentiality obligations may still apply.

3. Where information comes from

We obtain information directly from you through conversations, meetings, emails, website forms, applications and other communications. If you ask to hear about our deals, we may manually add your details to our mailing list.

We also obtain information from clients and prospective clients, target companies, employers, colleagues, transaction participants, professional advisers, intermediaries, referees and recruitment agencies. Other sources include Companies House, the FCA Register, company websites, professional networking sites, press reports and commercial business-information or verification providers.

Website technologies and service providers may generate technical information when you visit our website or interact with communications.

Where we obtain personal data indirectly, we provide the required privacy information within the applicable period: normally within one month, and earlier at our first communication or first disclosure where required. We rely on an exception only where it applies, for example if you already have the information or a specific legal restriction prevents disclosure.

4. Why we use information and our lawful bases

Our purposes and lawful bases include:

• Enquiries and prospective engagements: taking steps you request towards a contract where you are the prospective individual client; otherwise our legitimate interests in responding to enquiries and developing professional relationships.
• Advisory services and transaction work: performing a contract with you as an individual where necessary; otherwise our and our clients’ legitimate interests in obtaining and providing corporate finance services and completing transactions.
• Buyer and investor research: our and our clients’ legitimate interests in identifying suitable counterparties, maintaining professional relationships and assessing relevant opportunities, subject to applicable marketing rules.
• Compliance and verification: legal obligations that apply to identity, financial crime, tax, accounting or regulatory checks; and legitimate interests in proportionate risk management and fraud prevention for checks beyond those obligations.
• Fees and administration: contract where the contract is with you, applicable legal obligations, and legitimate interests in collecting fees and maintaining necessary business records.
• Marketing: consent for updates where we rely on your opt-in or the law requires it; otherwise legitimate interests in relevant professional communications where permitted. The additional rules in section 7 apply.
• Recruitment: taking steps at your request towards an employment contract, legitimate interests in assessing candidates, and applicable legal obligations such as right-to-work checks.
• Website operation, security, complaints and claims: legitimate interests in operating and protecting our services, resolving concerns and establishing, exercising or defending legal rights, together with applicable legal obligations.
• Optional tracking: consent where required for website analytics or email engagement tracking. Any reliance on a statutory exception is assessed separately and does not authorise unrelated tracking or advertising.

We use the contract basis only where the individual concerned is a party to the contract or has requested relevant pre-contractual steps. A contract with your employer does not, by itself, provide that basis for your personal data.

Where we rely on legitimate interests, we assess the purpose, necessity and effect on your rights and reasonable expectations. We do not rely on this basis where those interests are overridden by your rights. You may ask about the relevant assessment and object to the processing.

Some information is required by law or is necessary to consider or provide services, complete verification, assess an application or perform contractual obligations. Without it, we may be unable to proceed. We explain relevant requirements when appropriate. Optional marketing or tracking permission is not a condition of making an enquiry or receiving our services.

5. Transactions and buyer and investor databases

Our work includes sales and buyouts, acquisitions, investments and fundraising. We use professional information to identify relevant parties, assess commercial fit, communicate about mandates and manage introductions and negotiations. We may match acquisition or investment criteria to opportunities using professional judgement.

Transaction records and data rooms may contain information about people who are not our clients, including employees, directors and shareholders of target companies. We limit the information used and disclosed, consider anonymisation or aggregation, restrict access and use confidentiality arrangements where appropriate. Confidentiality agreements do not replace other data protection requirements.

We distinguish necessary service or transaction correspondence from promotional communications. An email about a deal can still be direct marketing, depending on its content and purpose.

We do not currently make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. Substantive advisory, recruitment and transaction decisions involve human judgement. If this changes, we will provide the required information and safeguards.

6. Sensitive information and criminal offence data

We do not routinely request special category information, such as health, ethnicity, religion, political opinions, trade union membership or information about sexual life or orientation. Such information may nevertheless arise in recruitment, legal matters or due diligence. Criminal offence information, including relevant allegations, may arise in compliance checks or legal matters.

We process these categories only where necessary and where an applicable additional legal condition is met. Depending on the activity, this may include employment-law obligations, legal claims, an applicable substantial-public-interest condition with its required safeguards, or explicit consent where appropriate. Criminal offence information requires official authority or an applicable condition under the Data Protection Act 2018. We maintain an appropriate policy document where required.

An ordinary commercial transaction or legitimate interest alone does not authorise this processing. We seek to exclude or redact unnecessary sensitive information. Please do not send it through our general enquiry form unless we have requested it and arranged an appropriate method.

7. Deal updates and marketing

We use contact details for relevant deal announcements, corporate finance insights, news and invitations. People may request updates through a signup process or during a conversation. We use Mailchimp, provided by The Rocket Science Group LLC, an Intuit company, to manage and send mailing-list communications.

For our Mailchimp mailing-list updates, we rely on your request or opt-in for the described communications. For other relevant communications to corporate subscribers, we may rely on legitimate interests where permitted. Corporate subscribers include limited companies, limited liability partnerships and Scottish partnerships. Status depends on the organisation and subscription, not simply the appearance of the email address.

Sole traders, many unincorporated partnerships and people using personal subscriptions generally require prior consent for unsolicited marketing emails unless every condition of an applicable exception is met. We do not treat a conversation, business card, public listing or contacts-database entry as consent by itself.

You can unsubscribe through the link in a marketing email or contact contact@sequenceadvisers.co.uk. Your right to object to use of your personal data for direct marketing, including related profiling, is absolute. We will stop that use. We do not replace withdrawn consent with legitimate interests to continue the same activity.

We retain limited suppression information to respect opt-outs and prevent inappropriate reintroduction. An opt-out does not prevent separately necessary administrative, regulatory or transaction communications, but those must not be used to circumvent your choice.

Mailchimp records delivery, bounces and unsubscribes. Our campaigns have also used recipient-level open and click tracking. Invisible images and tracked links can record whether and when an email is opened or a link clicked, with associated technical information such as IP-derived location and email-client information. We use engagement information to assess communications and relevance. Optional tracking is separate from sending an email and is subject to applicable consent requirements. A request for deal updates does not automatically authorise it. Privacy tools and automated systems can affect the accuracy of engagement measurements. You can contact us about this processing, withdraw any relevant consent or object to direct marketing and related profiling.

8. Cookies and website technologies

Cookies are small files stored on a device. Similar rules can apply to browser storage, pixels, scripts and other technologies that store or access information on a device.

Our WordPress website includes form-handling software, the Google tag and Google Analytics 4 for measurement, embedded Google Maps for our location, and Google reCAPTCHA for protection against automated form abuse. Some presentation resources and images are delivered by external content providers, including a Mailchimp-hosted image. External requests can disclose technical information such as IP address, browser information and the referring page.

We use Cookiebot by Usercentrics to present and record choices. The banner offers Allow all, Deny and Customize. Optional preferences, statistics and marketing categories initially appear switched off in the consent panel. Use the cookie-settings widget to review your recorded choice, change it or withdraw consent.

Cookiebot normally uses a first-party CookieConsent cookie to remember choices, with a provider-documented duration of up to 12 months. Browsers may remove it earlier. Consent management involves technical information, consent choices, the time recorded and a consent identifier. We use these records to respect choices and demonstrate compliance, based on applicable legal obligations and legitimate interests in managing consent. Cookiebot’s published terms describe consent-log retention of 12 months.

Google Analytics cookies can include _ga and _ga_8E2EH2EFCV, used to distinguish visitors and maintain session state. Google documents a default lifetime of two years, which can be configured differently and may be refreshed by subsequent use. Google Maps and reCAPTCHA can involve additional Google cookies or storage. The banner’s Details tab displays published cookie-scan information. You may also contact us for information about our technologies.

Embedded Maps may connect to Google when the page or map loads, even without interaction. reCAPTCHA analyses device and interaction information to help distinguish genuine form users from automated abuse.

Strictly necessary technologies may operate without consent. Other non-exempt storage or access requires prior consent. Limited statistical and appearance exceptions have specific conditions, including clear information and a simple, free means of objection; they do not provide general permission for advertising or individual profiling.

You can also block or delete cookies through your browser. Deleting a consent-preference cookie may remove your saved choice. Browser controls supplement the website’s controls. Further information is available from Google and Cookiebot.

9. Who receives information

Where necessary, recipients may include our partners and staff; clients and prospective clients; target companies and management teams; purchasers, investors, sellers, lenders and other transaction participants; lawyers, accountants and due diligence advisers; banks, insurers and auditors; recruitment agencies and referees; and courts, regulators, law enforcement bodies and public authorities, including the FCA and HM Revenue & Customs.

We use providers of hosting, IT support, cloud storage, communications, CRM, marketing, data rooms, verification, consent management and security services. Where a provider acts as our processor, we require appropriate processing terms and safeguards. Providers may be controllers for separate activities described in their own notices. Professional advisers, regulators and transaction participants often act as independent controllers.

If an engagement requires us to act solely on a client’s documented instructions as a processor, we agree the required terms and handle that information accordingly.

We do not sell personal data as a product. We may disclose relevant information concerning a restructuring or transfer of our business, subject to appropriate safeguards. Public deal announcements are limited to information that it is lawful and appropriate to publish.

10. International transfers

Our work and service providers may involve processing outside the United Kingdom, including the United States. Mailchimp processes mailing-list data in the United States. As checked on 3 November 2026, the official Data Privacy Framework register lists The Rocket Science Group d/b/a Mailchimp under Intuit’s active UK Extension certification, including non-HR data. We use this adequacy arrangement for covered transfers and keep its applicability under review.

For transfers restricted by UK law, we use a permitted mechanism. This may be applicable UK adequacy regulations; the UK International Data Transfer Agreement or an approved UK Addendum to the European Commission’s standard contractual clauses, with required assessments and supplementary safeguards; or a statutory exception where its conditions are met.

We consider the recipient, destination, information and safeguards. You may contact us for information about a relevant transfer and a copy or description of safeguards, subject to lawful redaction of confidential information. Where EU GDPR transfer rules also apply, we address them separately.

11. How long we keep information

We retain information for as long as necessary, taking account of its purpose, legal and regulatory obligations, accuracy, confidentiality and potential claims. Our normal periods and criteria are:

• Client, engagement and transaction records: seven years after the engagement or transaction ends, unless a different rule applies.
• Records collected under the Money Laundering Regulations: normally five years after the business relationship ends or an occasional transaction completes, subject to regulation 40. Personal data is deleted at the required point unless a statutory exception permits continued retention.
• Other compliance and regulatory records: normally seven years after the relationship or matter ends, subject to applicable rules and earlier-deletion requirements.
• Invoices and accounting records: normally seven years after the relevant accounting period.
• Prospective client and buyer or investor relationship records: normally three years after the last meaningful contact, unless a continuing relationship or another documented reason justifies retention.
• Marketing records and permission evidence: while the subscription and information remain relevant, and for any further period necessary to demonstrate compliance or address a specific complaint or claim.
• Suppression records: limited information for as long as reasonably necessary to honour an objection and prevent inappropriate further marketing.
• Unsuccessful recruitment applications: normally six months after the recruitment exercise, unless a longer period is agreed or required for a specific legal reason.
• Website and security information: periods determined by the security or diagnostic purpose, sensitivity and any incident or legal requirement. Cookie durations depend on the technology and configuration; section 8 explains relevant provider defaults.

We may preserve particular records for an investigation, dispute or legal requirement where permitted. A general seven-year policy does not override mandatory earlier deletion. At the end of the applicable period, information is securely deleted or anonymised. Residual backups remain protected and are removed through the applicable secure backup cycle.

12. Security

We use appropriate technical and organisational measures, including access restrictions, secure account and device controls, appropriate encryption, confidentiality obligations, staff awareness, secure sharing, continuity arrangements and incident management, according to the nature and risk of the processing.

Access is limited to people who need information for legitimate professional, operational or legal purposes. We assess personal data breaches and notify the regulator and affected individuals where required. No internet service or storage system can guarantee absolute security.

13. Your rights and complaints

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. You can withdraw consent without affecting the lawfulness of earlier processing. Your direct-marketing objection is absolute; other rights may be subject to legal conditions or exemptions.

Our GDPR Policy explains these rights and how to make a request. You can also email contact@sequenceadvisers.co.uk or write to the address above. Requests are normally free, and we respond without undue delay and normally within one month, subject to legally permitted extensions or adjustments.

You can complain to us using those details. We acknowledge data protection complaints within 30 days, investigate appropriately without undue delay, keep you informed and communicate the outcome without undue delay. You also have the right to complain to the Information Commissioner’s Office without first completing our complaints process.

14. Changes to this policy

We review this policy when our activities, technologies or legal requirements change. The current version is published with its update date. Where required, we give further notice of a material change or seek a new choice before changing a use based on consent.