Shawpoint Ltd
Privacy Notice
Last updated 20 October 2026
This notice explains how Shawpoint uses personal data about the people we deal with: clients and prospective clients, buyers, investors and other parties to transactions, their advisers and representatives, consultants and suppliers, job applicants and visitors to our website. Our staff receive a separate notice.
1. Who we are
Shawpoint Ltd (company number 10580815, registered office Suite 16, Beaufort Court, Admirals Way, Canary Wharf, London E14 9XL) (“Shawpoint”, “we”, “us”) is a corporate finance adviser authorised and regulated by the Financial Conduct Authority (FRN 948057). We are the controller of your personal data. ICO registration number: ZA577909.
For any question or request about your personal data, contact Jon Shaw at info@shawpoint.com.
2. What we collect
- Contact and professional details: name, job title, employer, business email, telephone and address.
- Our communications, meeting notes and call recordings, and information about engagements and transactions you are involved in.
- Identity and verification information for anti-money laundering and sanctions checks.
- For job applicants: CV, qualifications, nationality and right-to-work documents, references and background check results, including criminal records checks for roles where the FCA requires them.
- Website data collected by cookies, such as IP address, browser and device type and pages visited.
We do not ask for special category data (such as health information) unless it is necessary and the law allows it, for example to make adjustments for an interview.
3. Where we get it
Mostly from you. We also obtain personal data from your employer or colleagues, our clients, other parties and advisers on a transaction, public sources (such as Companies House, company websites, LinkedIn and the press), subscription databases, identity verification and screening providers, referees and background check providers, and our website.
4. Why we use it
| What we use it for | Lawful basis |
|---|---|
| Advising our clients and running engagements and transactions; dealing with our suppliers and consultants | Contract, where you are our client or supplier. Otherwise our legitimate interest in delivering our services, for example where you represent a client, a counterparty or another adviser |
| Identifying and contacting potential buyers, investors, targets and other counterparties, and managing these relationships in our CRM | Our legitimate interest in sourcing suitable counterparties for our clients’ transactions |
| Sending you news, insights and event invitations in your business capacity | Our legitimate interest in marketing our services. Where the law requires consent for electronic marketing, we ask for it first. Every email contains an unsubscribe link |
| Anti-money laundering, sanctions and identity checks; FCA, tax and other regulatory obligations; responding to regulators and authorities | Legal obligation. Criminal offence data is used only where the Data Protection Act 2018 permits |
| Recruitment, including right-to-work checks and, for FCA-regulated roles, regulatory references and criminal records checks | Steps before entering into an employment contract; legal obligation (including the FCA’s fitness and propriety requirements); our legitimate interest in recruiting suitable people. Criminal records and health information are used only where the Data Protection Act 2018 permits |
| Running and improving our website | Our legitimate interest in operating our website; your consent for non-essential cookies (see section 8) |
| Preventing and investigating misconduct, and establishing, exercising or defending legal claims | Our legitimate interest in protecting our business and complying with our policies |
Where we need information to meet a legal obligation (for example, identity checks) or to enter into a contract with you and you do not provide it, we may be unable to act for you or progress your application. We do not make decisions about you based solely on automated processing.
5. Who we share it with
- Service providers acting on our behalf, including our CRM provider (Copper), IT, email and hosting providers, website analytics (StatCounter), the website contact form (Formspree), call recording (Grain), AI tools, virtual data room, identity verification and background check providers.
- Our professional advisers, auditors and consultants, and other Shawpoint group companies.
- Other parties to a transaction and their advisers, such as prospective buyers or investors, where needed to run the transaction and normally under a confidentiality agreement.
- The FCA, HMRC, the National Crime Agency, courts and other authorities where the law requires it.
- A buyer of, or successor to, our business.
We do not sell personal data.
6. International transfers
Some of our service providers, including our CRM provider, and our Hong Kong group company store or access data outside the UK, including in the United States and Hong Kong. Where the destination does not have UK adequacy status (including, for certified US recipients, the UK-US Data Bridge), we use approved safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Prospective buyers, investors and their advisers may also be based outside the UK. Where we share data with them, we use similar safeguards or rely on an exception the law allows. Contact us for more information or a copy of these safeguards.
7. How long we keep it
We keep personal data only as long as we need it. In general:
| Records | Kept for |
|---|---|
| Client, engagement and transaction records | Six years after the engagement ends, or longer where FCA rules or a legal claim require it or the FCA asks us to |
| Anti-money laundering records | Five years after the end of our business relationship, as the Money Laundering Regulations require |
| Marketing and relationship contacts | Until you ask us to stop, or three years after our last meaningful contact with you |
| Unsuccessful job applications | Six months after the role is filled. Successful applicants’ data moves to their staff file |
| Website analytics data | 14 months |
8. Cookies
We use strictly necessary cookies to run our website and remember your cookie choices. We only use other cookies, such as StatCounter’s visitor statistics, if you accept them through our cookie banner. You can change your choice at any time using the “Cookie settings” link at the foot of each page, and you can delete cookies through your browser settings. StatCounter’s use of data is described in its own privacy policy.
9. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to our use of it, to receive data you gave us in a portable format, and to withdraw consent where we rely on it. Some of these rights apply only in certain circumstances.
Right to object: you can tell us to stop sending you marketing at any time, using the unsubscribe link or by contacting us, and we will stop. You can also object to our use of your data based on our legitimate interests, and we will stop unless we have compelling grounds to continue.
To exercise any right, contact us using the details in section 1. We will normally respond within one month.
If you are unhappy with how we have used your personal data, please contact us first. We will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
10. Security and changes to this notice
We protect personal data with appropriate technical and organisational measures, including access controls and encryption in transit. We may update this notice from time to time and will post the current version on this page.