Privacy notice

1. Where we got your details

We did not get your details from you. We got them from sources that are already published and open to anyone.

We research UK corporate finance advisers. When we find a named adviser, we record their details from the page we found them on. Those pages are:

• your firm's own website, usually a team page or a people page
• your firm's own news pages
• published award listings, such as shortlists and winners
• press releases
• the Companies House public register

We record the exact web address we took your details from and the date we took them. If you ask us, we will tell you both. You will be able to see the page your details came from.

There is one exception, set out in section 10. Once you have told us to stop, we delete that record along with the rest, so ask at the same time if you want it.

Two things we do not do

We do not buy lists from data vendors. Nothing in our records was bought in.

We do not scrape LinkedIn. Where we hold a link to your LinkedIn profile, it is there so we can send you a connection request, and for nothing else. We take no other information from LinkedIn.

2. Who we are

Overture Index Limited is the controller of your personal data. That means we decide what is held and why, and we are the ones answerable for it.

Our website is overtureindex.com. It can also be reached at ovrtr.co.uk, which is our older address and redirects to the same site.

We make target discovery software for mergers and acquisitions and for deal sourcing. It surfaces the long tail of companies that ranked search and prebuilt directories miss. We contact corporate finance advisers because that work sits close to theirs.

3. We have no data protection officer

We have not appointed a Data Protection Officer, and we are not required to appoint one. We are saying so plainly rather than leaving it out.

Anything you would send to a DPO should go to info@overtureindex.com. It reaches the person responsible for data protection here.

4. What we hold about you

For a named individual at a UK corporate finance firm, we hold:

• your name
• your job title, as published
• the firm you work for
• your business email address, where it is published
• your LinkedIn profile, where we use it to make contact
• the exact source web address your details were taken from
• the date they were collected

That list is everything. We hold no home address, no personal email address, and no special category data, such as anything about your health, ethnicity, religion or political opinions.

5. What we use it for

One purpose only: to contact you about Overture. This is business to business direct marketing.

The sequence is short and it is always the same.

1. A LinkedIn connection request.
2. A short sequence of emails.
3. We close the record and stop.

Each email is written for the person it is sent to, rather than sent in bulk to a list.

We do not use your details for anything else. We do not make decisions about you by automated means, and we do not carry out profiling as the UK GDPR defines it.

6. Our lawful basis

We rely on legitimate interests, under Article 6(1)(f) of the UK GDPR.

What those interests are, in plain English

We are a small company selling software to corporate finance firms. Advisers at those firms are the people who would use it and the people who decide whether to buy it. Reaching them is how a company like ours finds its customers.

We contact you at work, about your work, using details your firm has published so that people can get in touch with you. We think that is a reasonable and ordinary thing to do, and that it is not something you would find surprising or intrusive.

Our legitimate interests assessment

Before we contacted anyone, we carried out a legitimate interests assessment. It sets out the interest we are pursuing, tests whether contacting you this way is necessary to pursue it, and weighs it against your rights and your reasonable expectations.

You can have a copy. Email info@overtureindex.com and we will send it to you.

We do not rely on your consent

Because we do not rely on consent, there is no consent for you to withdraw. What you have instead is an absolute right to object, which is set out in section 9.

7. The marketing rules we follow

Marketing email in the UK is governed by the Privacy and Electronic Communications Regulations, usually called PECR, as well as by the UK GDPR.

Under PECR, unsolicited marketing email may be sent to corporate subscribers without asking first. It may not be sent that way to individual subscribers.

We only email corporate subscribers. That means limited companies, limited liability partnerships, and Scottish partnerships.

We do not email sole traders. We do not email ordinary partnerships outside Scotland. Both count as individual subscribers, so they are outside what we do.

Before anyone at a firm is contacted, we confirm that the firm is a corporate subscriber, and we record the result against that firm. For UK firms we confirm it against the Companies House public register. Where we cannot confirm it, the firm is set aside and nobody there is contacted.

Outside the UK

Everything above is built around UK rules and the UK register. Companies House does not cover firms registered elsewhere, so it cannot be the check for them.

The sequence described above is run against firms in the UK. If that ever changes, marketing email to a firm in another country is governed by that country's own rules rather than by PECR, and those rules are not the same as the UK's. We would work out what applied and change this page before the first message went out, rather than after.

Every email we send identifies us as the sender and gives you an address to reply to if you want it stopped.

8. How to stop hearing from us

You do not need a particular form of words. Replying to one of our emails with the word stop is enough.

9. Your absolute right to object

Under Article 21(2) of the UK GDPR you have the right to object to your personal data being used for direct marketing.

That right is absolute. There is no balancing test. We do not get to weigh our interests against yours, we do not get to ask you for a reason, and we do not get to decide whether your objection is justified. Once you object, we must stop using your details for marketing, and we stop.

This is stronger than the general right to object in Article 21(1), which does involve a balance. For marketing, no balance applies.

10. The suppression record

When you object, or ask us not to contact you, we keep a small record of that fact. We keep your name, your firm, the address or profile you asked us to stop using, and the date you asked.

We keep it for one reason: so that we do not contact you again.

If we deleted everything we hold about you, your details could be found again on the same published page a few months later, added again, and you would hear from us a second time. The suppression record is what prevents that.

Keeping that record is itself the lawful purpose. It is not marketing data. It is never used for marketing, never used to contact you, and never used for anything else. It is a list of people not to contact, and that is the whole of what it does.

Because we keep so little, a suppression record does not hold the web address your details came from. If you want to know where we found you, ask at the same time as you tell us to stop, and we will tell you before it goes.

If you would rather we erased everything and accepted the risk of your details being collected again later, tell us and we will do that instead.

11. Who else sees your details

We do not sell your details. We do not pass them to our customers. We do not share them with anyone for their own marketing.

We use a small number of service providers to run the business. They are our processors. They hold your details only to provide their service to us, act only on our written instructions under a data processing agreement, and are not allowed to use your details for their own purposes. These are all of them.

Atlassian

Supplies Jira, which is where a research record is kept. Everything listed in section 4 sits there: your name, your job title, your firm, the source address and the date.

Google

Supplies Google Workspace, which carries our email and the booking calendar on our home page. Anything we send you, anything you send back including an instruction to stop, and anything you enter to book a demo, sits there.

Anthropic

Supplies Claude, which we use to research firms and to draft what we send you. A record's details are given to it in the course of that work, so your name, job title and firm reach it. It is not used to decide anything about you.

We will also disclose personal data where the law requires it, for example to a court, a regulator or a public authority acting within its powers.

12. Where your details are held

We are a UK company. The three providers in section 11 hold your details in three different places, and these are all of them.

Your research record is held in the UK. Jira keeps it in Atlassian's London region, so the name, job title, firm, source address and date in section 4 do not leave the country.

Your email is stored in Europe. Google Workspace carries our mail, and its data region is set to Europe, so the mailbox holding anything we send you and anything you send back, an instruction to stop included, is stored in the European Union rather than here. Booking a demo goes the same way, because the calendar is part of the same Workspace. UK law treats the European Union as giving personal data equivalent protection, so that transfer needs nothing further from us. Google is a United States company, and some of what it does around the mailbox, support being the usual example, can happen outside Europe. That part is covered by the safeguards in our Google Workspace agreement.

Claude processes in the United States. Anthropic, which supplies Claude, is a United States company. Your details are processed there, and may be processed in other countries where Anthropic or its own providers operate. That transfer is covered by the data processing agreement built into Anthropic's commercial terms, which carries the standard contractual clauses approved for transfers out of the UK.

Wherever this section mentions a safeguard, you can see it. Email info@overtureindex.com and we will send you a copy of the one you ask about.

13. How long we keep them

A research record passes through three states.

Open

While the firm is on our research list and the contact sequence is running.

Closed

Once the sequence has finished, or once we decide the firm is not a fit. No further contact is made from a closed record.

Suppressed

If you have objected or asked us to stop. See section 10.

What is deleted, and when

We delete the personal data in a closed record 12 months after the date it was collected. That means your name, your job title, your business email address, your LinkedIn profile, and the source web address they came from.

What survives is the record of the firm: its name, that we looked at it, and why it was closed. That is information about a company rather than about you. It is also what stops us researching the same firm from scratch later on and arriving back at your name.

A suppression record is not an exception to that deletion. The same 12 month clock runs over it, and everything goes on it except the four things listed in section 10: your name, your firm, the address or profile you asked us to stop using, and the date you asked. Those four are kept for as long as we are marketing at all, because deleting them would put you back in the path of being contacted again. Nothing else about you is kept.

14. Visitors to this website

If you are here because you clicked Privacy in the footer rather than because we emailed you, this is the section you want.

Before the booking calendar loads

Nothing is set in your browser. This site sets no cookies of its own. No analytics script runs, there is no tracking pixel, and there is no advertising tag anywhere on it. The fonts and the video are served from our own domain rather than from anyone else's, and no video is downloaded until you press play.

After it loads

The home page shows a booking calendar inside the page. It is a Google appointment schedule, and it is not fetched until you scroll near it or follow one of the Book a demo links. Once it loads it comes from Google, and Google can set its own cookies and browser storage at that point. If you go on to book, the name, email address and time you enter go into our Google Workspace, and section 12 says where that sits.

If you would rather none of that happened, do not scroll to the calendar. Email us instead and we will fix a time by hand.

Serving the site

The site is served through Cloudflare. Like any host, Cloudflare handles the request your browser makes, which includes your IP address, in order to deliver the page and to keep the site up.

15. Your rights

You have all of the following rights over the personal data we hold about you.

Access

You can ask for a copy of what we hold about you, including where we got it. We will tell you the source web address and the date of collection.

Rectification

You can ask us to correct anything wrong, and to complete anything that is incomplete. If your job title or firm has changed, tell us and we will change it.

Erasure

You can ask us to delete what we hold. Please read section 10 first, because deleting everything removes the record that keeps you off our list.

Restriction

You can ask us to stop using your details while a question about them is being sorted out, for example while we check something you say is wrong.

Objection

You can object to our use of your details. For direct marketing that right is absolute and we must stop. See section 9.

Portability

This is the right to receive your data in a machine readable form and have it moved elsewhere. It applies only where processing is based on consent or on a contract and is carried out by automated means. Our processing rests on legitimate interests, so in practice this right does not arise here. We list it so you can see the complete set. If you want a copy of your data in any case, ask us under access above and we will send it.

Using any of these rights costs nothing, and using one does not affect the others.

16. How to use those rights

You do not need a particular form of words, and you do not need to quote the law. It helps if you tell us the email address or the LinkedIn profile we contacted you on, because that is how we find your record.

We will respond within one month. If a request is genuinely complicated we may need up to two further months, and if that happens we will tell you within the first month and say why. There is no charge.

17. Complaining to the ICO

If you are unhappy with how we have handled your personal data, tell us first and we will try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK's independent data protection regulator. You can go to them at any time, and you do not have to come to us first.

18. Changes to this notice

If we change how we handle personal data, we will change this page and update the date at the top. The current version was last updated on 14 September 2026.