PRIVACY POLICY

Wagtails Private Markets Limited

Version 1.0. Effective from the date of publication. Reviewed annually.

1. WHO WE ARE

Wagtails Private Markets Limited is a company registered in England and Wales with company number 14606043. Our registered office is at 86-90 Paul Street, London EC2A 4NE. We refer to ourselves as Wagtails in this policy.

We are registered with the Information Commissioner's Office as a data controller, registration number ZC252809.

We do not have a Data Protection Officer and are not required to appoint one. If you have any question about this policy or about personal data we hold about you, contact Matthew Craig-Greene at matthew.craig-greene@wagtails.co or write to us at the registered office above.

2. WHAT THIS POLICY COVERS

This policy explains how Wagtails uses personal data when we decide why and how it is used, which is when we act as a data controller. That covers our clients and their staff, the people we interview in research projects, the people we contact for business development, our specialist collaborators, and visitors to our website and client portal.

It does not cover personal data we process on a client's instructions as part of an engagement, where the client decides why and how it is used. That processing is governed by the Data Processing Schedule attached to the client's engagement letter, and the client's own privacy information applies to the people whose data it is. Where we select research participants ourselves rather than working from a list the client supplies, we act as controller for that selection and this policy applies.

This policy applies to Wagtails only. Our client portal, Nest, is at nest.wagtails.co and is covered by this policy. Links from our website to other sites are not.

3. THE PERSONAL DATA WE HOLD AND WHERE IT COMES FROM

We hold business contact information and the records that come from working with people. We do not seek special category data and do not hold it knowingly.

If you are a client, or someone who works for a client: we hold your name, job title, work contact details, your role in the engagement, the engagement letter and agreements you accept and the record of their acceptance, portal login details, messages and files you exchange with us through Nest, and invoices and payment records. This comes from you, your organisation, and your use of Nest.

If you are a research participant: we hold your name, organisation, job title, contact details, the date and subject of the interview, your consent to recording, a brief summary of the conversation, and our written analysis of it. This comes from you, from the client who introduced you, or from public professional sources such as LinkedIn where we selected you ourselves.

If you are a business contact or prospect: we hold your name, organisation, job title, work contact details, our record of meetings and correspondence, and conference attendance where we have met or are due to meet. This comes from you, your organisation, public professional sources, conference delegate lists, and data enrichment providers (see section 9).

If you are a specialist collaborator: we hold your name, contact details, company details, the agreements you accept, assignments and fees, invoices and payments, and the details you choose to show on a client's portal. This comes from you and your use of Nest.

If you are a website or portal visitor: we hold technical data in server logs (IP address, browser type and pages requested) and, for a portal account, the IP address and browser details recorded when you accept a document. This comes from your browser.

4. WHY WE USE IT AND OUR LAWFUL BASIS

UK data protection law requires a lawful basis for each use of personal data. Ours are below. Where we rely on legitimate interests, we have considered whether our interest is outweighed by yours and have concluded that it is not; you can ask us for our reasoning.

Running client engagements (letters, agreements, the portal, delivery, invoicing): performance of a contract with the client. Where you are a member of the client's staff rather than the contracting party, our legitimate interest in running the engagement.

Keeping a record of agreements accepted through Nest, including the date and time, the documents accepted and the IP address and browser details recorded at acceptance: our legitimate interest in evidencing what was agreed, keeping the portal secure and resolving any dispute. We do not use these details to verify identity or infer location.

Carrying out research interviews and writing them up: our legitimate interest, and the client's, in conducting the research. Where we selected you ourselves, we tell you this at or before first contact (see section 8).

Keeping a register of who we have interviewed: our legitimate interest in knowing who we have spoken to, so that we do not approach you for our own purposes within twelve months of an interview, and so that we can answer questions about work we carried out years earlier.

Business development, contacting people who may want our services and keeping a record of those conversations: our legitimate interest in promoting our services to people in the private markets industry. You can object at any time (see section 9).

Engaging specialist collaborators and paying them: performance of a contract with the collaborator.

Keeping accounting and tax records: legal obligation.

Keeping our website and portal secure and working: our legitimate interest in security and in diagnosing faults.

Defending or bringing legal claims, and answering regulators: our legitimate interest, and legal obligation where one applies.

We do not use personal data for automated decision-making and we do not sell it.

5. WHO WE SHARE IT WITH

We share personal data only with the service providers who run our systems, the specialist collaborators who help deliver engagements, our professional advisers, and where the law requires it. Our service providers act on our instructions and may not use the data for their own purposes.

Microsoft 365: email, calendar, document storage, Teams meetings and recordings, and the register of people we have interviewed. Data held in the United Kingdom.

Supabase: the database and file storage behind Nest, our client portal. Data held in the Republic of Ireland.

Lovable Labs Incorporated: hosting and serving Nest. United States.

Resend: sending notification emails from Nest. United States.

HubSpot: our customer relationship management system, holding client and business contacts. United States.

Apollo: business contact data enrichment, used for business development only. United States.

Plaud: recording, transcription and note-taking for conferences and business conversations only, never research interviews. Processed in the European Union; Plaud Inc. is a US company.

Hostinger: hosting our website wagtails.co and its domain. European Union.

Specialist collaborators: delivering assignments on our engagements, under written confidentiality and data protection terms. United Kingdom.

Professional advisers: accountancy, tax, legal and insurance. United Kingdom.

Until 2026 we also used SurveyMonkey to run surveys on some engagements. We no longer use it. Survey responses collected through it have been exported and are held by us under this policy.

We may also disclose personal data where the law requires it, for example to HM Revenue and Customs, the Information Commissioner or a court.

6. TRANSFERS OUTSIDE THE UK

Some of our service providers hold data outside the United Kingdom. Where they do, the transfer is covered by one of the safeguards UK law recognises.

Supabase, Hostinger and Plaud (processing), European Union: the UK adequacy regulations for the EEA.

Resend, HubSpot and Apollo, United States: the UK Extension to the EU-US Data Privacy Framework, under which each is certified. HubSpot's and Apollo's terms also apply the UK International Data Transfer Addendum where the Framework does not cover a transfer.

Lovable Labs Incorporated, United States: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, in Lovable's data processing terms.

You can ask us for a copy of the relevant safeguard.

7. HOW LONG WE KEEP IT

We keep personal data for as long as the purpose it was collected for requires, and then for as long as we may need it to answer questions about our work or to defend a claim. The periods below are the ones we apply.

Engagement letters, accepted agreements and the full record of their acceptance, including the accepted document and its hash, the version of our Standard Terms, any attached schedules or variations, and the IP address and browser details recorded at acceptance: 15 years from the end of the engagement. This is the longstop period for professional negligence claims under the Limitation Act 1980, and our insurance requirements. The record is kept together; no part is deleted ahead of the agreement it evidences.

Our written working papers from an engagement (notes, write-ups, scores, analysis and a copy of the deliverable): 15 years from the end of the engagement, for professional record-keeping, insurance and the defence of claims.

Interview recordings and verbatim transcripts: destroyed at the end of the engagement, which is what we tell every participant before recording.

The register of people we have interviewed: 15 years from our last contact with you, so that we know not to approach you for our own purposes and can answer questions about work carried out years earlier.

Client and collaborator accounts on Nest: access removed at the end of the engagement and the account deleted twelve months later, which allows questions about the engagement to be answered before the account closes.

Business contact records and correspondence: no fixed period. Kept while there is a continuing business relationship or a realistic prospect of one, reviewed periodically, and removed on request.

Conference and business conversation recordings and notes made on Plaud: reviewed within twelve months and deleted unless they relate to a continuing relationship.

Invoices and accounting records: 6 years from the end of the accounting period, as HM Revenue and Customs requires, and in practice with the engagement file.

Email: retained in line with the record it relates to, reviewed periodically. Our mailbox is our working record.

Website and portal server logs: held by the hosting provider for a short rolling period, for security and fault diagnosis.

Routine backups of Nest's database are kept by our provider for seven days before they expire. Data deleted from Nest may persist in those backups for up to seven days afterwards. Backups are not used for any other purpose.

8. RECORDING CONVERSATIONS

Research interviews. If we interview you for a research project, we ask your permission before recording and we record only if you agree. Recordings are made on Microsoft Teams, stored in our Microsoft 365 tenant in the United Kingdom, transcribed on our own equipment and not by a third-party service, and destroyed at the end of the project together with any verbatim transcript. What we keep is our written analysis. Where you were introduced to us by a client, that client receives our analysis; where we agreed with you that your comments would not be attributed, they are not, though you should be aware that a comment can sometimes identify its author by its content even without a name attached.

Where we chose you ourselves. On some projects we select the people we interview rather than working from a client's list. In that case we are the controller for your details, we tell you who we are and why we are contacting you at or before first contact, and this policy applies to you directly.

Conferences and business conversations. We sometimes use a Plaud recording device to record and transcribe conversations at conferences and in business development meetings, so that we can keep an accurate note. We will tell you when we are doing so. These recordings are processed by Plaud in the European Union and are not used by Plaud or its AI providers to train their models. We never use Plaud to record a research interview or a conversation about a live client engagement.

9. BUSINESS DEVELOPMENT: WHERE WE GOT YOUR DETAILS

We contact people who work in private markets and who we think may want our services. If we have not dealt with you before, your details will have come from one or more of: a conference delegate list where we were also attending; your organisation's website or your public professional profile, such as LinkedIn; a business contact data provider, currently Apollo, which supplies work email addresses and job titles; or a referral from someone who knows us both.

When we first write to you, we say where your details came from and link to this policy. We do not contact people we have interviewed for research within twelve months of the interview, and we check our register before any outreach.

You can ask us to stop at any time by replying to any email from us or writing to the address in section 1. We keep a suppression record so that your details are not added again from a later list.

We contact organisations rather than individuals in their private capacity. If you are a sole trader or a partner in an unincorporated partnership, or you are in a country whose rules on business email differ from the United Kingdom's, tell us and we will stop.

10. OUR WEBSITE AND CLIENT PORTAL

wagtails.co. Our website sets no cookies and runs no analytics or tracking. Our hosting provider keeps standard server logs, which record the IP address, browser type and pages requested, for security and fault diagnosis. The site has no contact form; if you email us, we hold your message as business correspondence under this policy.

Nest, our client portal. Nest is at nest.wagtails.co and is used by clients and collaborators with an account we create for them. It uses the storage in your browser that is strictly necessary to keep you signed in; it sets no advertising or analytics cookies. When you accept a document through Nest, we record who accepted it, when, which documents were accepted and the IP address and browser details your connection presented. We keep those details as evidence of the agreement, as set out in sections 4 and 7; we do not use them to verify your identity or to infer your location. Files you upload to Nest are stored in the Republic of Ireland and are visible only to the people assigned to your engagement.

11. HOW WE KEEP IT SECURE

We keep personal data in a small number of systems, each with named access. Our email, documents and the interview register are in a Microsoft 365 tenant in the United Kingdom. Nest holds each client's data separately, so that a client and the people working on their engagement see only that engagement. Access to Nest is by individual account; accounts are created by us and closed when the engagement ends. Interview recordings are transcribed on our own equipment rather than sent to a transcription service. Data in transit to and from Nest and our website is encrypted. Nest's database is backed up daily, and we keep a separate backup of the files it holds.

If we become aware of a personal data breach that is likely to put you at risk, we will tell you and the Information Commissioner's Office without undue delay, as the law requires.

12. YOUR RIGHTS

Under UK data protection law you can ask us to tell you what personal data we hold about you and give you a copy; to correct it if it is wrong; to delete it, where we have no continuing reason to keep it; to restrict how we use it while a question about it is resolved; to object to our use of it where we rely on legitimate interests, which we will stop unless we can show a compelling reason; to object to direct marketing, which we will always stop; and, for data you gave us under a contract, to receive it in a portable form.

To exercise any of these rights, write to the address in section 1. We will respond within one month. We may ask you to confirm your identity first. There is no charge unless a request is plainly unfounded or excessive.

If you took part in a research interview that a client arranged, your request may need to go to that client, because the client controls the research data; we will tell you if so and help you reach them. Where we selected you ourselves, the request comes to us.

If you are unhappy with how we have handled your personal data, we would like the chance to put it right, but you also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

13. CHANGES TO THIS POLICY

We review this policy at least once a year and whenever we change the systems or practices it describes. The current version is always at wagtails.co/privacy. If we make a change that affects how we use data we already hold about you, we will tell you before it takes effect where we can reasonably do so.

Version 1.0, effective from the date of publication: first published policy.