Privacy notice

Sale Prospectus is a service operated by THINKERZ LTD (trading as Thinkerz Consulting). THINKERZ LTD acts as a data controller for its website, enquiries, business administration, its own customer contacts and legal records. Where an accountant, broker or other adviser instructs us to process client-supplied personal information solely on their documented instructions, that adviser may be the controller and THINKERZ LTD the processor for that particular work. The parties’ roles, authorised purposes, processing instructions, permitted recipients, sub-processors and arrangements for return or deletion must be recorded in the written engagement and, where applicable, a data-processing agreement before substantive client data is supplied. An enquiry alone is not such an agreement. If someone else supplied your information, contact us to ask about its source or the instruction.

We collect enquiry and contact details; account and project assignment information; business, ownership, employee and financial information supplied through the fact-find; supporting files; draft documents; and correspondence. Information may come from you, the business owner, an authorised contributor or the commissioning adviser. The hosting platform also processes technical and security information needed to operate the service. The public enquiry form uses Cloudflare Turnstile to check for automated abuse; Cloudflare processes browser and device signals for this security check.

We use contact information to respond to business enquiries and manage professional relationships, relying on our legitimate interests. Where an individual asks us to take steps towards, or perform, a contract with that individual, we rely on contractual necessity where applicable. For company client contacts and authorised contributors, our legitimate interests include administering the instruction and preparing the commissioned documents. Security and misuse prevention are also legitimate interests. We rely on legal obligations where applicable to tax, accounting or other required records. A privacy acknowledgement is not marketing consent.

Provide information you are authorised to disclose. Use role descriptions and customer or supplier references where names are unnecessary. Avoid health information, identity documents, bank credentials and other sensitive personal information. Redact payroll and contract uploads where possible. If a matter needs particularly sensitive information, agree an appropriate handling process before uploading it.

Public visitors are not given access to enquiries or client project records. Authorised administrators can access the preparation workspace; an invited contributor is assigned to a specific project and can access its fact-find and related files. Drafts and outputs are shared only with appropriate recipients as agreed for the assignment. We use Base44 for the application platform, authentication, hosted records, private document storage and integrated services, including transactional email and optional AI assistance. We use Cloudflare Turnstile for public enquiry abuse prevention. These providers and their authorised sub-processors may handle relevant information in providing those services. We do not sell personal information or use client submissions as a public portfolio. Brand logos intentionally uploaded for document display are public assets; client supporting files are not.

Logos uploaded through Brand settings are stored as public image assets so they can appear on covers and in previews. They should contain only material approved for that use. This is separate from supporting accounts, contracts and other project files, which use private storage and project access controls. Do not use logo uploads to store confidential documents or personal records.

The document-production system includes an optional administrator-initiated drafting feature that submits selected, relevant fact-find answer material to Base44’s AI integration to suggest unverified narrative text. The feature is not automatically triggered by an enquiry or contributor submission; the administrator must first acknowledge source review and authority for the selected information. Supporting document files and internal notes are not attached to this narrative request. AI suggestions are not final documents: they require human review and explicit application, and the original fact-find answers are preserved. Before using the feature for an adviser-controlled instruction, we must establish that the commissioning party has authorised this processing and that applicable data-processing terms permit it. If this is not authorised, the assignment must be prepared without that AI feature.

Our application uses services provided by Base44 and may involve access to or processing of information outside the United Kingdom, including by authorised sub-processors. We do not represent the service as UK-only hosting. Base44 publishes its data-processing agreement, including cross-border transfer provisions, at https://base44.com/about-us/legal/dpa. The published agreement describes lawful transfer mechanisms such as adequacy arrangements and approved contractual safeguards where applicable; a published provider policy is not, by itself, verification of every transfer for a particular assignment. For a commissioning adviser with specific data-residency, sub-processor or restricted-transfer requirements, those requirements must be assessed and addressed in writing before client materials are uploaded. Contact us to discuss the applicable arrangements.

We do not apply the same retention period to every category of information. Enquiries that do not proceed are held only while reasonably needed to respond, manage related correspondence and establish or defend a claim. For an accepted instruction, fact-find records, supporting documents, drafts and correspondence are retained for the time needed to carry out and close the engagement, meet any agreed handover or support period, and address relevant legal claims. Accounting, payment and statutory records may need to be kept separately for applicable legal periods. Retention is determined by those purposes rather than by indefinite use of the contributor account. The specific project retention and return/deletion requirements, including private files and working drafts, must be set out in the written engagement where we act on an adviser’s instructions. There is not currently a published fixed automatic deletion period for every project record, and deleting a visible record may not immediately remove provider backups. You can contact us to ask what information remains, the retention criteria applicable to your instruction, or to request deletion where legally appropriate.

Depending on the circumstances, you may request access, correction, erasure, restriction or a portable copy of relevant personal information. You may object to processing based on legitimate interests, including on grounds relating to your particular situation. Where processing relies on consent, you may withdraw that consent. Rights are subject to legal conditions and are not absolute. Email hello@saleprospectus.co.uk to make a request.

Please contact hello@saleprospectus.co.uk with privacy concerns. You can also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.

Sign-in and essential application functions use cookies or browser storage to maintain access and operate the service. Browser controls can restrict or clear this storage, but doing so may prevent sign-in or interrupt application functions. Any additional analytics, advertising or other storage technology must be assessed against the applicable rules and, where required, a choice or consent mechanism configured before use. The preparation service does not make legally significant decisions about individuals solely by automated processing.

Contact hello@saleprospectus.co.uk or write to Thinkerz Ltd at the registered office below. This notice may be updated as the service and documented processing arrangements develop.