Privacy Policy.

Draft. This policy has been prepared for review and has not yet been settled by counsel. Remove this notice once it has.

Last updated: 31 August 2026

1. Who we are.

Federation SaaS HoldCo S.à r.l. (“Federation”, “we”, “us”) is a private limited liability company incorporated in the Grand Duchy of Luxembourg. We are the data controller for personal data collected through federationsaas.com and through correspondence with us.

Questions, or any request under this policy: partnership@federationsaas.com.

2. What we collect.

• Information you give us. Through the contact form: your name, company, email address, country, an approximate revenue band, a description of your software, and a description of where you are in your thinking. By email or in a call: whatever you choose to tell us, which in an acquisition discussion may include commercial and financial information about your business.
• Technical information. Our hosting provider records standard server log data, including IP address, browser type, pages requested and time of request. This is generated automatically by the act of visiting any website.

We do not collect special category data, and you should not send it to us. We do not knowingly collect data relating to children.

3. Cookies and tracking.

This website sets no cookies. It runs no analytics, no advertising pixels and no third-party trackers. Typefaces are served from our own domain rather than from a font provider, so loading a page on this site does not disclose your IP address to any third party beyond our host. If we introduce analytics, we will update this policy first and will use a provider that does not require consent-based tracking wherever possible.

4. Why we use it, and on what legal basis.

• To respond to your enquiry and take steps at your request prior to entering into a contract — Article 6(1)(b) GDPR.
• To assess a potential acquisition and manage our pipeline — Article 6(1)(f), our legitimate interest in evaluating businesses that approach us, and yours in being evaluated properly. We have considered your interests and consider this processing to be within your reasonable expectations, given you contacted us for that purpose.
• To keep records of our correspondence and comply with legal, tax and corporate obligations — Articles 6(1)(c) and 6(1)(f).
• To operate and secure the website — Article 6(1)(f).

We do not send marketing email, and we do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Who has access.

Internally, the Federation deal team and those advising it. Externally, only:

• our website host and, where used, our form-submission provider, acting as processors on our instructions;
• professional advisers (legal, financial, technical) engaged on a specific transaction, under confidentiality obligations;
• authorities, where we are legally required to disclose.

We do not sell personal data, we do not share it for third-party marketing, and nothing you send through the contact form is passed outside the deal team without your knowledge.

6. Transfers outside the EEA.

Some of our service providers are established outside the European Economic Area. Where personal data is transferred to such a provider, we rely on an adequacy decision of the European Commission where one applies, and otherwise on the Commission’s Standard Contractual Clauses together with any additional measures required. You can ask us for details of the transfers relevant to you.

7. How long we keep it.

• Enquiries that do not proceed: up to 24 months from our last exchange, so that we can pick up the conversation if you come back to us, then deleted.
• Enquiries that proceed to diligence or a transaction: for the life of the relationship and thereafter for the period required by Luxembourg corporate, tax and limitation rules.
• Server logs: retained by our host for a short period in the ordinary course.

8. Your rights.

Under the GDPR you have the right to: obtain confirmation of whether we process your data and a copy of it (Article 15); have inaccurate data corrected (Article 16); have data erased (Article 17); have processing restricted (Article 18); receive data you provided in a portable format (Article 20); and object to processing carried out on the basis of legitimate interests (Article 21).

To exercise any of these, write to partnership@federationsaas.com. We will respond within one month. We may ask you to confirm your identity first.

If you are not satisfied with our response, you may lodge a complaint with the Luxembourg supervisory authority, the Commission nationale pour la protection des données (15, Boulevard du Jazz, L-4370 Belvaux; cnpd.public.lu), or with the authority in your country of residence.

9. Security.

The site is served over HTTPS. Access to enquiry data is limited to those who need it. We ask that you do not send commercially sensitive material through the contact form before we have a confidentiality agreement in place — a short description is enough to start.

10. Changes.

We will post any changes to this policy on this page and update the date above.