Privacy policy

Effective date: 22 July 2026

Last updated: 25 August 2026

Company: XAPNER LTD · Company number: 16227291 · Registered office: Unit 9105, 141 Access House, Morden Road, Mitcham, Surrey, CR4 4DG, United Kingdom · Public service area: London, UK · Website: https://xapner.com · Email: hey@xapner.com · Telephone and WhatsApp: +44 7345 963949

1. ABOUT THIS PRIVACY POLICY

This Privacy Policy explains how XAPNER LTD collects, uses, stores, shares, protects, and otherwise processes personal information.

It applies when you:

• Visit or interact with xapner.com.
• Contact us by website form, email, telephone, WhatsApp, social media, video call, or another communication channel.
• Request a quotation, proposal, consultation, demonstration, or support.
• Purchase or use our services.
• Create an account or access a platform operated by us.
• Subscribe to marketing communications.
• Apply to work with us.
• Act as an employee, representative, contractor, supplier, or contact person of one of our clients or partners.
• Interact with websites, software, campaigns, automations, systems, or digital services that we operate for a client.

This Privacy Policy applies to personal information relating to identifiable individuals. It does not apply to information that has been irreversibly anonymised.

2. WHO WE ARE

XAPNER LTD is a company registered in England and Wales under company number 16227291.

For personal information collected for our own business purposes, XAPNER LTD normally acts as the data controller. This means we determine why and how that personal information is processed.

For personal information processed through websites, software, customer relationship management systems, campaigns, databases, automations, hosting services, or other systems operated for a client, we may act as a data processor on that client’s instructions. In those circumstances, the client will normally be the data controller.

Questions concerning privacy may be sent to:

XAPNER LTD Unit 9105, 141 Access House Morden Road Mitcham Surrey CR4 4DG United Kingdom

Email: hey@xapner.com Email subject: Privacy Request

We have not appointed a formal Data Protection Officer unless expressly stated otherwise. Privacy enquiries are handled by our data protection contact.

3. INFORMATION WE MAY COLLECT

Depending on your relationship with us, we may collect the following categories of information.

3.1) Identity information

• Full name.
• Username or account identifier.
• Job title.
• Employer or organisation.
• Signature.
• Date of birth where reasonably required for verification.
• Identity documents where legally or commercially necessary.

3.2) Contact information

• Email address.
• Telephone number.
• WhatsApp number.
• Postal or business address.
• Social media contact details.
• Preferred communication method.

3.3) Business and project information

• Company name and registration details.
• Industry and business activities.
• Project requirements.
• Technical specifications.
• Brand information.
• Products and services.
• Target audiences.
• Marketing plans.
• Website content.
• Images, files, designs, documents, databases, and other materials you provide.
• Feedback, approvals, instructions, revision requests, and support enquiries.

3.4) Account and authentication information

• Account username.
• Encrypted or hashed password.
• Authentication tokens.
• Login history.
• Access permissions.
• Multi-factor authentication information.
• Security and fraud-prevention records.

You must not send us passwords or access credentials through insecure channels unless we have specifically instructed you to do so.

3.5) Financial and transaction information

• Billing address.
• Payment status.
• Invoice information.
• Transaction references.
• Subscription information.
• Tax information.
• Payment method type.
• Refund and chargeback information.

Payment card details are normally processed directly by our payment providers. We do not intentionally store full payment card numbers or security codes unless expressly disclosed and lawfully implemented.

3.6) Communications

• Emails.
• Website form submissions.
• WhatsApp messages.
• Telephone call notes.
• Meeting notes.
• Support requests.
• Survey responses.
• Reviews and testimonials.
• Complaints.
• Social media messages.
• Records of permissions, approvals, and contractual discussions.

Calls or meetings will only be recorded where permitted by applicable law and where appropriate notice has been given.

3.7) Technical and usage information

• Internet Protocol address.
• Device type.
• Browser type and version.
• Operating system.
• Screen resolution.
• Language.
• Time zone.
• Approximate location derived from an Internet Protocol address.
• Referral source.
• Pages visited.
• Session duration.
• Clicks and interactions.
• Form activity.
• Error logs.
• Security logs.
• Cookie identifiers.
• Advertising identifiers.
• Analytics and performance information.

3.8) Marketing information

• Marketing preferences.
• Subscription status.
• Campaign engagement.
• Email opening or link interaction data, where enabled.
• Advertising audience information.
• Records of consent.
• Records of objections or unsubscribe requests.

3.9) Recruitment and supplier information

• Curriculum vitae.
• Employment history.
• Qualifications.
• Portfolio.
• References.
• Interview notes.
• Right-to-work information.
• Contractor or supplier information.
• Bank and tax information where required for payment.

3.10) Sensitive information

We do not normally require special-category personal information, such as information about health, ethnicity, religious beliefs, political opinions, trade union membership, biometric identification, sexual orientation, or criminal convictions.

Do not provide sensitive personal information unless it is genuinely required, lawful, and specifically requested.

Where a project requires us to process sensitive personal information on behalf of a client, that processing must be covered by an appropriate contract, documented instructions, safeguards, and any required lawful conditions.

4. HOW WE COLLECT INFORMATION

We may collect personal information:

• Directly from you.
• From your employer, colleague, representative, or business partner.
• Through our website, forms, applications, and systems.
• Through cookies and similar technologies.
• Through payment, scheduling, communications, hosting, analytics, advertising, and business-software providers.
• From social networks and professional platforms.
• From publicly available websites, company registers, directories, and business databases.
• From referrals and introductions.
• From clients for whom we operate a website, system, campaign, or service.
• During projects, support work, meetings, and contractual communications.
• Through legally permitted business-development activities.

Where we receive your information from another source, we will process it only where we have an appropriate purpose and lawful basis.

5. HOW AND WHY WE USE PERSONAL INFORMATION

We may process personal information for the following purposes.

5.1) Enquiries and quotations

We use contact, business, and project information to:

• Respond to enquiries.
• Understand requirements.
• Arrange consultations.
• Prepare quotations and proposals.
• Assess whether we can provide a service.
• Communicate before entering into a contract.

The relevant lawful basis may be taking steps at your request before entering into a contract, legitimate interests, or consent where required.

5.2) Providing services

We use personal and business information to:

• Set up and manage projects.
• Design and develop websites, software, applications, brands, campaigns, and digital systems.
• Manage accounts and access.
• Deliver subscriptions, retainers, hosting, maintenance, or support.
• Process revisions and approvals.
• Communicate about delivery.
• Provide training and documentation.
• Manage quality, security, and service continuity.

The relevant lawful basis is normally performance of a contract, taking steps before entering into a contract, legitimate interests, or legal obligations.

5.3) Payments and administration

We use financial and transaction information to:

• Issue quotations and invoices.
• Take and record payments.
• Create a lead record when you submit checkout contact details, including where payment is later declined, fails, is cancelled, or the checkout expires.
• Contact you about an incomplete checkout when you have expressly agreed to this follow-up.
• Convert a successful purchaser into a client record and automatically create the related service project, paid invoice, and payment record.
• Manage subscriptions.
• Process permitted refunds.
• Recover unpaid amounts.
• Keep accounting and tax records.
• Prevent fraud and misuse.

The relevant lawful basis may be performance of a contract, legal obligations, or legitimate interests.

5.4) Customer service and complaints

We process communications and account information to:

• Provide support.
• Investigate problems.
• Resolve complaints.
• Maintain service records.
• Protect our legal position.
• Establish, exercise, or defend legal claims.

The relevant lawful basis may be performance of a contract, legal obligations, or legitimate interests.

5.5) Website operation, analytics, and improvement

We may use technical and usage information to:

• Operate our website.
• Remember settings.
• Diagnose faults.
• Measure website performance.
• Understand how visitors use our services.
• Improve design, content, accessibility, and user experience.
• Detect bots, malicious activity, and security threats.

The relevant lawful basis may be legitimate interests or consent, depending on the technology and applicable law.

5.5A) Visitor research and lead attribution

We operate a first-party visitor research system on xapner.com for business research and lead attribution. For visitors to our marketing site we may record:

• Pages visited, visit order, and visit counts.
• Timestamps and approximate time spent on pages.
• Scroll depth on pages.
• Clicks that indicate service interest (for example Website, Branding, or Software).
• Text copied from the page.
• Technical details such as IP address, browser user agent, screen size, language, and timezone.
• A first-party visitor identifier cookie (xp_vid) and session identifier.
• UTM parameters and referrer where available.

This information is stored in our xapner.com systems so our team can review visitor behaviour in the admin Visitor research module. If you submit an enquiry form, we link the behaviour record to your support ticket and may share a behaviour summary with our internal CRM at workspace.xapner.com so the sales team can see the journey that led to the enquiry.

The relevant lawful basis is our legitimate interests in understanding demand, improving the website, preventing abuse, and responding to enquiries with relevant context. You may object by contacting hey@xapner.com with the subject Privacy Request.

5.6) Marketing

Subject to applicable laws, we may use contact and business information to:

• Send information about our services.
• Follow up on enquiries.
• Send relevant offers.
• Conduct business-to-business outreach.
• Create advertising audiences.
• Measure campaign performance.

Where consent is legally required, we will rely on consent.

Where legitimate interests may lawfully apply, we will assess our interests against your rights and expectations.

You can object to direct marketing or unsubscribe at any time.

5.7) Security and fraud prevention

We may process account, transaction, device, and communication information to:

• Verify identity.
• Prevent unauthorised access.
• Protect our clients, users, systems, and business.
• Investigate suspected fraud or abuse.
• Maintain security records.
• Enforce our agreements.

The relevant lawful basis is normally legitimate interests, legal obligations, or performance of a contract.

5.8) Legal and regulatory compliance

We may process information to:

• Meet tax, accounting, corporate, employment, data-protection, consumer-protection, and other legal requirements.
• Respond to lawful requests.
• Cooperate with regulators, courts, law enforcement, and government authorities.
• Maintain evidence of transactions and agreements.
• Establish, exercise, or defend legal claims.

The relevant lawful basis is normally legal obligation or legitimate interests.

5.9) Business transactions

Information may be reviewed or transferred in connection with:

• Investment.
• Financing.
• Reorganisation.
• Merger.
• Acquisition.
• Sale of assets.
• Sale or transfer of all or part of our business.
• Insolvency or administration.

Any recipient must use personal information only as lawfully permitted.

6. LAWFUL BASES

Depending on the circumstances, we rely on one or more of the following lawful bases:

• Contract: processing is necessary to perform a contract or take requested steps before entering into one.
• Legal obligation: processing is necessary to comply with applicable law.
• Legitimate interests: processing is necessary for our legitimate commercial, operational, security, administrative, or legal interests, provided those interests are not overridden by individual rights.
• Consent: you have freely given specific and informed consent.
• Legal claims: processing is necessary to establish, exercise, or defend legal claims.
• Vital interests or public-interest grounds, where exceptionally applicable.

Where we rely on consent, you may withdraw consent at any time. Withdrawal does not make earlier lawful processing unlawful.

7. WHEN WE ACT AS A PROCESSOR

Where we process personal information on behalf of a client:

• The client determines the purposes of processing.
• We process information according to documented instructions.
• The client is responsible for providing privacy information and establishing the appropriate lawful basis.
• The client is responsible for ensuring that collection and instructions are lawful.
• We will implement appropriate contractual, organisational, and technical safeguards.
• Processing may be governed by our Data Processing Addendum.
• Requests from individuals may need to be referred to the relevant client.

Nothing in this Privacy Policy changes the allocation of controller and processor responsibilities set out in an applicable agreement.

8. MARKETING COMMUNICATIONS

We may send marketing communications where:

• You have requested them.
• You have consented.
• The communication is otherwise permitted by law.
• We have a lawful business-to-business marketing basis.

Every electronic marketing message will provide an unsubscribe method where required.

You may also opt out by emailing hey@xapner.com.

We may retain limited information on a suppression list after you unsubscribe. This is used to ensure that we respect your preference and do not add you back to the same marketing list unintentionally.

Opting out of marketing will not prevent necessary service, payment, security, or contractual communications.

9. COOKIES AND SIMILAR TECHNOLOGIES

Our website may use:

• Cookies.
• Local storage.
• Tracking pixels.
• Tags.
• Scripts.
• Software development kits.
• Device identifiers.
• Similar storage or access technologies.

We use these technologies for purposes such as:

• Website operation.
• Security.
• Preference storage.
• Analytics.
• Performance measurement.
• Advertising.
• Embedded content.
• Communication features.

Where consent is required, non-essential technologies will not be activated until an appropriate choice has been made.

The Google AdSense publisher loader is present so Google can verify xapner.com and make its configured consent message available where applicable. Xapner has not added AdSense ad units during the current readiness work. If advertising is activated later, Google and its advertising partners may use cookies, web beacons, IP addresses, or other identifiers for fraud prevention, delivery, frequency control, personalisation, reporting, and measurement, subject to your choices and applicable law.

Information about how Google uses data when you use partners’ sites or apps is available at Google’s business data responsibility page. You can manage or withdraw optional advertising choices through our cookie-preference controls.

More information is available in our Cookie Policy and cookie-preference interface.

10. SHARING PERSONAL INFORMATION

We may share personal information with the following categories of recipients where reasonably necessary.

10.1) Service providers

These may include providers of:

• Website hosting.
• Cloud infrastructure.
• Email.
• Communications.
• Project management.
• Customer relationship management.
• Analytics.
• Advertising.
• Payment processing.
• Accounting.
• Scheduling.
• File storage.
• Cybersecurity.
• Technical support.
• Design and development tools.
• Artificial intelligence services where appropriate.
• Backup and disaster recovery.

10.2) Contractors and subcontractors

We may use vetted developers, designers, marketers, consultants, support providers, and other subcontractors.

They may access information only to the extent necessary for their duties and subject to confidentiality and data-protection obligations.

10.3) Professional advisers

We may share information with accountants, lawyers, insurers, auditors, consultants, debt-recovery providers, and financial advisers.

10.4) Authorities

We may disclose information to courts, regulators, law-enforcement bodies, government authorities, or other parties where:

• Required by law.
• Necessary to protect rights or safety.
• Necessary to investigate fraud or misuse.
• Necessary to establish, exercise, or defend legal claims.

10.5) Business transactions

Information may be shared with potential or actual buyers, sellers, investors, lenders, advisers, or transaction partners, subject to appropriate confidentiality arrangements.

10.6) Client-directed recipients

Where we operate as a processor, information may be shared with persons and providers selected or authorised by the relevant client.

11. SALE OF PERSONAL INFORMATION

We do not sell personal information in the ordinary meaning of selling information for money.

Certain privacy laws use broader definitions of “sale”, “sharing”, or targeted advertising. Where those laws apply, users may exercise any available opt-out rights through our cookie controls or by contacting us.

12. INTERNATIONAL TRANSFERS

We operate from the United Kingdom and may work with clients, contractors, and technology providers in other countries.

Personal information may therefore be stored, accessed, or processed outside:

• The United Kingdom.
• The European Economic Area.
• The country in which you are located.

Where legally required, we will use an approved transfer mechanism or safeguard, such as:

• An adequacy decision or regulation.
• The UK International Data Transfer Agreement.
• The UK Addendum to approved European Union Standard Contractual Clauses.
• European Union Standard Contractual Clauses.
• Another legally recognised safeguard.

We may also carry out appropriate transfer-risk assessments and require supplementary contractual, technical, or organisational protections where necessary.

13. DATA SECURITY

We use reasonable and proportionate safeguards designed to protect personal information.

Depending on the nature of the information and service, these may include:

• Access controls.
• Role-based permissions.
• Encryption in transit.
• Encryption at rest where appropriate.
• Password and authentication controls.
• Multi-factor authentication.
• Secure backups.
• Logging and monitoring.
• Malware protection.
• Firewall and infrastructure controls.
• Staff and contractor confidentiality.
• Supplier assessments.
• Incident-response procedures.
• Data minimisation.
• Secure deletion processes.

No website, network, storage platform, email service, or transmission method can be guaranteed completely secure.

You are responsible for:

• Protecting passwords.
• Using secure devices and networks.
• Enabling multi-factor authentication where available.
• Informing us promptly of suspected unauthorised access.
• Keeping your contact and account information accurate.

14. PERSONAL DATA BREACHES

We maintain procedures for identifying, assessing, recording, containing, and responding to personal data breaches.

Where required by applicable law, we will notify the relevant supervisory authority and affected individuals.

Where we act as a processor, we will notify the relevant client without undue delay after becoming aware of a personal data breach affecting client-controlled personal information.

15. RETENTION

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including contractual, operational, security, tax, accounting, insurance, and legal requirements.

Typical retention considerations include:

• Enquiry records may normally be retained for up to 24 months after the last meaningful interaction.
• Client contracts, invoices, transaction records, and important project communications may normally be retained for up to six years after the end of the relationship, or longer where required.
• Project files may be retained for the support period or another agreed period.
• Account and security logs may be retained according to operational and security requirements.
• Marketing information may be retained until you unsubscribe, object, or the information is no longer useful.
• Suppression records may be retained to ensure that marketing objections continue to be respected.
• Recruitment information may normally be retained for up to six months after a recruitment process unless a longer period is agreed or justified.
• Information relevant to a dispute, investigation, debt, or legal claim may be retained until the matter and applicable limitation periods have ended.

We may anonymise information instead of deleting it. Properly anonymised information may be used for analytics, security, research, and service improvement.

16. YOUR DATA-PROTECTION RIGHTS

Depending on applicable law and the circumstances, you may have rights to:

• Be informed about processing.
• Request access to personal information.
• Request correction of inaccurate information.
• Request completion of incomplete information.
• Request deletion.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Object to direct marketing.
• Withdraw consent.
• Request data portability.
• Challenge certain decisions made solely through automated processing.
• Complain about our use of personal information.

These rights are not always absolute. A request may be refused or limited where permitted by law, including where information must be retained for legal obligations, contractual records, fraud prevention, security, or legal claims.

We may request information reasonably necessary to verify identity and prevent unauthorised disclosure.

To exercise a right, email hey@xapner.com with the subject “Privacy Request”.

We will respond within the period required by applicable law. UK and European requests are normally handled within one month, subject to lawful extensions for complex or multiple requests.

17. AUTOMATED DECISION-MAKING

We do not ordinarily make decisions about individuals based solely on automated processing where those decisions produce legal or similarly significant effects.

Where such processing is introduced, we will provide appropriate information and safeguards as required by law.

Analytics, fraud detection, lead scoring, content recommendations, advertising audiences, or workflow automations may involve automated processing, but these activities do not necessarily involve legally significant automated decisions.

18. CHILDREN

Our website and services are primarily intended for businesses and persons aged 18 or over.

We do not knowingly collect personal information directly from children where parental or guardian consent is legally required.

A person under 18 should not purchase services, create a binding account, or provide personal information without appropriate permission.

Where a client service is likely to involve children’s information, this must be specifically disclosed and governed by appropriate instructions and safeguards.

19. THIRD-PARTY LINKS AND SERVICES

Our website may contain links to external websites, applications, payment services, social networks, scheduling tools, embedded media, maps, or other third-party services.

Those third parties operate under their own privacy notices and terms.

We are not responsible for their independent processing, security, availability, or content.

20. REGIONAL PRIVACY RIGHTS

Individuals in certain jurisdictions may have additional rights, including rights relating to:

• Access.
• Correction.
• Deletion.
• Portability.
• Consent.
• Targeted advertising.
• Sale or sharing of personal information.
• Profiling.
• Appeals against privacy-request decisions.

Where those laws apply to us, we will honour applicable rights.

We will not unlawfully discriminate against a person for exercising a privacy right.

21. PRIVACY COMPLAINTS

Privacy complaints may be submitted to:

Email: hey@xapner.com Subject: Data Protection Complaint

Please include:

• Your name and contact information.
• A description of the concern.
• Relevant dates.
• The service or project involved.
• Copies of relevant communications where available.
• The resolution requested.

We will acknowledge a data-protection complaint within 30 days where required under UK law. We will investigate appropriately and provide an outcome without undue delay.

You may also complain to the Information Commissioner’s Office in the United Kingdom or to another competent supervisory authority.

Information Commissioner’s Office Website: https://ico.org.uk

We encourage you to contact us first so we have an opportunity to address the matter.

22. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect:

• Changes in law.
• Changes in services.
• Changes in technology.
• New processing activities.
• Regulatory guidance.
• Security or operational requirements.

The updated version will be posted on our website with a revised date.

Material changes may also be communicated by another reasonable method.

23. CONTACT

XAPNER LTD Company number: 16227291

Registered office: Unit 9105, 141 Access House Morden Road Mitcham Surrey CR4 4DG United Kingdom

Email: hey@xapner.com Telephone and WhatsApp: +44 7345 963949