01 Introduction
This Privacy Policy explains how [Company Legal Name], trading as "X∞RAY" ("we", "us", "our"), collects, uses, shares and protects personal data when you visit our website, request a demonstration, contact us, or otherwise interact with us (together, the "Services").
We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 ("PECR").
02 Who We Are
For the purposes of the UK GDPR, the data controller of your personal data is:
[Company Legal Name]
Company number: [Company Registration Number]
Registered office: [Registered Office Address], United Kingdom
Privacy contact: privacy@x8ray.com
Where we have appointed a Data Protection Officer or nominated privacy contact, their details will be provided here or on request.
03 Scope of This Policy
This policy applies to personal data we collect through our website, demo request and contact forms, sales and support communications, and events. It does not apply to personal data processed by us on behalf of our customers within their use of the X∞RAY platform under a separate Order Form or data processing agreement, which is governed by the terms of that agreement.
04 Personal Data We Collect
We may collect and process the following categories of personal data about you:
| Category | Examples |
|---|---|
| Identity & contact data | Name, job title, employer, business email address, phone number |
| Enquiry & communications data | Content of demo requests, sales enquiries, support messages, and correspondence with us |
| Technical & usage data | IP address, browser type and version, device information, pages visited, referral source, and time spent on the site |
| Marketing preferences | Your preferences in receiving marketing from us and your communication preferences |
We do not intentionally collect special category data (such as data concerning health, religion, or political opinion) through the Website and ask that you do not submit such data to us via our forms.
05 How We Collect Your Data
- Directly from you, when you complete a form, request a demonstration, subscribe to updates, or otherwise contact us;
- Automatically, through cookies and similar technologies as you interact with the Website (see section 7); and
- From third parties, such as publicly available business or professional information (for example, LinkedIn or your employer's website) where relevant to a business enquiry, or from event organisers where you have consented to your details being shared with exhibitors.
06 How and Why We Use Your Data
We only use your personal data where we have a valid lawful basis to do so under the UK GDPR. The table below summarises our main processing activities:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and demo requests | Performance of steps prior to a contract / legitimate interests in responding to enquiries |
| Operating, securing and improving the Website | Legitimate interests in maintaining a secure and functioning website |
| Sending marketing communications | Consent, or legitimate interests where permitted for existing business contacts (with an opt-out on every communication) |
| Complying with legal and regulatory obligations | Legal obligation |
| Detecting, investigating and preventing security incidents, fraud or misuse | Legitimate interests in protecting our systems, staff and users |
Where we rely on legitimate interests, we have considered that this processing is proportionate and does not unduly impact your rights and freedoms. You may ask us for further details of this assessment at any time.
07 Cookies & Similar Technologies
The Website uses cookies and similar technologies to distinguish you from other users, remember your preferences, and understand how the Website is used. In accordance with PECR, we only set non-essential cookies (such as analytics or marketing cookies) with your consent, which you can manage via our cookie banner or your browser settings.
| Category | Purpose | Consent required |
|---|---|---|
| Strictly necessary | Essential for the Website to function (for example, security and load balancing) | No |
| Analytics | Understanding how visitors use the Website so we can improve it | Yes |
| Marketing | Measuring the effectiveness of our marketing and tailoring content | Yes |
You can withdraw or change your cookie consent at any time by adjusting your browser settings or through the cookie preferences available on the Website. Disabling certain cookies may affect the functionality of the Website.
08 Who We Share Your Data With
We do not sell your personal data. We may share your personal data with:
- Service providers who support our operations, such as website hosting, email delivery, customer relationship management (CRM), scheduling, and analytics providers, acting on our instructions under appropriate contractual safeguards;
- Professional advisers, including lawyers, auditors and insurers, where necessary;
- Regulators, law enforcement or other authorities, where we are required to do so by law or to protect our rights, property or safety, or that of others; and
- A buyer or successor, in the event of a merger, acquisition, financing, or sale of some or all of our assets, subject to appropriate confidentiality arrangements.
09 International Data Transfers
Some of our service providers may be located, or process data, outside the United Kingdom. Where this is the case, we ensure an adequate level of protection is in place, for example by relying on the UK's "adequacy regulations" for the relevant destination country, or by using the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards required under UK data protection law.
10 Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements. As a general guide:
- enquiry and demo request data is retained for as long as necessary to progress the relevant business relationship, and for a reasonable period thereafter in case of follow-up contact, after which it is deleted or anonymised;
- marketing preference data is retained until you unsubscribe or withdraw consent; and
- website analytics data is retained in accordance with the retention settings of our analytics provider, typically no longer than 26 months.
Where we no longer need your personal data, we will securely delete or anonymise it.
11 Data Security
We maintain appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, and against accidental loss, destruction or damage, including access controls, encryption in transit, and staff training. While we take security seriously, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office and affected individuals in accordance with our obligations under the UK GDPR.
12 Your Rights Under UK GDPR
Subject to certain conditions and exemptions set out in law, you have the following rights in relation to your personal data:
- Right of access — to obtain a copy of the personal data we hold about you;
- Right to rectification — to have inaccurate or incomplete data corrected;
- Right to erasure — to request deletion of your personal data in certain circumstances;
- Right to restrict processing — to request that we limit how we use your data in certain circumstances;
- Right to data portability — to receive certain personal data in a structured, commonly used, machine-readable format;
- Right to object — to object to processing based on legitimate interests or for direct marketing purposes, at any time and free of charge; and
- Right to withdraw consent — where processing is based on consent, at any time, without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact us at privacy@x8ray.com. We will respond within one month, as required by the UK GDPR, and may ask you to verify your identity before actioning your request.
13 Automated Decision-Making
We do not use your personal data to make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.
14 Children's Privacy
The Website and Services are intended for business and professional audiences and are not directed at, or intended for use by, individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so that we can take appropriate action.
15 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal or regulatory reasons. The "Last updated" date at the top of this page indicates when this policy was last revised. We encourage you to review this page periodically for the latest information on our privacy practices.
16 Contact Us & Complaints
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at privacy@x8ray.com or by post to [Registered Office Address], United Kingdom.
If you are not satisfied with our response, you have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office ("ICO"):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Helpline: 0303 123 1113 · ico.org.uk