Privacy Policy
Last updated: September 2026
1. About this Privacy Policy
This Privacy Policy explains how TWO SEAS ("we", "us" or "our") collects, uses, stores and discloses personal data in connection with our website, our business and the services we provide.
We are a boutique mergers and acquisitions advisory business providing strategic and transaction-related advice to businesses, shareholders, management teams, investors and other clients and counterparties.
This Privacy Policy applies to personal data that we process in connection with:
your use of our website;
enquiries or other communications you send to us;
our provision of advisory and transaction-related services;
our relationships with clients, prospective clients, investors, counterparties and their advisers;
our professional contacts and business relationships;
events, meetings and other business development activities; and
the operation and administration of our business.
This Privacy Policy does not form part of any engagement or other contractual agreement between us and a client.
Where we process personal data on behalf of a client as a processor, our processing will be governed by the applicable engagement terms and data processing arrangements.
We may provide additional privacy information where appropriate for particular services, transactions or categories of personal data.
2. Who we are
The entity responsible for your personal data is:
Two Seas Advisory Limited (company number 17446829)
Email: privacy@twoseas.ai
Post: Charter Court, 16A Harcourt Street, London W1H 4HE
For the purposes of applicable data protection legislation (including the UK GDPR, the UK Data Protection Act 2018 and the EU GDPR), we are generally the controller of the personal data we process in connection with our website and our own business activities.
We are not an SRA-regulated law firm. Nothing in this Privacy Policy is intended to suggest otherwise.
The fact that individuals involved in our business may be, or may have been, regulated by the Solicitors Regulation Authority does not of itself mean that the business is an SRA-regulated firm.
3. The personal data we collect
Depending on the nature of our relationship with you, we may collect and process information including:
Information you provide to us
This may include:
your name and contact details;
your job title, employer and professional background;
information contained in correspondence and communications with us;
information provided when you submit an enquiry or request information;
information provided in connection with a prospective or actual engagement;
information contained in transaction-related documents and correspondence; and
information you provide when attending meetings, events or other business activities.
Information we obtain from other sources
In the course of our business, we may obtain personal data from sources other than you, including:
our clients and prospective clients;
other transaction participants and their professional advisers;
companies, shareholders, directors and management teams involved in transactions;
publicly available sources;
corporate registries and databases;
professional advisers and service providers;
business intelligence and due diligence providers; and
other legitimate commercial sources.
This may include information about individuals who are connected with a company or transaction, even where we have not had direct contact with those individuals.
Information collected through our website
When you visit our website, we may collect technical information such as:
your IP address;
browser and device information;
operating system;
information about how you use the website;
pages visited and interactions with the website; and
information collected through cookies or similar technologies.
The precise information collected will depend on the configuration of our website and the cookies and other technologies that we use.
4. How we use personal data
We use personal data for purposes including:
responding to enquiries and requests;
establishing and maintaining business relationships;
providing M&A and strategic advisory services;
identifying and evaluating potential transactions and opportunities;
communicating with clients, prospective clients, investors, counterparties and advisers;
conducting appropriate due diligence;
carrying out conflict checks and other checks necessary to protect our business and our clients;
managing transaction processes and communications between relevant parties;
maintaining appropriate records;
managing our suppliers and professional advisers;
operating, maintaining and improving our website and IT systems;
managing our business and financial affairs;
sending business communications and, where permitted, marketing communications;
complying with applicable laws and regulatory or professional obligations;
establishing, exercising or defending legal claims; and
protecting our rights, property, confidential information and systems.
We will not use personal data for purposes that are incompatible with the purposes for which it was collected unless permitted or required by applicable law.
5. Our legal bases for processing personal data
We process personal data only where we have a lawful basis to do so.
Depending on the circumstances, this may include:
Performance of a contract. We may process personal data where this is necessary to enter into or perform a contract with you.
Legitimate interests. We may process personal data where this is necessary for our legitimate interests, or those of a third party, provided that those interests are not overridden by your interests or fundamental rights and freedoms.
Our legitimate interests may include operating and developing our business, providing and improving our services, managing client and business relationships, identifying transaction opportunities, carrying out appropriate checks, protecting our business and systems, and establishing, exercising or defending legal claims.
Legal obligations. We may process personal data where necessary to comply with a legal or regulatory obligation.
Consent. In some circumstances we may ask for your consent to process personal data, for example where consent is required for particular electronic marketing or certain cookies. Where we rely on consent, you may withdraw it at any time.
6. Transaction-related information
Our business involves advising clients in relation to mergers, acquisitions, disposals, investments and other corporate transactions.
In that context, we may receive personal data relating to directors, officers, employees, shareholders, management teams, investors, beneficial owners, advisers, counterparties and other individuals connected with a transaction.
Such information may be provided to us by a client or by another participant in a transaction and may be included in transaction documents, due diligence materials, corporate information, financial information, correspondence or other materials.
We process such information only to the extent reasonably necessary for our business activities and the relevant transaction or engagement, and in accordance with applicable data protection law.
Where appropriate, we may also process information in order to establish, exercise or defend legal claims or to protect confidential or commercially sensitive information.
7. Confidentiality
We recognise the importance of maintaining the confidentiality of information provided to us in connection with our business and transactions.
We take appropriate organisational, contractual and technical measures to protect confidential information against unauthorised access, disclosure, alteration or loss.
However, confidentiality and data protection are distinct legal concepts. The fact that information is confidential does not necessarily mean that it constitutes personal data, and the fact that information is personal data does not necessarily mean that it is confidential.
Nothing in this Privacy Policy limits any confidentiality obligations that apply to us under an engagement, agreement or applicable law.
8. Who we share personal data with
We may disclose personal data where reasonably necessary for the purposes described in this Privacy Policy.
Depending on the circumstances, recipients may include:
our clients and prospective clients;
companies, shareholders, directors, management teams, investors and counterparties involved in a transaction;
lawyers, accountants, tax advisers, financial advisers and other professional advisers;
banks, financing providers and other financial institutions;
insurers and insurance advisers;
auditors and other professional service providers;
technology, IT, cloud storage, communications and other service providers;
data room, transaction management and other technology providers;
providers of due diligence, corporate intelligence and business information services;
regulators, governmental bodies, courts and law enforcement authorities where required or permitted by law; and
other third parties where you have asked us to do so or where disclosure is otherwise lawful.
Where we use third-party service providers to process personal data on our behalf, we will take appropriate steps to ensure that the processing is carried out in accordance with applicable data protection law.
We do not sell personal data.
9. International transfers
Some of our service providers or other recipients of personal data may be located outside the United Kingdom.
Where we transfer personal data outside the UK, we will do so only where permitted by applicable data protection law and will put in place appropriate safeguards where required.
These safeguards may include an adequacy decision or appropriate contractual or other safeguards recognised under applicable UK data protection legislation.
You may contact us using the details in section 2 if you would like further information about the safeguards applicable to a particular international transfer.
Our website is hosted by Framer, Inc., a technology provider based in the United States. Consequently, any personal data you submit directly through our website contact form will be transferred to and stored on servers located outside the UK and the EEA. To guarantee that this data receives an equivalent level of protection, our relationship with Framer is governed by a Data Processing Addendum (DPA) that explicitly incorporates the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum
10. How we protect personal data
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures may include appropriate access controls, authentication procedures, encryption, secure systems, confidentiality obligations and information-security procedures.
No method of transmitting or storing information is completely secure. We therefore cannot guarantee the absolute security of personal data.
11. How long we keep personal data
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to satisfy legal, accounting, regulatory or reporting requirements and to establish, exercise or defend legal claims.
The appropriate retention period will depend on the nature of the information and the circumstances in which it was collected.
For example, information relating to an actual or prospective engagement or transaction may need to be retained for longer than information relating to a general website enquiry.
When personal data is no longer required, we will securely delete it or, where appropriate, anonymise it.
12. Direct marketing
We may use your contact details to send you information about our services, transactions, events, publications or other matters that we consider may be of legitimate interest to you, where permitted by applicable law.
Where applicable law requires consent for electronic marketing, we will obtain that consent before sending the relevant communications.
You can ask us to stop sending marketing communications at any time by contacting us or using the unsubscribe mechanism included in the communication.
13. Cookies and similar technologies
Our website may use cookies and similar technologies.
Some cookies are necessary for the operation, security and functionality of the website. Other cookies, such as analytics or similar technologies, may be used to understand how visitors use our website and to improve its performance.
Where required by law, we will ask for your consent before placing non-essential cookies on your device.
You can control cookies through our cookie settings tool and, depending on your browser, through your browser settings.
Further information is available in our Cookie Notice.
14. Third-party websites
Our website may contain links to websites operated by third parties.
We are not responsible for the privacy practices, security or content of third-party websites. If you follow a link to another website, you should review that website's privacy policy before providing personal data.
15. Your rights
Subject to applicable legal conditions and exemptions, you may have rights in relation to your personal data, including:
the right to obtain information about how we process your personal data;
the right to request access to personal data we hold about you;
the right to request correction of inaccurate or incomplete personal data;
the right to request erasure of personal data in certain circumstances;
the right to request restriction of processing in certain circumstances;
the right to object to certain processing, including processing based on legitimate interests and direct marketing; and
where applicable, the right to receive or have transferred to another organisation certain personal data in a structured, commonly used and machine-readable format.
Where we process your personal data on the basis of consent, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.
These rights are subject to limitations and exemptions under applicable law.
To exercise a right, please contact us using the details in section 2.
We may need to request additional information from you in order to verify your identity and protect personal data against unauthorised disclosure.
16. Automated decision-making
We do not currently use personal data to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects on them.
If this changes, we will provide appropriate information about the relevant processing and any rights and safeguards that apply.
17. Children's personal data
Our website and services are directed primarily at businesses and professional users and are not intended for children.
We do not knowingly collect personal data from children through our website except where such information is provided to us in a legitimate business or transaction context.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business, the services we provide, the personal data we process, applicable law or regulatory requirements.
The date at the top of this Privacy Policy indicates when it was last updated.
We encourage you to review this Privacy Policy periodically.
19. Questions and complaints
If you have any questions about this Privacy Policy or how we process personal data, please contact us:
Two Seas Advisory Limited
Charter Court, 16A Harcourt Street, London W1H 4HE
Email: privacy@twoseas.ai
If you are not satisfied with our response, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).
Information about how to make a complaint is available on the ICO's website.
We would, however, appreciate the opportunity to address your concerns before you approach the ICO. If you are based in the European Union, you also have the right to lodge a complaint with your local EU Supervisory Authority.
20. Governing law
This Privacy Policy is governed by the laws of England and Wales, to the extent permitted by applicable law.