1. Purpose and scope
This Website Privacy Notice explains how Xworks Holdings Ltd collects and uses personal data when you visit xworks.systems or related public pages, submit a contact or evidence-review enquiry, communicate with us, receive business communications, or act as a contact for a prospective or current business relationship.
The Site and our services are intended for organisations and adult business users. They are not directed to children, and we do not knowingly collect personal data relating to children through the Site.
2. Controller and contact details
Xworks Holdings Ltd is the controller for the processing described in this Notice. Xworks is incorporated in England and Wales with company number 16771998 and is located at 66 Paul Street, London EC2A 4NE, United Kingdom.
Privacy contact: accounts@xworks.systems. Telephone: +44 2045 384 245. Please mark correspondence for the attention of the Privacy Lead. ICO registration number: ZB039948.
Xworks may act as a processor when it handles personal data contained in customer evidence under a contracted Xworks service. In that situation, the customer or other relevant organisation determines the purpose and means of processing, and the applicable contract, data processing agreement and that organisation's privacy information govern the processing. This Notice still applies where Xworks processes business-contact, service-security, billing, governance or legal-compliance data for its own purposes.
3. Personal data we collect
Depending on how you interact with us, we may collect:
- identity and professional data, such as your name, role, employer or organisation and business identifiers;
- contact data, such as business email address, telephone number and postal address;
- enquiry and communications data, including your message, evidence type and approximate volume, correspondence, meeting notes and support or complaint records;
- technical data, such as IP address, user-agent, browser, device type, operating system, timestamps, requested URL, referrer, coarse location and security logs;
- website measurement data, such as page views, route, filtered query parameters, network speed, browser and device characteristics, country-level location and web-performance metrics;
- security and anti-abuse signals processed when you use a protected form, including IP address, TLS fingerprint, user-agent, site key, origin and a short-lived challenge token;
- business-relationship data, such as your organisation's requirements, communications preferences, due-diligence information and relationship history; and
- marketing-preference data, including whether you have opted out or withdrawn consent.
Do not submit special-category personal data, criminal-offence data, identity documents, evidence files or confidential supply-chain records through a public website form. If such data is required for a contracted service, Xworks will provide or agree an appropriate secure channel and applicable terms.
4. How we obtain personal data
We collect personal data directly from you; automatically from your device and browser; from the organisation you represent, colleagues or referral sources; and from legitimate public sources such as corporate registries and professional websites. If another person gives us your business contact details, we use them only for relevant business purposes and provide this Notice at the appropriate time.
5. Purposes, lawful bases and storage-technology position
We process personal data only where we have a lawful basis. The main purposes and bases are set out below. More than one basis may apply where the facts and law permit.
| Purpose | Data | UK GDPR basis | PECR position |
|---|---|---|---|
| Deliver and secure the Site | Technical, log and anti-abuse data | Legitimate interests in reliable, secure services; legal obligations relating to security | Strictly necessary security or communications exception where applicable |
| Measure and improve the Site | Page, route, referrer, coarse location, device and performance data | Legitimate interests in improving the Site using minimised, aggregate statistics | Statistical-purposes exception, with a simple free means to object |
| Respond to enquiries and arrange reviews | Identity, contact, organisation and message data | Steps at your request before a contract; legitimate interests in responding to business contacts | Not generally applicable |
| Manage business relationships | Contact, role, correspondence and relationship data | Contract where you are a party; otherwise legitimate interests in managing business relationships | Not generally applicable |
| Due diligence, fraud prevention and compliance | Identity, organisation, public-source and security data | Legal obligation; legitimate interests in protecting Xworks and counterparties | Strictly necessary security exception where applicable |
| Relevant business marketing | Business contact and preference data | Legitimate interests for proportionate B2B communications; consent where required | PECR consent or applicable business-marketing rule |
| Legal claims and governance | Relevant records from the categories above | Legal obligation; legitimate interests in establishing, exercising or defending rights | Not generally applicable |
Our legitimate interests include operating and securing the Site, understanding aggregate use, responding to business enquiries, managing relationships, protecting our rights and preventing fraud. We balance those interests against the impact on individuals and use proportionate safeguards. You may object as explained in section 12.
6. Website measurement and security services
The Site currently uses Vercel Web Analytics and Vercel Speed Insights. Web Analytics uses a request-derived hash rather than third-party cookies; the visitor-session identifier is automatically discarded after 24 hours. Speed Insights records anonymous page-performance data and is not designed to reconstruct a browsing session or identify an individual. We use both solely to produce aggregate statistics and improve the Site.
Protected forms use Cloudflare Turnstile to distinguish people from automated abuse. Cloudflare processes browser and connection signals to provide the service on our behalf and also processes limited signals as a controller to improve its bot-detection capabilities, as described in its Turnstile privacy information.
Some pages currently request website assets from external providers, including Google Fonts and the Tailwind content-delivery network. Those providers receive ordinary request information such as IP address, user-agent, URL and timestamp. We do not use those requests for advertising or profiling.
See our Cookie Notice for the current technology schedule and the Website measurement control.
7. Sharing personal data
We may share personal data, only where necessary, with:
- hosting, analytics and performance providers, including Vercel;
- website-security and anti-abuse providers, including Cloudflare Turnstile;
- content-delivery, font, email, communications, customer-relationship and IT service providers;
- other Xworks group entities where they support the relevant activity and are subject to appropriate controls;
- independent verification or assurance providers only where you ask us to coordinate an engagement or another lawful basis applies;
- professional advisers, insurers, auditors and financiers under duties of confidentiality;
- courts, regulators, law-enforcement bodies and public authorities where required or permitted by law; and
- a buyer, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.
Service providers acting as processors must follow our documented instructions, protect personal data and use it only for the contracted purpose. Some providers also act as independent controllers for limited purposes identified in their own notices.
8. International transfers
Some providers may process personal data outside the United Kingdom. When a restricted transfer is made, we use a lawful transfer mechanism and supplementary safeguards as required. These may include UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, supported by a transfer risk assessment where required.
You may contact the Privacy Lead for more information about the safeguards relevant to your personal data. Commercial or security-sensitive provisions may be summarised rather than disclosed in full.
9. Retention
We keep personal data only for as long as reasonably necessary for the stated purpose, including legal, accounting, security and dispute requirements. Our standard targets are:
| Record | Standard retention target |
|---|---|
| Vercel Web Analytics session identifier | Automatically discarded after 24 hours; aggregate reports retained in the Xworks account for up to 24 months. |
| Vercel Speed Insights | Aggregate performance reports retained for up to 24 months; the service is not designed to reconstruct individual browsing sessions. |
| Website and security logs | Normally up to 12 months, unless a longer period is needed to investigate an incident or establish legal claims. |
| Enquiries and unsuccessful opportunities | Up to 24 months after the last meaningful contact. |
| Customer, supplier and partner contacts | For the relationship and up to 7 years after it ends where needed for contractual, tax, audit or claims purposes. |
| Marketing records | Until you opt out or the contact is no longer relevant; a minimal suppression record may be retained to honour the opt-out. |
| Rights requests and complaints | Normally 6 years after closure, to demonstrate handling and protect legal rights. |
We may retain data longer where law, litigation, an investigation or a legal hold requires it. We may anonymise information so that it no longer identifies an individual and use the anonymous information for legitimate analytical or statistical purposes.
10. Security
We use proportionate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or access. Measures may include access controls, encryption in transit, logging, supplier controls, data minimisation and incident procedures. No internet service is completely secure, and we cannot promise absolute security.
11. Automated decisions and artificial intelligence
The public Site does not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Xworks does not use artificial intelligence to verify claims, score evidence, approve records or assign verification states. If a future activity materially changes this position, we will provide appropriate information before the processing begins.
12. Your rights
Depending on the circumstances, you may have the right to:
- ask for access to your personal data and information about its use;
- ask us to correct inaccurate or incomplete data;
- ask us to erase data where there is no overriding reason to retain it;
- ask us to restrict processing in specified circumstances;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- receive certain data in a portable format where the legal conditions apply;
- withdraw consent at any time, without affecting earlier lawful processing; and
- seek safeguards relating to qualifying solely automated decisions.
To exercise a right, email accounts@xworks.systems and provide enough information for us to identify the relevant records. We may request proportionate proof of identity. We do not usually charge a fee. We normally respond within one month, subject to lawful extensions for complex or multiple requests.
13. Data-protection complaints
You may make a data-protection complaint by emailing accounts@xworks.systems with the subject “Data protection complaint”, or by writing to the Privacy Lead at our address above. Please describe what happened, the data involved, relevant dates and the outcome you seek.
We will facilitate the complaint, acknowledge it no later than 30 days after receipt, take appropriate steps to investigate, and tell you the outcome without undue delay. If more information is needed, we will explain what is required. We will keep an appropriate record of the complaint and our response.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk. You may contact the ICO at any time, although we would appreciate the opportunity to address the issue first.
14. Direct marketing
We may send proportionate business-to-business communications where permitted and relevant to your role. We obtain consent where law requires it. You can opt out at any time by using an unsubscribe mechanism in the message or contacting the Privacy Lead. Opting out of marketing does not stop necessary service or relationship communications.
15. Third-party sites
The Site may link to third-party websites or services. Their operators control their own processing. This Notice does not apply to them, and you should read their privacy information before providing personal data.
16. Changes to this Notice
We review this Notice regularly and may update it when our website, providers or legal obligations change. The current version is the version published on the Site, and the “Last updated” date identifies the latest revision. We will provide a more prominent notice where a change materially affects individuals.
17. Contact
Privacy questions, rights requests and complaints should be sent to accounts@xworks.systems or to the Privacy Lead, Xworks Holdings Ltd, 66 Paul Street, London EC2A 4NE, United Kingdom. General website enquiries may be sent to hello@xworks.systems.