Legal Documentation
Privacy Policy
01. Who We Are
Whales Finance ("we", "us", or "our") is a financial advisory and CFO services company providing strategic financial leadership to AI, IT, and SaaS companies. Our website is located at https://whalesfinance.io. We are the data controller responsible for the personal data collected through this website and in connection with our services. This Privacy Policy explains how we collect, use, store, and protect your personal information in compliance with the General Data Protection Regulation (GDPR) and applicable data protection law.
Your privacy matters to us. We collect only what is necessary, store it securely, and never sell your personal data to third parties.
02. Data We Collect
We may collect the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Identity data | First name, last name, job title | You provide directly |
| Contact data | Email address, phone number, company name | You provide directly |
| Communication data | Messages sent via contact forms or email | You provide directly |
| Technical data | IP address, browser type, device type, pages visited | Automatically collected |
| Usage data | How you interact with our website and content | Automatically collected |
We do not knowingly collect personal data from individuals under the age of 16.
03. How We Use Your Data
We use your personal data for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Responding to enquiries and contact form submissions | Legitimate interests / Contract |
| Delivering financial assessment results and advisory services | Contract performance |
| Sending relevant insights, articles, or service updates (newsletter) | Consent |
| Improving our website and understanding visitor behaviour | Legitimate interests |
| Complying with legal and regulatory obligations | Legal obligation |
| Fraud prevention and website security | Legitimate interests |
We will not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
04. Legal Basis for Processing
Under GDPR, we rely on the following legal bases to process your personal data: Consent - when you subscribe to our newsletter or submit an assessment form, you give us explicit consent to process your data for that purpose. You may withdraw consent at any time. Contract performance - when we need to process your data to deliver the services you have requested or engaged us for. Legitimate interests - when processing is necessary for our legitimate business interests (e.g. improving our website, responding to enquiries), provided these interests are not overridden by your rights. Legal obligation - when we are required to process data to comply with applicable law.
05. Data Sharing & Third Parties
We do not sell, rent, or trade your personal data. We may share data with trusted third parties only where necessary:
| Recipient | Purpose | Location |
|---|---|---|
| Website hosting provider | Hosting and technical infrastructure | USA (with safeguards) |
| Email service provider | Sending and receiving email communications | USA (with safeguards) |
| Analytics provider (e.g. Google Analytics) | Website usage analysis | USA (with safeguards) |
All third-party processors are bound by data processing agreements and required to implement appropriate security measures.
07. Data Retention
We retain your personal data only for as long as necessary for the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Contact and enquiry data | 3 years from last contact |
| Client service data | 5 years from end of engagement |
| Newsletter subscribers | Until consent is withdrawn |
| Website analytics data | 26 months (Google Analytics default) |
| Financial records (invoices, contracts) | 5 years (accounting law requirement) |
When data is no longer required, it is securely deleted or anonymised.
08. Your Rights Under GDPR
As a data subject under GDPR, you have the following rights: · Request a copy of the personal data we hold about you. · Ask us to correct inaccurate or incomplete data. · Request deletion of your data ("right to be forgotten") where applicable. · Ask us to limit how we process your data in certain circumstances. · Receive your data in a structured, machine-readable format. · Object to processing based on legitimate interests or for direct marketing. · Withdraw consent at any time where processing is consent-based. · Lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. To exercise any of these rights, please contact us at the details in Section 10. We will respond within 30 days.
09. International Data Transfers
Some of our third-party service providers (such as analytics tools) may transfer data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, including: • Standard Contractual Clauses (SCCs) approved by the European Commission • Transfers to countries with an EU adequacy decision • Data Processing Agreements with all relevant vendors You may request further information about the safeguards we use for international transfers by contacting us directly.
10. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us using the details below.
This policy was last updated on 30 May 2026. We reserve the right to update this Privacy Policy at any time. Material changes will be communicated via our website.