Privacy Notice

Who we are

Crestmont Business Services is a Denmark-based sole proprietorship operated by Mona Al Khalili. We provide structured B2B receivables governance services to UK, Irish, and European clients.

CVR: 46425650. Registered address: [PLACEHOLDER].

For all data protection enquiries: founder@crestmontbusinesservices.com

What personal data we collect

We collect personal data through three channels:

• The contact form on our website (name, business email, company name, role, and the content of your enquiry)
• Direct correspondence with us (email content and attached documents)
• Operational engagement with clients (data necessary to perform our services, governed by our service agreement)

We use Google Analytics to understand how visitors use our website. This is activated only with your consent via the cookie banner. Google Analytics collects data including your IP address (anonymised), device and browser information, and the pages you view. If you decline analytics cookies, this data is not collected. We do not use analytics to profile or identify individual visitors, and we do not share analytics data with advertising networks.

The lawful basis for processing

• For enquiries submitted through the contact form: legitimate interest in responding to commercial enquiries and assessing potential engagement fit
• For client engagements: contract performance under the service agreement signed with the client
• For correspondence with prospects who have not become clients: legitimate interest in operating the practice

How long we keep your data

• Enquiry data from the contact form: retained for 12 months from submission, unless the enquiry progresses to an Initial Assessment or engagement
• Initial Assessment correspondence and reports: retained for 3 years from the date of the observation report
• Client engagement data: retained for the duration of the engagement and for a further 5 years following termination, or longer where required by Danish accounting and tax law

Personal data is deleted at the end of the applicable retention period unless a longer retention is required by law.

Who we share data with

We use the following third-party services as sub-processors. Each is bound by data processing terms compliant with GDPR.

• Google Analytics — website traffic measurement (activated only with visitor consent)
• Google Workspace — email, document storage
• Mailmeteor — cold outreach correspondence
• Airtable — pipeline management
• Yousign — e-signature
• Dinero — accounting and invoicing

This list is current as of the date of this notice. We do not share personal data with any party not on this list without your explicit consent, except where required by law.

International data transfers

Some of our sub-processors are based outside the European Economic Area, including in the United States (Google Analytics, Google Workspace, Airtable). Where this is the case, transfers are governed by the EU Standard Contractual Clauses, executed between Crestmont and the relevant vendor, in accordance with Chapter V of the GDPR.

Your rights

You have the following rights regarding your personal data:

• The right to be informed about how we process your data (this notice)
• The right of access — to obtain a copy of the personal data we hold about you
• The right of rectification — to have inaccurate data corrected
• The right of erasure — to have your data deleted where the lawful basis no longer applies
• The right to restrict processing — to limit how we use your data
• The right to data portability — to receive your data in a structured, machine-readable format
• The right to object — to processing based on legitimate interest

To exercise any of these rights, write to founder@crestmontbusinesservices.com. We will respond within 30 days.

Complaints

If you believe we have not handled your personal data in accordance with the law, you have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet): datatilsynet.dk

Changes to this notice

This notice was last updated on 21 May 2026. We will update this notice as our processing practices evolve. The current version is always available at this URL.