Privacy Policy

1Who we are

Xium Labs Ltd is the data controller responsible for your personal data. We are a company registered in England and Wales under company number 16702035, with our registered office at 124 City Road, London, EC1V 2NX, United Kingdom.

We are registered with the UK Information Commissioner's Office (ICO) under registration reference ZC070384.

For any privacy matter, including exercising your rights, you can contact us at [email protected].

2The personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity and contact data: your name, organisation, email address and telephone number, provided when you complete our contact form, subscribe to our newsletter or engage our services.
• Enquiry and project data: the project name, services of interest and any details you choose to share with us when contacting us.
• Engagement data: information provided in the course of delivering services to you, which may include technical information about your systems where you have engaged us for security testing or software development.
• Technical and usage data: where you consent to analytics cookies, we collect anonymised information such as your (truncated) IP address, device and browser type, pages visited and referring source, via Google Analytics.
• Communications data: the content of your correspondence with us.

We do not intentionally collect special category data through the website. Please do not send us sensitive personal data through the contact form.

3How and why we use your data (lawful bases)

We only process your personal data where we have a lawful basis to do so under the UK GDPR:

• Consent: to send you our newsletter (which you may withdraw at any time) and to set analytics cookies.
• Legitimate interests: to respond to your enquiries, to operate, secure and improve our website, and to promote our services to businesses, provided your rights do not override those interests.
• Performance of a contract: to provide the services you have engaged us for, and to manage our relationship with you.
• Legal obligation: to comply with our legal and regulatory obligations, including accounting and tax requirements.

4Who we share your data with

We do not sell your personal data. We share it only with trusted service providers (processors) who act on our instructions, and where required by law. These fall into the following categories:

• Infrastructure providers: secure hosting of our website, database and file storage, including enquiry records.
• Email service providers: delivery of transactional and newsletter email.
• Google Analytics: website analytics, only where you have consented to analytics cookies.

We may also disclose personal data where required to comply with a legal obligation, to enforce our agreements, or to protect our rights, property or safety, or those of others.

5International transfers

Some of our processors may store or process data outside the UK. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, so that your data receives an equivalent level of protection.

6How long we keep your data

We keep personal data only for as long as necessary for the purposes for which it was collected. Enquiry data is typically retained for up to 24 months from our last contact; client engagement records are retained for the duration of the engagement and for up to 7 years afterwards to meet legal and accounting obligations; newsletter data is retained until you unsubscribe.

7Your rights

Under the UK GDPR you have the right to:

• be informed about how your data is used;
• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to our processing;
• data portability;
• withdraw consent at any time, where processing is based on consent; and
• not be subject to solely automated decision-making with legal or similarly significant effects (we do not carry out such processing).

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

8Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the ICO at ico.org.uk or by calling 0303 123 1113.

9How we protect your data

As a security-focused company, we take the protection of personal data seriously. We use appropriate technical and organisational measures, including encryption in transit, access controls and reputable infrastructure providers, to protect personal data against unauthorised access, loss or disclosure. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10Children

Our website and services are directed at businesses and are not intended for children. We do not knowingly collect personal data from anyone under 16.

11Changes to this policy

We may update this Privacy Policy from time to time. The date at the top shows when it was last revised. Material changes will be highlighted on this page.