Privacy Policy
We build systems that handle other organisations' data for a living, so we hold ourselves to the standard we ask of them. This notice explains what we collect through this website and in the course of our work, why we collect it, how long we keep it, and the rights you can exercise over it.
Last updated 5 September 2026 · Applies to AiXL Consultancy Ltd. and this website.
1. Who we are
AiXL Consultancy Ltd. is the data controller for the personal data described in this notice. We are a technology and IT consultancy registered in England and Wales, company number [company number], with a registered office at [registered office address].
Our registration with the Information Commissioner's Office is [ICO registration number]. Where we build or run systems on your behalf under a contract, we usually act as your processor rather than as a controller, and our data processing agreement governs that work instead of this notice.
2. What we collect
We collect only what we need for a stated purpose.
- When you contact us — your name, work email, company, telephone number if you give it, and whatever you choose to tell us about the work. This comes from you directly, through the enquiry form or by email.
- When you visit the site — your IP address, browser and device type, the pages you view and the site you arrived from. Some of this is written to our web server logs as a necessary part of serving and protecting the site; the rest is only collected if you agree to analytics cookies.
- During an engagement — business contact details for the people we work with, and any personal data contained in material you ask us to process. We ask clients not to send us personal data that is not needed for the work.
We do not buy contact lists, and we do not collect special category data through this website.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Replying to your enquiry and scoping possible work | Legitimate interests — responding to someone who approached us; or steps prior to entering a contract |
| Delivering a project and supporting it afterwards | Performance of a contract |
| Keeping the site available, and defending it against attack | Legitimate interests — security and continuity of our service |
| Understanding how the site is used | Consent — set through the cookie banner, and withdrawable at any time |
| Measuring campaigns | Consent — as above |
| Accounting, tax and statutory records | Legal obligation |
Where we rely on legitimate interests we have considered whether our interest is overridden by your rights, and we will stop if you object and we have no overriding ground to continue.
4. Your data is not used to train models
This is a commitment, not an aspiration. Material you send us — enquiries, documents, or anything processed inside a system we build for you — is not used to train, fine-tune or improve any general-purpose model, ours or a third party's. Where an engagement uses a model provider, we contract for training to be disabled and we name the sub-processors involved before the work starts.
5. Who we share it with
We do not sell personal data. We share it only with:
- Service providers who host our infrastructure, deliver our email, or provide the tools we run the business on. Each is bound by a written contract that limits them to our instructions.
- Professional advisers — accountants, insurers and lawyers — where they need it and are under a duty of confidence.
- Authorities, where we are legally required to disclose.
A current list of the sub-processors used in a given engagement is available to that client on request.
6. Where it is held
We prefer to keep personal data in the United Kingdom or the European Economic Area, and we design client systems to keep data in the region the client requires. Where a provider processes data outside those regions, we rely on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, together with an assessment of the protections in the destination country.
7. How long we keep it
- Enquiries that do not become work — up to 24 months from our last exchange, then deleted.
- Client records — for the life of the engagement and 6 years afterwards, to meet contractual and statutory limitation periods.
- Accounting records — 6 years from the end of the financial year, as tax law requires.
- Web server logs — a rolling period of no more than 12 months.
- Your cookie choice — 12 months, after which we ask again.
8. Keeping it safe
Access to personal data is limited to the people who need it for their role. Data is encrypted in transit, and at rest where the platform supports it. We keep an audit trail of access to client systems, review permissions when someone joins or leaves, and require multi-factor authentication on the accounts that matter. We test what we build before it carries real data, and we will tell you and the ICO about a qualifying personal data breach within the time the law allows.
9. Your rights
Under UK GDPR you can ask us to give you a copy of your personal data, correct it if it is wrong, delete it, restrict what we do with it, or provide it in a portable form. You can object to processing we base on legitimate interests, and you can withdraw consent at any time — withdrawing does not affect anything we did lawfully before you withdrew.
We do not make decisions about you by automated means that produce a legal or similarly significant effect.
To exercise any of these, email hello@aixlconsultancy.com. We reply within one month and will not charge you, unless a request is manifestly unfounded or excessive. We may need to confirm your identity first.
10. Cookies
Our use of cookies and similar technologies, and how to change your choice, is set out in full in our Cookie Policy. You can reopen the cookie settings at any time from the link in the footer of any page.
11. Changes to this notice
If we change how we handle personal data we will update this page and change the date at the top. Where a change is significant we will draw attention to it rather than rely on you noticing.
12. How to contact us
Questions about this notice, or about how we handle personal data, go to hello@aixlconsultancy.com, or write to us at our registered office.
If you are not satisfied with our response you can complain to the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113.