Privacy Notice

Information we collect

Depending on how you interact with us, we may collect:

• identity and contact information, such as name, role, company, work email, telephone or WhatsApp number;
• business and company information you provide through forms, assessments, meetings or communications;
• information contained in documents or links you choose to provide, including pitch decks, plans, financial summaries and other supporting material;
• publicly available company and professional information gathered from company websites, public sources, licensed databases and research tools;
• technical and usage information, such as device, browser, IP address, referral source, campaign attribution, page views and interaction events, where collected by our website and analytics tools;
• communications, meeting notes, tasks, preferences and relationship history;
• consent records, privacy-notice version, communication preferences and related compliance records.

How we use information

We may use personal and business information to:

• provide, operate, secure and improve the website and Services;
• create, research, analyse and review CEO Opportunity Reports and related outputs;
• research and understand a company using public and authorised sources;
• respond to enquiries, provide service communications and manage relationships;
• qualify opportunities and recommend appropriate An Extra Chair services where relevant;
• manage agreements, billing, onboarding and client delivery;
• maintain CRM, operational, audit and compliance records;
• protect against fraud, misuse, security incidents and unlawful activity;
• comply with legal, regulatory, tax, accounting and record-keeping obligations;
• send marketing or relationship communications where permitted by law and consistent with your communication preferences.

AI, automation and research tools

We may use artificial intelligence, automation, search tools, external databases and specialist technology providers to assist with research, enrichment, extraction, summarisation, drafting, analysis and workflow management. We apply controls intended to limit unnecessary disclosure of confidential information. Public-company research workflows should receive only the information reasonably required to identify and research the relevant company, rather than confidential strategic free text merely because it exists elsewhere in our systems.

At launch, material client-facing CEO Opportunity Reports are subject to human review before release.

Service providers and sharing

We may disclose information to personnel, contractors, advisers and service providers who need it to operate the Services, including providers of cloud hosting, databases, CRM, document storage, email, scheduling, payments, analytics, research, artificial intelligence, security and professional services. We require access to be limited to legitimate business purposes and subject to appropriate contractual, confidentiality and security obligations where applicable.

We may also disclose information where required by law, to protect rights or security, in connection with a corporate reorganisation, financing, acquisition or sale, or with your direction or consent. We do not sell personal information to advertisers.

International processing

An Extra Chair operates and may use service providers in multiple countries. Your information may therefore be processed outside the country in which you are located. Where required, we take appropriate steps to address applicable cross-border data-transfer requirements.

Data minimisation and confidentiality

We aim to collect and use only information reasonably required for the relevant purpose. Detailed confidential strategic answers should not be copied into third-party systems that only require summary commercial fields. Client-supplied confidential material is handled separately from public research where practical and subject to applicable confidentiality obligations.

Security

We use administrative, technical and organisational measures designed to protect information against unauthorised access, loss, misuse or alteration. These measures may include access controls, least-privilege permissions, encryption in transit and provider encryption at rest, authentication controls, audit logging, secure tokens and restricted API credentials. No system can be guaranteed to be completely secure.

Retention

We retain information for as long as reasonably necessary for the purposes described in this Notice, to maintain business and relationship records, to comply with legal or regulatory obligations, to resolve disputes and to enforce agreements. Retention periods may vary according to the type of information, relationship and legal requirement. We may retain de-identified information where it no longer identifies an individual.

Your rights and choices

Depending on your location and applicable law, you may have rights to request access to, correction of, deletion of or restriction relating to your personal information, or to object to certain processing. You may also have rights relating to data portability or to withdraw consent where processing is based on consent. These rights may be subject to legal exceptions and verification requirements.

You may opt out of marketing communications using the unsubscribe mechanism provided or by contacting us. Service or transactional communications relating to a request or active relationship may still be sent where appropriate.

Cookies and analytics

Our website may use cookies and similar technologies for essential functionality, security, preferences, analytics and attribution. Where required by law, non-essential cookies or similar tracking technologies will be used only after the required consent. See our Cookie Notice or preference controls for more information.

We use cookies and similar technologies to operate and secure the website, remember preferences, understand how the site is used and measure where enquiries come from. Essential technologies may operate without optional consent where permitted. Analytics, advertising or other non-essential technologies will be handled in accordance with applicable law and your selected preferences.

You can change your non-essential cookie preferences through the website preference controls where available. Disabling some technologies may affect measurement or certain website features.

Children

The Services are intended for business and professional users and are not directed to children.

Changes to this Notice

We may update this Privacy Notice from time to time. The current version will state its effective date. Material changes will be communicated where required by applicable law.

Privacy contact

Questions or requests relating to privacy may be sent to [PRIVACY/LEGAL CONTACT] at [ADDRESS].