Privacy policy

Who is responsible

The controller for personal data processed through this website is Array Capital GmbH, Weinbergstrasse 131, 8006 Zürich, Switzerland (CHE-349.211.433). Contact for all privacy matters: [email protected]. We process personal data under the Swiss Federal Act on Data Protection (revDSG) and, where it applies to visitors in the EU/EEA, the GDPR.

What this website does, and does not, collect

This site currently runs no advertising pixels. If we introduce ad measurement (for example Google Ads or LinkedIn), it will load only with your consent through the same cookie banner, and this page will be updated. Our hosting provider, Cloudflare, processes technical connection data (IP address, request metadata) in server logs to deliver the site and defend it against abuse; we see this only in aggregate. Legal basis: our legitimate interest in operating a secure website (GDPR art. 6(1)(f)).

We use Google Analytics 4 to understand which pages are useful, with Google Consent Mode: the analytics cookie is set only if you accept it in the banner, and IP addresses are anonymized. If you decline, only cookieless, non-identifying pings are sent, and you can change your mind any time by clearing this site's data in your browser. Legal basis: your consent (GDPR art. 6(1)(a)).

Two embedded services load third-party code in specific places: the scheduling widget on the discovery-call page is provided by Calendly LLC (loads when you open that page and may set its own cookies; see Calendly's privacy notice), and our videos are served by Wistia but load only after you press play. If you never book a call or play a video, no third-party service receives anything about your visit.

Data you give us

If you email us, book a discovery call, or request access to a mandate through our deal portal, we process what you provide: name, email address, firm, and the content of your messages. We use it to respond, to run the process you asked to join, and to keep required records. Legal bases: taking steps prior to a contract (art. 6(1)(b)) and our legitimate interest in operating an M&A advisory practice. Deal-notification signups are used solely to tell you about new mandates, and every message includes a way to opt out.

Client and counterparty deal data

Confidential materials in live transactions are processed separately from this website, in access-controlled, NDA-gated systems: per-deal segregation, per-recipient watermarking, and logged access. Client data is never used to train models, never shared beyond the deal process it belongs to, and is returned or deleted after the engagement ends, subject to statutory retention duties.

Retention

Enquiries and correspondence: as long as needed to handle them, then up to 2 years. Deal-process records: 10 years, per Swiss commercial record-keeping obligations. Deal-notification signups: until you unsubscribe. Server logs: per Cloudflare's standard rotation.

Where data goes

Our infrastructure providers (Cloudflare, Google Workspace, Calendly) process some data in the United States. Transfers rely on the Swiss and EU adequacy decisions for the EU-U.S. Data Privacy Framework and, where needed, standard contractual clauses. We do not sell personal data, ever.

Your rights

You can ask us for access to your data, correction, deletion, restriction, a portable copy, or object to processing based on legitimate interest, by writing to [email protected]. We answer within 30 days. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU/EEA, to your local supervisory authority.

Changes

We update this page when our practices change and change the date at the top when we do. Material changes will be noted here explicitly.