Data Room

What is a data room?

Data room refers to the access-protected repository, built on a fixed structure, of all the documents that investors or prospective buyers need to review a company. Today it is almost always a virtual data room (VDR), that is, a platform with permission management, logging of access and a guided question process. It resembles a locked archive in which each visitor sees only the shelves for which they have been given a key, and in which every visit is recorded.

The data room is the working tool of due diligence, the thorough review of a company by investors or buyers before a contract is concluded, in financing rounds and in company sales. It is set up and filled by the company, usually coordinated by the transaction adviser. Access is given to investors or buyers and their advisers on legal, tax, financial and technical matters. In a company purchase it is at the same time the basis of evidence: what was disclosed in the data room can decide whether a warranty claim exists later.

Contents of a data room: checklist by review area

The structure follows the review areas, so that every review team on the other side finds its documents without searching. Each folder and each document receives a number to which questions, review reports and later the contract can refer. The following areas are common:

• Corporate law: commercial register extract, articles of association, list of shareholders, shareholders' agreements, resolutions, cap table.
• Finance: annual financial statements, ongoing management accounts, trial balances (overviews of all accounts in the bookkeeping), plan, derivation of the metrics.
• Tax: tax assessments, tax audit reports, open proceedings.
• Contracts: customer and supplier contracts, lease, leasing and financing agreements, especially those with termination rights on a change of control, that is, a change of the majority shareholder.
• Personnel: employment contracts in anonymised form, participation programmes, company policies, commitments to key people.
• Intellectual property and IT: trademarks, patents, evidence of the transfer of rights by employees and freelance developers (IP assignment), licences, use of open-source software, data protection.
• Litigation and authorities: ongoing and threatened proceedings, permits, grant award notices.

An index listing all documents with number, title and date is updated with every addition. It often later becomes an annex to the contract.

Permissions and tiered visibility

Not every interested party receives all documents at every point in time. Permissions are assigned per folder and per user group, for example separately for interested parties and their advisers. Usual settings are view-only without download, watermarks with name and time, and blocks on printing and forwarding.

Release takes place in stages tied to process steps. In a sale process, interested parties first receive overview information after signing a confidentiality agreement (NDA). With a letter of intent (LOI) comes broader access, with redactions for sensitive data such as customer names, individual prices and salaries. Unredacted documents are generally received only by the party in exclusivity. In financing rounds the tiering is usually simpler: before the term sheet a selected set is enough, and full access follows afterwards.

If an interested party is a competitor of the target company, competition law demands additional caution. Competitively sensitive information such as current prices, margins per customer or strategy plans must not be exchanged before closing in a way that could influence market behaviour. Such data is made accessible only in summarised form or through a separate area for a clean team. Its members do not work in the acquirer's operating business and are obliged to keep information confidential from their own company.

Question process and logging

The reviewers' questions run through a question module of the data room or a managed list (Q&A process, from questions and answers), not through individual emails. Each question receives a number, an allocation to a review area, a person responsible on the company's side and a deadline. Answers are coordinated before release and, where they refer to documents, given the document's number. This keeps it traceable what was answered when, even with several hundred questions.

The platform logs who opened which document, when and for how long. This serves confidentiality and at the same time gives indications of the interest of individual bidders. At the end of the process, the data room is saved on data carriers in the state that formed the basis of the contract. These are often deposited with the notary or referred to in the contract, so that it can later be established what was disclosed.

Legal framework of the data room

• Disclosure and knowledge: Whether the entire content of the data room counts as disclosed, or only what is listed in the disclosure schedule (disclosure schedule) as an exception to the warranties, is often disputed in the purchase agreement. Whether the buyer can later rely on a breach of warranty depends on it.
• Data protection: Personal data of employees and customers may be disclosed only to the extent that a legal basis exists. As a rule this is a legitimate interest after a balancing of interests (Article 6(1)(f) of the EU General Data Protection Regulation, GDPR; in German Datenschutz-Grundverordnung, DSGVO). In early stages it is therefore anonymised or summarised.
• Trade secrets: The protection of the German Trade Secrets Act (Gesetz zum Schutz von Geschäftsgeheimnissen, GeschGehG) is enjoyed only by information that is subject to appropriate confidentiality measures. Confidentiality agreement, permissions concept and logging are among these measures.
• Management's duty of confidentiality: The management of a GmbH (German limited liability company) is obliged to keep trade secrets confidential. In a share sale, opening the data room is therefore in practice often secured by a shareholders' resolution.

Practical example: data room in the sale of a software company

The shareholders of a software company with around 60 employees sell the majority of their shares. Five interested parties sign a confidentiality agreement, including a competitor. The data room is opened in three stages:

1. After the confidentiality agreement: information memorandum, summarised financial figures for the last three years, the plan and an overview of products and customer groups without names.
2. After three interested parties have submitted an LOI: contracts, financial statements, trial balances and an anonymised personnel overview; names and prices of the ten largest customers remain redacted. Margins per customer are seen at the competitor only by its clean team.
3. In exclusivity with one interested party: unredacted customer contracts, employment contracts of the executives and details of ongoing proceedings.

In the course of the review, 240 questions arrive through the question module: 60 on finance, 70 on contracts, 45 on personnel, 40 on intellectual property and IT and 25 on tax. The access logs show early that one of the three bidders hardly opens any documents after the second stage; it withdraws its interest two weeks later. At signing, the data room is frozen, saved and referred to in the purchase agreement.

Distinction: data room, due diligence and disclosure schedule

• Due diligence: the review itself. The data room is its most important working tool but replaces neither management meetings nor on-site visits.
• Disclosure schedule: the contractual list of exceptions to the warranties. The data room supplies the material, the schedule the legally decisive selection.
• Vendor due diligence: a review commissioned by the seller, the reports of which are provided in the data room. It shortens the buyers' review but does not replace it.
• Information memorandum: the sales document that describes the company and business model. It is often in the first stage of the data room but is not itself a review document.

Common mistakes

• Set up only on request. If the data room is set up only when an interested party asks for it, several weeks are missing in the timetable.
• Adverse matters not disclosed. Adverse circumstances generally come to light in the review. If they are not disclosed, credibility suffers and warranty claims threaten.
• No version discipline. Several versions of the same document without clear labelling produce queries and doubts about the care of the finance function.
• Too much opened too early. Customer names, prices and salaries in the first stage give even interested parties without serious intent to buy a complete view.
• Questions answered by email. Answers outside the question process cannot later be reliably evidenced.
• No state saved at contract signing. Without archiving, it cannot be proved in a dispute what was disclosed.

Frequently asked questions

When is a data room set up?

Before the first approach to investors or buyers. Experience shows that compiling it takes longer than expected, longest usually the evidence of the transfer of rights for software and the documents of earlier financing rounds.

Is cloud storage enough, or is a data room provider needed?

For a small financing round, cloud storage may suffice if rights can be assigned per folder and access can be traced. In a company sale, specialised providers of virtual data rooms are usual, because watermarks, detailed logs, redactions and a question module are standard there. Server location, data processing agreement, archiving at closing and the pricing model also count in the selection.

Who gets access to the data room?

Only the approved persons on the side of the interested parties and their advisers, as well as the company's project team. Employees outside this team often learn of a sale process only late, to avoid unrest in the company.

May personnel data go into the data room?

Yes, but only to the extent required and in tiers. In early stages, anonymised overviews of roles, pay bands and contract types suffice. Named contracts of executives are generally released only in exclusivity and after weighing the interests of those concerned.

What happens to the data room after closing?

It is saved in the state at contract signing and then closed. The saved copy is the basis of any later dispute about warranties. Interested parties that did not win must return or delete the documents received in accordance with the confidentiality agreement.

The Roemer Capital view

In every transaction process, the data rooms of Roemer Capital follow the same numbered structure. Companies thereby see early which documents are missing, and progress can be read off the filled positions. Because the structure is fixed, a data room can be provided within 24 hours; filling begins before the first approach and not only at the request of an interested party.

Roemer Capital tiers visibility by process step: before the term sheet or LOI, interested parties see a selected set, afterwards the full data room. Whether individual details such as customer names, individual prices or salaries stay redacted until exclusivity is determined with the management. Where competitors are among the interested parties, Roemer Capital pays attention to the limits under competition law.