Back to website

LEGAL AND PRIVACY

Privacy Policy

This notice explains what personal information Xiola Digital may process, why we use it, how long we keep it and the rights available to you under UK data protection law.

Last updated 3 September 2026

1. Who is responsible for your information

XIOLA DIGITAL LTD is the data controller for the processing described in this notice. The company is registered in England and Wales under company number 16264235. Its registered office is 13 Berestede Road, London, England, W6 9NP.

Privacy requests and complaints

Write to Data Protection Complaints, XIOLA DIGITAL LTD at the registered office above. Please include your name, contact details, a clear description of your request or concern, any relevant dates and how you would prefer us to reply.

2. Information we process and our lawful basis

Contact, consultation, investor and partnership enquiries are delivered through Formspree to Xiola Digital. Please do not send passwords, identity documents, payment details or confidential client records. To limit automated enquiries, we temporarily store a time-specific hash derived from the connection address and a request count, not the enquiry contents, in our website database. Entries expire after the 15-minute limit window and are removed when later enquiries are processed. Recruitment applications and CV uploads are not currently accepted here.

Information
Contact and enquiry details you choose to provide
Purpose
To respond, discuss services and keep an appropriate record
Lawful basis
Steps requested before a contract and our legitimate interests in responding to business enquiries
Information
Basic technical and security data such as IP address, browser, device and request logs
Purpose
To deliver, secure and troubleshoot the website and prevent misuse
Lawful basis
Our legitimate interests in operating a secure and reliable website
Information
Client, supplier and contract records
Purpose
To deliver services, manage relationships, payments and records
Lawful basis
Contract, legal obligations and our legitimate business interests
Information
Cookie or consent choices if optional technologies are introduced
Purpose
To remember choices and operate any features you request
Lawful basis
Consent for non-essential cookies and legitimate interests for essential security

The current public website does not provide a newsletter sign-up and Xiola has not configured advertising or behavioural profiling on it. We will update this notice before introducing materially different processing.

3. Where information comes from

We normally receive information directly from you when you contact us or work with us. Basic technical information may be generated by your browser and our hosting or security providers. In a business context, we may also receive professional contact information from your organisation, a referral or a public source where its use is lawful and reasonable.

4. Who we may share information with

We may share only the information reasonably necessary with:

  • website hosting, content management, security and IT service providers;
  • professional advisers such as accountants, auditors, insurers and lawyers;
  • public authorities, regulators or courts where disclosure is required by law; and
  • a buyer, investor or successor if our business or assets are reorganised or transferred.

Service providers acting for us must handle personal information under appropriate contractual and confidentiality obligations. We do not sell personal information.

5. International transfers

Some technology providers may process information outside the United Kingdom. Where UK data protection law requires safeguards, we use an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another lawful transfer mechanism, together with any necessary risk assessment and security measures.

6. How long we keep information

We keep personal information only for as long as it is needed for the purpose described, to resolve a request or complaint, to meet legal and accounting duties, or to establish and defend legal claims. We consider the nature and sensitivity of the information, the risk of harm, available alternatives and applicable legal requirements. Hosting and security logs follow the relevant provider's controlled retention schedule. Information that is no longer required is deleted or anonymised.

7. Your data protection rights

Depending on the circumstances, you may have the right to:

  • ask for access to your personal information;
  • have inaccurate or incomplete information corrected;
  • ask for information to be erased or its use restricted;
  • object to processing based on legitimate interests or to direct marketing;
  • receive certain information in a portable format;
  • withdraw consent at any time where consent is the lawful basis; and
  • complain about how your information has been handled.

These rights are not absolute and an exemption may apply. We may need to verify your identity before acting on a request. There is normally no charge, although the law permits a reasonable fee or refusal in limited circumstances.

8. Automated decisions and children

The public website does not make decisions about people solely by automated means that produce legal or similarly significant effects. It is intended for businesses and professionals and is not directed at children. We do not knowingly collect children's personal information through this website.

9. Our data protection complaints process

You may make a data protection complaint in writing to the registered office. We will accept a complaint even if it does not use legal terminology. We will acknowledge receipt within 30 days, make appropriate enquiries without undue delay, keep you informed where the investigation is ongoing and tell you the outcome without undue delay. We will explain any action taken and how you may challenge the outcome.

You can also complain to the UK Information Commissioner's Office. We would appreciate the opportunity to address the issue first, but this does not affect your right to contact the ICO. Visit ico.org.uk/make-a-complaint.

10. Changes to this notice

We may update this notice when our services, technology or legal obligations change. The date at the top shows when it was last revised. Material changes will be highlighted where appropriate.