PhiX Technologies Limited (company number 12191016), whose registered office is 3rd Floor Crown House, 151 High Road, Loughton, Essex, IG10 4LG, United Kingdom (“PhiX”, “we”, “us” or “our”), is the controller of the personal information described in this policy unless we tell you otherwise.
This policy explains how we collect and use personal information relating to visitors to our website, business contacts, prospects, event participants and other people who interact with our marketing and business-development activities. It does not create a contract, and it does not replace any more specific privacy information we give you in connection with a particular service, project or recruitment process.
Who we are and how to contact us
| Controller | PhiX Technologies Limited |
|---|---|
| Registered office | 3rd Floor Crown House, 151 High Road, Loughton, Essex, IG10 4LG, United Kingdom |
| Privacy contact | data@phixtechnologies.com |
| Data-protection complaints | data@phixtechnologies.com (see section 12) |
1. Personal information we collect
Information you provide
We may collect information you give us when you:
- submit a contact, demo, review or event form;
- register for or attend a webinar, event or meeting;
- subscribe to marketing communications;
- contact us by email, telephone, social media or another channel;
- engage with us as a customer, prospect, supplier or business partner.
This may include your name, job title, employer, business contact details, location or region, communication preferences, the content of your enquiry, and information relevant to a potential or existing business relationship.
Meeting recordings and transcripts
Where you attend an online meeting or call with us and agree to it being recorded, we collect and store a recording and transcript through our meeting-assistant provider (Fathom). We ask all participants to agree before recording begins, and you can ask us not to record.
Information collected from your use of our website
When you visit our website, we may collect technical and usage information such as your IP address, browser and device information, referral source, pages viewed, approximate location derived from your IP address, and interactions with our pages or communications. We use cookies and similar technologies as explained in section 5.
Information obtained from other sources
We may obtain professional or business contact information from public sources, event and campaign partners, referrals, and business-data providers such as Lusha. This may include your name, job title, employer, business email address, business telephone number, professional profile information, and information about your organisation.
Where data-protection law requires us to give you privacy information after obtaining your details from another source, we will do so within the applicable period, normally no later than our first communication with you or one month after obtaining the information.
2. How and why we use personal information
The purposes and legal bases below apply where UK GDPR or EU GDPR governs the processing. A different or additional basis may apply under local law.
| Purpose | Typical information | Legal basis | Our legitimate interest, where used |
|---|---|---|---|
| Respond to enquiries, arrange meetings and provide requested information | Identity, business contact and enquiry information | Steps requested before entering a contract; contract; legitimate interests | Responding to business contacts and developing relevant relationships |
| Manage customer, supplier and partner relationships | Identity, contact, role, communications and relationship records | Contract; legal obligation; legitimate interests | Operating our business, delivering services and managing relationships |
| Operate, secure and troubleshoot our website and systems | Technical, device, log and security information | Legitimate interests; legal obligation where applicable | Maintaining availability, preventing misuse and protecting PhiX and users |
| Measure website and campaign performance | Cookie identifiers, technical and interaction information | Consent where required for cookies; legitimate interests for later processing | Understanding content and campaign performance and improving communications |
| Send relevant B2B marketing and event communications | Identity, employer, role, contact details, interests, source and engagement | Consent where required; otherwise legitimate interests | Promoting relevant PhiX services and events to professional audiences proportionately |
| Enrich, segment and prioritise business contacts | Professional contact and organisation information | Legitimate interests, subject to assessment and the right to object | Keeping records accurate and focusing outreach on relevant organisations and roles |
| Comply with law and handle legal claims | Any information relevant to the obligation or claim | Legal obligation; legitimate interests | Protecting legal rights, handling disputes and cooperating with authorities |
3. When you need to provide information
You are not generally required by law to provide personal information through our website. We may, however, need certain information to respond to your request, register you for an event, enter into a contract or provide a service. If you do not provide it, we may be unable to take the requested action.
4. Who we share information with
We may share personal information with service providers that support our business, under appropriate contractual and security terms. Depending on the activity, these may include:
- Cloudflare, for website hosting, content delivery, domain services and security;
- Web3Forms, which processes submissions from the contact and “Book a Review” forms on our site and delivers them to us by email;
- Salesforce, including Salesforce CRM and Marketing Cloud Account Engagement (MCAE), which store and manage our customer and prospect records and support our CRM, campaign, landing-page and marketing activity;
- Fathom, which records and transcribes online meetings and calls where the participants have agreed to the recording;
- Zoom, which hosts our webinars and online events and processes registration and attendance information for them;
- Lusha, for business-contact enrichment;
- Google Workspace, for email and business collaboration;
- professional advisers, insurers, auditors and authorities where necessary.
We may also disclose information in connection with a merger, acquisition, restructuring or sale of all or part of our business, or where disclosure is required by law or necessary to protect legal rights, safety or security.
Joint events and partner marketing. Where we run an event or webinar jointly with a partner (for example, Salesforce), we tell you at the point of registration if your details will be shared with that partner. We only share your details for that partner’s own marketing where you have actively opted in at registration. We do not otherwise share personal information with other organisations for their own marketing.
5. Cookies and similar technologies
At launch, our website does not set any non-essential cookies when a page loads. We have not installed website analytics, tag managers, advertising pixels or marketing tracking. On that basis we provide this cookie information but do not use a cookie consent banner at launch.
The only strictly necessary cookie set is a bot-management cookie (__cf_bm) placed by Cloudflare as part of hosting and security. This is essential to protect the site and is exempt from consent.
We serve our fonts from our own site rather than loading them from Google, so visiting a page does not send your IP address to Google for fonts. Our PhiXFliX pages display video thumbnails hosted by YouTube; loading these contacts YouTube’s servers but does not set cookies.
YouTube (video content). Our PhiXFliX pages feature videos hosted on YouTube. When one of these pages loads, YouTube’s servers are contacted to display video thumbnails. If you choose to play a video, YouTube may set cookies on your device. We use YouTube’s privacy-enhanced mode (youtube-nocookie.com), which limits what is stored until you play. YouTube is provided by Google, and any data it collects is governed by Google’s privacy policy. We have no control over cookies set by YouTube once you play a video.
If we later add analytics or marketing technologies (for example, website analytics or Pardot), we will introduce a consent management tool and banner that lets you accept or reject non-essential cookies and blocks those technologies until you choose. We will update this policy at that time.
6. Direct marketing
We may send professional contacts information about PhiX services, insights, events and related business topics where the communication is relevant and the law allows it. The rules differ by channel, recipient type and country. We obtain consent where it is required, and otherwise rely on legitimate interests only where our assessment supports it.
Every marketing email identifies PhiX and provides a way to unsubscribe. You can object to direct marketing at any time using the unsubscribe link or by contacting us. We may keep limited information on a suppression list so we can honour your choice and avoid contacting you again.
For Canadian commercial electronic messages, we rely on express consent or a qualifying form of implied consent, and include the identification and unsubscribe information required by Canada’s Anti-Spam Legislation (CASL).
7. International transfers
Some of our service providers and their sub-processors may process personal information outside the United Kingdom or the European Economic Area (EEA). The destination and route depend on the provider and the service configuration.
Where a restricted transfer is made, we use a lawful transfer mechanism and any additional measures required by law. These may include an adequacy regulation or decision, the UK International Data Transfer Agreement or Addendum, and the European Commission’s Standard Contractual Clauses. We also carry out any required assessment of the transfer and the protections in the destination country.
You may contact us for further information about the safeguards relevant to your information and, where applicable, to request a copy, subject to appropriate redactions.
8. How long we keep information
We keep personal information only for as long as reasonably necessary for the relevant purpose, including to meet legal, accounting, reporting, security and dispute-management requirements.
| Category | Retention period or criterion |
|---|---|
| Website enquiries, and prospect or visitor records that do not convert into an ongoing relationship | Deleted once older than one year |
| Customer, supplier and partner records (including contracts and invoices) | Kept for the duration of the relationship and for 7 years after it ends, to meet tax, accounting and limitation requirements |
| Marketing subscription and engagement records | Kept while you are subscribed and for up to 2 years of inactivity, after which they are deleted. Records confirming that you have opted out (suppression records) are kept for as long as needed to honour your choice |
| Event registrations and attendance records | Kept for up to 2 years after the event, unless it leads to an ongoing relationship or you have consented to further contact |
| Meeting recordings and transcripts (Fathom) | Kept while relevant to an active or prospective relationship and reviewed for deletion at least annually, then deleted once no longer needed |
| Website and security logs | Kept for up to 12 months |
| Cookie and consent records | Kept for up to 12 months, after which consent is refreshed |
9. Security
We use appropriate technical and organisational measures designed to protect personal information against unauthorised or unlawful access, use, alteration, disclosure, loss or destruction. Measures are chosen according to the nature of the information and the risks involved, and may include access controls, authentication, secure configurations, staff responsibilities, vendor due diligence, backups and incident-management procedures. No system is completely secure, and we review our controls as our systems and risks change.
10. Automated decision-making and profiling
We may use segmentation or scoring to help prioritise relevant business communications. We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.
11. Your rights
Depending on the law that applies to you and the circumstances, you may have rights to:
- ask for access to your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to delete information;
- ask us to restrict processing;
- object to processing based on legitimate interests, and object at any time to direct marketing;
- receive certain information in a portable format;
- withdraw consent at any time where processing is based on consent;
- ask for safeguards relating to an international transfer;
- raise a complaint with us and with the relevant supervisory authority.
These rights are subject to legal conditions and exceptions. We may need to verify your identity and clarify your request. To exercise a right, contact data@phixtechnologies.com.
12. Data-protection complaints
You can complain to us about how we have handled your personal information by emailing data@phixtechnologies.com. We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate, and communicate the outcome without undue delay.
You may also complain to the UK Information Commissioner’s Office or, where applicable, another supervisory authority. We encourage you to contact us first so we have an opportunity to address your concern.
13. European Economic Area
Where EU GDPR applies to our processing, individuals in the EEA have the rights described above and may complain to the supervisory authority in the country where they live, work or believe an infringement occurred.
14. Canada
Where Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) applies, PhiX is accountable for personal information under its control and will collect, use and disclose it for purposes a reasonable person would consider appropriate. You may contact our Data Protection Lead at data@phixtechnologies.com, or by post at our registered office above, to ask questions, request access or correction, or complain about our practices. You may also contact the Office of the Privacy Commissioner of Canada.
15. United States
Certain US state privacy laws apply only where an organisation meets specified thresholds or carries out specified activities. Where such a law applies to PhiX and to your information, you may have additional rights, which can include rights to know, access, correct or delete information. We do not sell your personal information, and we do not use it for targeted or cross-context behavioural advertising. We will not discriminate against you for exercising an applicable privacy right.
16. Children
Our website and business-development activities are intended for business audiences and are not directed to children. We do not knowingly collect personal information from children through these activities. If you believe a child has provided information to us, please contact us so we can assess and take appropriate action.
17. Changes to this policy
We may update this policy to reflect changes in law, technology, providers or our processing. We will publish the updated version on this page and change the “Last updated” date. Where a change materially affects how we use information, we will take additional steps to inform affected people where appropriate.
18. Contact us
Questions, rights requests and data-protection complaints should be sent to:
- Data Protection Lead
- PhiX Technologies Limited
- 3rd Floor Crown House, 151 High Road, Loughton, Essex, IG10 4LG, United Kingdom
- data@phixtechnologies.com