Legal notice and privacy policy

This English translation is provided for convenience only. The French version (« Mentions légales ») is the sole authoritative and legally binding version.

1. Legal notice

Site publisher

The diligeo.com website is published by:
Hugues Schaap, sole trader (French entrepreneur individuel) operating under the trading name Diligeo
Address: 62 rue du Faubourg Poissonnière, 75010 Paris
SIRET: 106 190 465 00018 (SIREN: 106 190 465)
APE code: 70.22Z (business and other management consultancy activities)
VAT not applicable, Article 293 B of the French General Tax Code
Director of publication: Hugues Schaap
Email: contact@diligeo.com
Website: https://diligeo.com

Hosting provider

Vercel Inc.
340 S Lemon Ave #4133, Walnut, CA 91789, USA
Website: https://vercel.com

2. Privacy policy

This policy describes how Diligeo collects, uses and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

2.1 Data controller

Diligeo · contact@diligeo.com

No data protection officer (DPO) has been appointed at this stage: such an appointment is not mandatory for an organization of this size. The point of contact for any question relating to your data is contact@diligeo.com.

2.2 Data collected

The /onboarding form collects the following categories of data, depending on the branch selected (buyer case or sourcing case):

Identity and contact details: name, email address, telephone number.
Professional experience: primary role, background sectors, years of experience, largest team managed.
Acquisition profile: mode (solo, team, fund), rank (first acquisition, second, serial), training completed.
Personal financial capacity: personal equity contribution, target bank leverage, any cash reserve.
Target criteria: sectors sought, target revenue, target headcount, geographic area, accepted procedures (solvent sale, court-supervised restructuring (redressement judiciaire, RJ), court-ordered liquidation (LJ)).
Position on the case (buyer branch): stage of progress, any offer deadline, cases pursued in parallel, indication of whether a chartered accountant or a lawyer has been engaged.
Search constraints (sourcing branch): area mode, sale horizon, reason for acquisition, free-form notes.
Document: CV (optional PDF, 4 MB maximum).
Free text: comment or free-form notes (optional).
Technical metadata: consent timestamp, internal case reference generated by Diligeo, partial IP address (for anti-spam rate limiting).

The fields marked as mandatory in the form are necessary to process your request: without them, Diligeo can neither contact you nor scope the engagement. The other fields are optional and their absence does not prevent your request from being taken into account.

The home page and the other public pages collect no personal data (no tracker, no analytics cookie). Diligeo only keeps aggregate, anonymous visit counters, described in section 3.

When you order the approach to owners together with your scouting, Diligeo also processes, for the companies you select, data about their directors: see section 2.4.4.

2.3 Purposes of processing

Your data is collected in order to:

Respond to your request and contact you within 48 business hours;
Define the scope of the engagement (data-room analysis or target scouting);
Prepare a quote or commercial proposal suited to your profile;
Produce the requested deliverable (analysis report or scouting file).
Approach, at your request and in your name, the owners of the companies you have selected, by handwritten letter, LinkedIn message or email, and track these approaches.

Legal basis: performance of pre-contractual measures taken at your request (Article 6(1)(b) GDPR), supplemented by your explicit consent (Article 6(1)(a) GDPR) ticked when the form is submitted. For the public data of legal entities and their directors used in the scouting file, the legal basis is legitimate interest (Article 6(1)(f) GDPR).

2.4 Processors and recipients

The processing of your data involves the following technical processors, each strictly limited to its function:

Vercel Inc. (United States): website hosting and execution of server functions. Traffic encrypted over HTTPS. See postal address in section 1.
Resend (Boundary Mountain, Inc.) (United States): email delivery (confirmation emails, team alerts). Resend does not durably store the content of emails beyond its technical logs.
OVH SAS (France): hosting of the @diligeo.com mailboxes.
Google Ireland Limited (Gmail) (Ireland, data may be processed in the United States): receipt and storage of emails sent to Diligeo, including the files submitted through the form, for the period set out in section 2.5.
Upstash Inc. (United States, regional infrastructure in Europe): temporary storage of the double opt-in token, with the name and email address entered, while confirmation is pending (48 hours at most); anti-spam rate-limiting counters (truncated IP address, hash of the email address). No personal data is kept there for more than 48 hours.
Svix Inc. (United States): delivery and signature (HMAC) of the sending notifications Resend sends to Diligeo (recipient address, subject and status of the email).
Calendly LLC (United States): appointment scheduling, under standard contractual clauses. The calendar is loaded only on the start-your-case page.
Infomaniak Network SA / SwissTransfer (Switzerland): secure transfer of data-room documents. See section 2.4.2.
Anthropic, PBC (United States): automated processing by the Claude language models of the documents and data entrusted, solely for the purpose of producing the requested extraction and analysis. The data submitted is not used to train the models.
lemlist SAS (France): sending and tracking of approach emails to owners (section 2.4.4).
Printing and postal mailing provider: printing and delivery of approach letters (section 2.4.4).

Transfers outside the European Union: the US processors cited are bound by the European Commission's Standard Contractual Clauses (SCCs) or an equivalent mechanism under Article 46 GDPR (EU-US Data Privacy Framework certification where applicable), which govern the international transfer of personal data. Switzerland is recognized by the European Commission as offering an adequate level of protection (Decision 2000/518/EC).

Under no circumstances is your data sold, rented or transferred to third parties for commercial purposes.

2.4.1 Buyer case form

The data listed in section 2.2 and collected via the /onboarding form in the Buyer branch is processed in the context of pre-contractual measures taken at your request (Article 6(1)(b) GDPR), so that the Diligeo team can contact you regarding your acquisition project and produce the requested analysis. For the Target scouting and Preliminary diligence (pre-LOI) branches, the data processed includes: identity, contact details, professional profile, financing capacity, scoping elements of the contemplated transaction (valuation provided, shareholder current accounts, timetable) and the description of the available documents. When you identify a target, the data relating to its directors (identity, role) provided by you or obtained from public registers is processed on the basis of legitimate interest (Article 6(1)(f) GDPR), strictly to the extent necessary for the pre-LOI diligence; those persons have a right to object by writing to contact@diligeo.com.

This data is intended for the Diligeo team only and is not shared with any third party (apart from the technical processors cited in section 2.4, strictly within the limits of their function). It is retained for 24 months after the last contact, then deleted.

You have the rights of access, rectification, erasure and objection with respect to this data. To exercise them, write to contact@diligeo.com.

2.4.2 Transfer of the data room

To preserve the confidentiality of your data-room documents, they never pass through direct email or our web form. We use the SwissTransfer service (Infomaniak Network SA, Switzerland), which is GDPR-compliant and provides:

end-to-end AES-256 encryption of the transfer;
mandatory password protection, transmitted through a separate channel (telephone);
a limited lifetime for the link (30 days maximum);
automatic deletion from the servers after download or expiry.

The downloaded documents are stored on the professional workstations of the Diligeo team, with restricted access (strong authentication, disk encryption), and deleted at the latest 12 months after delivery of the analysis report, or immediately upon your written request to contact@diligeo.com.

Apart from the technical processors listed in section 2.4 (each strictly within the limits of its function), no data-room document is disclosed to a third party or used for any purpose other than the requested analysis.

2.4.3 Sourcing case form

The data listed in section 2.2 and collected via the /onboarding form in the Sourcing branch is processed in the context of pre-contractual measures taken at your request (Article 6(1)(b) GDPR), in order to qualify sale opportunities within your scope and to provide you with a corresponding deliverable.

The public data of legal entities and their directors used to produce the scouting file is collected from the French public registers (INSEE SIRENE, INPI RNE, DILA BODACC) and processed on the basis of legitimate interest (Article 6(1)(f) GDPR). An objection procedure is available by email at contact@diligeo.com. For a scope outside France, the equivalent public registers of the country concerned are read in the same way. This data is kept for the duration of the engagement, then for three years after the scouting file is delivered. If the client orders the approach of some companies, section 2.4.4 applies to their directors.

You have the rights of access, rectification, erasure and objection with respect to your personal data. To exercise them, write to contact@diligeo.com.

2.4.4 Approaching owners on behalf of a client

When a client orders it, Diligeo approaches, in the client's name, the owners of companies the client has selected in its scouting file, by handwritten letter, LinkedIn message or email. This section is addressed in particular to the owners contacted in this way.

Who is responsible. Diligeo and the client who requested the approach are joint controllers of the processing (Article 26 GDPR). They have set out their respective roles in writing:

Diligeo identifies the companies and their directors, drafts the messages with the client, sends them (from the client's account for LinkedIn), responds to the people contacted and keeps the objection list;
the client chooses the companies approached, approves each message before it is sent, then receives and handles the replies itself.

Whichever controller is concerned, you can exercise your rights with Diligeo, at contact@diligeo.com, which passes on to the client whatever concerns it.

Data processed. Director's first and last name and position; company name, registered address and business activity; professional email address and LinkedIn profile where public; date and channel of each message, and any request not to be contacted again. No sensitive data is processed.

Sources. Public company registers of the country concerned (in France: INSEE SIRENE, INPI RNE, DILA BODACC), the company's website and public professional profiles.

Legal basis. Legitimate interest (Article 6(1)(f) GDPR): the client's interest in proposing the acquisition of a business to its owner, and Diligeo's interest in carrying out this engagement. Messages are limited to the recipient's professional activity. In line with the rules on business-to-business prospecting (Article L34-5 of the French Postal and Electronic Communications Code), an email is only sent to a professional address, on a subject related to the recipient's position, and every email offers a way not to be contacted again.

Information. This section is permanently available. Anyone contacted who asks where their contact details come from receives a straightforward answer from the signatory or from Diligeo, with a link to this page.

Objection. Simply reply to the message asking for it, or write to contact@diligeo.com. Diligeo then removes your company from all its lists: it will no longer be proposed to any of its clients. Any messages still scheduled are cancelled.

Recipients. The Diligeo team, the client who requested the approach and the sending processors listed in section 2.4. Your data is never sold, rented or transferred.

Retention periods.

Data on the owners approached: deleted six months after the last message of the engagement.
Objection list: only the company's registration number and the date of the request are kept, for three years, so that the objection continues to be respected.
Replies to a message: received and kept by the client, under its own responsibility.

Your rights. Access, rectification, erasure, restriction and objection, under the conditions of section 2.6. You may also lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.

2.5 Retention period

Your data submitted via the /onboarding form is retained for 24 months after your last contact with the Diligeo team, then deleted, including from Diligeo's mailboxes. The data-room documents transferred via SwissTransfer follow a distinct cycle specified in section 2.4.2 (deletion at the latest 12 months after delivery of the report, or immediately upon written request).

The technical double opt-in token stored at Upstash, with the name and email address entered, has a lifetime of 48 hours maximum and is automatically purged after use (single-use). The anti-spam counters expire on their own: two hours at most for the truncated IP address, 48 hours at most for the hash of the email address.

Data on owners approached on behalf of a client and the objection list follow the periods in section 2.4.4.

2.6 Your rights

In accordance with the GDPR, you have the following rights:

Right of access: obtain a copy of your personal data
Right to rectification: correct inaccurate data
Right to erasure: request the deletion of your data
Right to restriction: restrict the processing of your data
Right to portability: receive your data in a structured format
Right to object: object to the processing of your data
Right to withdraw your consent: at any time, without affecting the lawfulness of processing based on consent carried out before that withdrawal

To exercise these rights, contact us at: contact@diligeo.com

In the event of a dispute, you may lodge a complaint with the CNIL (the French data-protection authority): www.cnil.fr

2.7 Security

Diligeo implements the following technical and organizational measures to protect your data:

Encryption in transit: all communications with the site and the processors use HTTPS (TLS 1.2 or higher). The HSTS header requires your browser to always connect over HTTPS.
Email double opt-in: your form submission triggers a confirmation email. Until you have clicked on that link, your address is not considered verified. This prevents impersonation by third parties and constitutes proof of consent.
Rate limiting: limits per IP address, per email address and an overall hourly cap prevent massive automated submissions and spam; a form submission coming from another website is refused.
Anti-bot honeypot: a hidden form field detects and silently rejects bot submissions.
File validation: CVs sent with an analysis request are checked (strict PDF format, size limited to 4 MB, rejection of PDFs that contain JavaScript, embedded files or automatically triggered actions, including in their compressed parts).
Restricted internal access: the workstations of the Diligeo team are protected by strong authentication and disk encryption.
Strict Content Security Policy (CSP): the site only executes scripts served from its own domain; no third-party script, no tracker.

3. Cookies and local storage

The diligeo.com website uses no cookies for tracking, analytics, audience measurement or advertising. No third-party measurement or advertising cookie (Google Analytics, Meta Pixel, etc.) is set. One exception: on the start-your-case page, Calendly's scheduling frame sets its own session and security cookies (_calendly_session, __cf_bm, _cfuvid), which it needs to work.

Anonymous visit counting: the site keeps aggregate counters (number of clicks on action buttons, number of views of the Data room review page), incremented by a request to the diligeo.com domain itself. This counting uses no cookie, no local storage, no identifier, and records neither your IP address nor your browser's characteristics: only monthly totals per page and per language are kept, for at most 25 months, with no personal data. Your truncated IP address serves solely as an anti-abuse safeguard at the time of the request and is not kept beyond that technical window (two hours at most), like the rest of the rate limiting described in section 2.7.

Content by country: the example on the home page (the map, the companies, the filed documents and the letter) follows the country you are browsing from (the United States example from the United States, for instance). That country is inferred from your IP address by our host, Vercel, at the time of the request. It serves solely to choose what is displayed: it is neither kept nor associated with you, and nothing is read from your device.

Browser-side local storage (localStorage): the /onboarding form saves a draft of your answers in your browser's local memory, under the key diligeo:onboarding:draft, so that you can resume your entry if you close the tab by mistake. This data:

is never transmitted to the Diligeo servers until you have explicitly submitted the form;
remains accessible only to your browser, on your device;
expires after 7 days: an older draft is erased on your next visit to the form;
can be erased at any time via your browser settings (the key diligeo:onboarding:draft in the domain's local storage).

Fonts: the site's fonts are self-hosted on the diligeo.com servers. No request is made to Google Fonts or to any other third-party service when pages load: your IP address is not transmitted to any third party through the mere consultation of the site.

4. Intellectual property

All the content of the diligeo.com website (text, graphics, logo, structure) is the property of Diligeo and is protected by intellectual-property law. Any reproduction, even partial, is prohibited without prior authorization.

5. Ordering target scouting online

Target scouting is ordered through the French form /fr/onboarding (stage "Repérage de cibles") or by email from get started: four answers set the scope of the collection, Diligeo confirms the price, then sends the invoice in reply to the confirmation email; payment is made by bank transfer.

Price. The price depends on the number of départements in the scope, according to the grid on the Pricing page; outside France and for an investment fund, it is set by quote; it is net of tax (VAT not applicable, Article 293 B of the French General Tax Code). Diligeo confirms it in writing before any payment, and it appears on the invoice.

Delivery. Target scouting is delivered in a private file available online, whose address and password are sent by email, within 24 hours for up to five départements and 72 hours at most beyond that, from payment; outside France, the time frame is confirmed before the order.

Performance and withdrawal. Payment constitutes an express request for immediate performance: the collection starts as soon as it is confirmed. A consumer client acknowledges that, as a result and in accordance with Article L221-28 of the French Consumer Code, the right of withdrawal can no longer be exercised once the service has been fully performed, and that a proportional amount is due for the work done if withdrawal occurs before delivery. If the requested scope cannot be served, Diligeo says so before any collection and refunds the payment in full.

Nature of the service. Target scouting flags companies from public registers and visible-market listings; it is neither an introduction service, nor a search mandate, nor an investment recommendation. The file is delivered to the client privately.

Approach to owners (optional). At the client's request, Diligeo approaches, in the client's name, the owners of the companies the client has selected, by handwritten letter, LinkedIn message or email, under a quote accepted beforehand. The client approves each message before it is sent and receives the replies directly. Diligeo takes no part in the discussions that follow, negotiates on behalf of no party, and takes neither commission nor equity in any acquisition. The processing of owners' data is described in section 2.4.4.

Joint responsibility for the data of owners approached. By ordering an approach, the client accepts the following commitments.

Purpose. For the approach to owners ordered by the client, Diligeo (Hugues Schaap, sole trader, SIREN 106 190 465) and the client are joint controllers of the processing of these owners' personal data, within the meaning of Article 26 GDPR.
Diligeo's role. Diligeo identifies the companies and their directors from public sources; drafts the messages with the client and sends them; keeps this policy available to the people contacted; keeps an objection list and checks it before any message is sent; acts as the point of contact for the people concerned.
The client's role. The client chooses the companies approached and approves each message before it is sent; makes its LinkedIn account available for messages sent through that channel; answers straightforwardly anyone who asks where their contact details come from, with a link to this policy; receives and handles the replies alone; uses the data received only for its acquisition project; forwards to Diligeo, within 72 hours, any objection, erasure or access request it receives directly; does not contact again a person who has objected.
Information of the people concerned. The essence of this agreement is made available to them in section 2.4.4.
Retention. Diligeo deletes the data on owners approached six months after the last message of the engagement, except for the objection list (registration number and date), kept for three years. The client keeps the replies for the duration of its acquisition project, and at most three years after the last exchange.
Security and incidents. Each party protects the data it holds. Any personal data breach is reported to the other party within 48 hours.
Term. This agreement applies for the duration of the approach and of the retention periods set out in article 5.

6. Nature of the analysis deliverables

Working documents, not legal advice. The preliminary diligence, full analysis and second opinion reports, as well as the draft letter of intent delivered with the preliminary diligence when the offer is retained, are working documents meant to inform the client's decision. They constitute neither legal advice, nor a statutory audit or chartered-accountancy engagement, nor investment advice. The draft letter of intent must be reviewed by the client's lawyer before it is sent to the seller; Diligeo drafts no legal instrument and does not bind the client towards any third party.

7. Update

This page was last updated on 13 October 2026.