LEGAL / DATA PRACTICES

Your data.
Handled like a system.

XHOXA designs and engineers digital products, platforms and intelligent systems. This Privacy Policy explains what information we collect when you visit our site, contact us, or work with us — and how that information is used, stored, shared and protected. We wrote it so a human can read it end to end.

Read the policy Contact us
Overview / 01

What this policy covers and who it applies to.

This Privacy Policy applies to the XHOXA website, any contact forms, project-start flows, email correspondence, and the limited personal data we handle while delivering design and engineering work for clients. It does not replace any separate data-processing agreement we may sign with a client for a specific engagement.

By using our website or submitting information to us, you acknowledge the practices described here. If you do not agree with them, please do not use the site or provide personal data through it. We update this document when our practices change; the “Last updated” date at the bottom reflects the current version.

We collect only what we need.

Contact details, project context and the technical signals required to run a modern website. Nothing for the sake of a larger database.

We do not sell personal data.

XHOXA does not sell, rent or trade the personal information of visitors or clients to third parties for their marketing purposes.

You can ask questions and exercise rights.

Access, correction, deletion and other rights are available through the contact channel listed at the end of this page.

Security is treated as a design constraint.

We apply reasonable technical and organisational measures appropriate to the data we actually hold and the risks that apply to it.

02 / INFORMATION WE COLLECT

Categories of data and how they reach us.

We distinguish between information you give us deliberately, information that is generated by your use of the site, and information that may appear in the course of a client project.

A / DIRECT

Information you provide

When you fill in a contact form, start a project brief, reply to an email, or otherwise communicate with us, you may give us your name, email address, organisation name, role, phone number (if you choose), project description, files you upload, and any other details you decide to include. We treat everything in that channel as intentional disclosure.

B / AUTOMATIC

Technical and usage data

Like most websites, ours records certain technical information when you visit: IP address (often truncated or anonymised where possible), browser type and version, device category, operating system, referring URL, pages viewed, approximate location derived from IP, timestamps, and basic interaction signals. This data helps us keep the site reliable, diagnose problems and understand aggregate traffic patterns.

C / COOKIES

Cookies and similar technologies

We use cookies and related storage mechanisms for essential site function, preference remembering, and (where you consent or local law permits) limited analytics. A fuller description appears in the Cookies section below. You can control cookies through your browser settings at any time.

D / PROJECT

Client-engagement data

When we work with an organisation, we may receive names, work email addresses, roles and operational context belonging to people at that organisation. That data is handled under the commercial agreement and any applicable data-processing terms, not under this website-focused policy alone. We do not treat client project data as a marketing list.

Purpose / 03

How we use the information we hold.

We use personal information only for the reasons it was collected or for closely related, legitimate purposes. We do not use it for unrelated secondary marketing without a lawful basis and, where required, your consent.

01

Respond and deliver

Answer enquiries, evaluate briefs, propose work, execute contracts, and provide the design and engineering services we have agreed to deliver.

02

Operate the site

Keep pages loading, fix errors, protect against abuse, measure basic performance, and improve clarity and accessibility of the experience.

03

Communicate clearly

Send project-related messages, confirmations, and (only if you have asked or local rules allow) occasional updates about our work or process.

04

Meet legal duties

Comply with applicable law, respond to lawful requests, defend legal claims, and maintain records required for tax, accounting or regulatory reasons.

05

Protect systems

Detect, prevent and investigate fraud, security incidents, spam, and misuse of our website or services.

06

Improve our practice

Analyse aggregate, non-identifying patterns so we can refine how we present our capabilities and how visitors move through the site.

Lawful bases / 04

Why we are allowed to process your data.

Depending on your location and the nature of the interaction, we rely on one or more of the following bases under applicable privacy law (including the GDPR where it applies).

Contract and pre-contract steps

When you request a proposal, start a brief, or enter into an engagement, we process the data necessary to take those steps and perform the contract.

Necessary

Legitimate interests

Running a secure, reliable website, responding to genuine enquiries, preventing abuse, and understanding aggregate traffic in ways that do not override your rights.

Balanced

Consent

Where we rely on consent (for example certain non-essential cookies or optional marketing messages), you can withdraw it at any time without affecting prior lawful processing.

Optional

Legal obligation

Retention of certain records, responses to valid legal process, and other processing required by the laws that apply to us.

Required
05 / COOKIES & SIMILAR TECHNOLOGIES

What we place, why, and how you control it.

Cookies are small text files stored on your device. We use them sparingly and primarily for function and measurement. Below is a practical breakdown rather than a legal checklist.

ESSENTIAL

Strictly necessary

These cookies (or equivalent storage) keep the site working: load balancing, security tokens, basic session state, and remembering choices that are required for the page to function. They cannot be turned off through our interface without breaking core behaviour; you can still block them in your browser if you accept the resulting limitations.

ANALYTICS

Performance & understanding

Where enabled, we may use analytics tools that set cookies or use similar identifiers to understand which pages are visited, how long sessions last, and where technical problems occur. We prefer aggregated views. Where local law requires consent for non-essential analytics, we will request it before those tools run.

PREFERENCE

Remembering choices

If we offer preference storage (for example language or reduced-motion settings), those cookies exist only to honour your choice on later visits. They are not used for advertising profiles.

CONTROL

Your browser is the switch

Most browsers let you refuse cookies, delete existing ones, or receive a warning before a cookie is set. Instructions are usually under “Privacy”, “Security” or “Cookies” in the browser settings. Blocking all cookies may limit some site features. We do not currently use advertising cookies or third-party ad networks on this site.

Disclosure / 06

When and with whom we share information.

We do not sell personal information. We share it only in the limited situations described below, and only to the extent needed for the purpose.

Service providers

Hosting, email delivery, analytics (where used), security tooling and similar infrastructure providers process data on our behalf under contractual terms that restrict their use of it. They are not free to repurpose it for their own marketing.

Professional advisers

Lawyers, accountants or insurers may receive limited information when it is necessary for advice, compliance or the defence of legal claims.

Legal and safety requirements

We may disclose information if required by law, regulation, legal process or governmental request, or if we believe in good faith that disclosure is necessary to protect the rights, property or safety of XHOXA, our clients, or the public.

Business transfers

If XHOXA is involved in a merger, acquisition, asset sale or similar transaction, personal data may be transferred as part of that process. We will take reasonable steps so that the receiving party continues to respect the commitments in this policy.

Cross-border / 07

International transfers.

XHOXA works with organisations and infrastructure that may be located in different countries. When personal data moves across borders we take steps appropriate to the legal framework that applies.

Standard contractual safeguards

Where required (for example under GDPR for transfers outside the EEA/UK), we use standard contractual clauses or equivalent mechanisms recognised by the relevant authorities.

Recognised

Service-provider locations

Some of our infrastructure and tools are operated by providers with data centres in multiple regions. We select providers that offer appropriate security and contractual protections.

Assessed

Your location matters

The specific rights and transfer rules that apply to you can depend on where you live. If you have questions about how your data is transferred, contact us using the details at the end of this policy.

Contextual
08 / SECURITY MEASURES

How we protect the data we hold.

No system is perfectly secure. We apply technical and organisational measures that are reasonable and appropriate to the volume and sensitivity of the personal data we actually process.

ACCESS

Limited access

Personal data is accessible only to people who need it for the purposes described in this policy. Client project data stays within the engagement team.

TRANSIT

Encryption in transit

Our website is served over HTTPS. Communication channels we control are protected with modern transport encryption where supported.

STORAGE

Careful storage

We favour reputable hosting and infrastructure providers that offer strong security baselines, and we avoid keeping personal data longer than necessary.

PROCESS

Organisational habits

We treat client and visitor data as sensitive by default. Unnecessary copies are avoided; access is reviewed when roles change.

INCIDENT

Incident response

If we become aware of a security incident that affects personal data, we will investigate promptly and notify affected individuals and regulators when the law requires it.

LIMIT

Honest limits

You also play a role: keep your own devices and email accounts secure. We cannot control the security of networks or devices outside our systems.

Lifecycle / 09

How long we keep information.

We retain personal data only for as long as it is needed for the purposes set out in this policy, or longer if required by law, regulation or a legitimate need to resolve disputes and enforce agreements.

Contact-form submissions and enquiry correspondence are typically kept for a limited period after the last meaningful interaction, unless they lead to a client relationship. Project-related records follow the retention schedule in the relevant commercial agreement and any applicable legal retention obligations. Technical logs are kept for shorter operational windows sufficient to maintain security and diagnose issues. When data is no longer needed we delete or anonymise it in a way that prevents identification.

Your rights / 10

What you can ask us to do.

Depending on where you live, privacy laws may give you specific rights over personal data we hold about you. The list below summarises the rights most commonly available under regimes such as the GDPR and similar frameworks. We will respond to valid requests within the timeframes required by applicable law.

Access

You can request confirmation of whether we process personal data about you and, where we do, receive a copy of that data and related information.

Right of access

Correction

You can ask us to correct inaccurate personal data or complete incomplete data that we hold about you.

Rectification

Deletion

In certain circumstances you can request that we erase personal data. This right is not absolute; legal or contractual obligations may require us to retain some information.

Erasure

Restriction & objection

You may have the right to restrict certain processing or to object to processing based on legitimate interests, including processing for direct marketing.

Control

Portability

Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive your data in a structured, commonly used format.

Portability

Withdraw consent

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing that took place before the withdrawal.

Consent

Complaint

You have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or place of the alleged infringement. We encourage you to contact us first so we can try to resolve the issue.

Authority
Minors / 11

Children’s privacy.

Our website and services are directed at businesses and adult professionals. We do not knowingly collect personal information from children under the age of 16 (or the equivalent minimum age in the relevant jurisdiction).

If you believe a child has provided us with personal data, please contact us using the details below. We will take reasonable steps to delete the information promptly once we become aware of it.

External sites / 12

Links to other websites.

Our site may contain links to third-party websites, tools or platforms (for example social profiles or external documentation). Those sites have their own privacy practices. This policy does not apply to them.

We are not responsible for the content or privacy practices of any third-party site. We encourage you to read the privacy notices of any site you visit after leaving ours.

Updates / 13

Changes to this Privacy Policy.

We may revise this policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. When we make material changes we will update the “Last updated” date and, where appropriate, provide additional notice on the website.

Review the current version

The version published on this page is the one that applies. Continued use of the site after an update constitutes acceptance of the revised policy where permitted by law.

Current

Material changes

If a change significantly affects how we use personal data we already hold, we will take reasonable steps to inform affected individuals where required.

Notice
Contact / 14

Questions about this policy or your data.

If you have questions about this Privacy Policy, want to exercise a right, or need to report a concern about how personal data is handled, contact us. We will respond as promptly as reasonably possible and within any deadlines set by applicable law.

Email: business@xhoxa.com

Please include enough detail for us to locate the relevant records (for example the email address you used to contact us, and the nature of your request). We may need to verify your identity before acting on certain requests.

Go to contact page

Last updated: November 10, 2026
This Privacy Policy is provided by XHOXA for the website and related contact channels operated under that name. It is intended to be clear and complete; it is not legal advice to you.

Message us