Privacy Notice

1. Who we are

XPLORATECH LIMITED ("XPLORATECH", "we", "us") is a private limited company registered in England and Wales, company number 14894117, registered office C/O Aardvark Accounting, 1 Cedar Office Park, Cobham Road, Wimborne, BH21 7SB. We design and build business automation, and our first service is the Automation Audit.

We are the controller of the personal data this notice describes. For questions about this notice or your data, email hello@xploratech.ai.

When a business we work with shares information about its own customers, staff or other people so that we can deliver its Audit, we process that information on the business's behalf, as its processor. That business is responsible for telling those people about it.

2. What we collect, why, and our lawful basis

Enquiries and our contact form

• What: your name, email address and message.
• Why: to reply to you.
• Basis: legitimate interests in responding to enquiries.

If we contacted you about our services

We research businesses in the UK that we think may want our services. We may hold a person's name, job title, employer, work email address and work telephone number, with public information about the company itself. We gather it from the company's own website, the Companies House register, and public business directories and professional profiles. We use it only to contact you about our services. Before we telephone any number we check it against the Telephone Preference Service and the Corporate Telephone Preference Service.

• Basis: legitimate interests. We keep a written assessment weighing our interest in offering our services against your rights and what you would reasonably expect.
• To stop: email hello@xploratech.ai and we will not contact you again. We keep the contact detail and the fact that you objected, so that we keep honouring it. We keep nothing else.

Discovery Calls

• What: when you book, your name, email address, time zone and your answers on the booking form: your company name and website, your role, a phone number and anything you tell us in advance. During and after the call, our notes of what we discussed. We do not record or transcribe Discovery Calls.
• Why: to arrange and hold the call, and to understand whether an Automation Audit would help your business.
• Basis: legitimate interests, or steps you asked us to take before entering a contract.

Customer portal accounts

• What: your email address, your password and authenticator app enrolment (held by our sign-in provider; we do not store your password), the business you have access for, when access was given, used, disabled or removed, and why.
• Why: to let you sign in securely and see your Audit.
• Basis: contract where you are our customer yourself (for example a sole trader); otherwise legitimate interests in delivering our contract with your business.

Orders, invoices and payments

• What: the purchaser's legal name, billing address, country, billing email and any purchase order reference; who accepted the Order, when, and which version of our Terms; invoices, payments, refunds and the Audit credit.
• Card payments: you enter your card details on Stripe's payment page, not ours. Stripe tells us whether the payment succeeded and gives us its payment reference; we never receive your card details.
• Why: to form and perform the contract, invoice, record payment and keep accounts.
• Basis: contract, or legitimate interests where you act for your business; legal obligation for our accounting and tax records.

The Audit Intake

• What: your answers to the Intake questions about your business and its processes, and who submitted them.
• Why: to prepare the Audit.
• Basis: as for portal accounts.

Audit Call bookings, recordings and transcripts

• What: the booking details, as for Discovery Calls; and, unless you ask us not to, a video and audio recording and a written transcript of the Audit Call, which capture the names, voices, images and words of everyone taking part.
• Why: to capture accurately what you tell us, so that our analysis and Roadmap rest on what was actually said.
• Basis: legitimate interests in keeping an accurate record of the information on which we base our professional conclusions. We keep a written assessment weighing that interest against the interests of the people on the call. You can ask us not to record, before or during the call, and you can object afterwards.
• How it works: the call takes place on Google Meet, hosted from our Google Workspace account. We tell you before the call that we intend to record it, and we say so again at the start, before the substantive conversation. You can ask us not to record; the Audit then continues using notes and a written account, which may mean more follow-up questions. After the call we transfer the recording and transcript into our own evidence store and delete them from Google Drive. Recordings and transcripts are working evidence for our staff. They are not shown in the customer portal.

Evidence, analysis and Roadmaps

• What: files you upload; short excerpts and facts we take from the Intake, the call and the files; our analysis, recommendations and your Automation Roadmap; the Audit Review and any corrections.
• Why: to deliver the Audit and be able to stand behind what we concluded.
• Basis: as for portal accounts. Personal data about other people in files you share is processed on your business's behalf (section 1).

Correspondence

• What: emails between us.
• Why: to communicate with you and keep a record of what was agreed.
• Basis: legitimate interests, or contract.

Security and administration

• What: records of sign-ins and of changes made in our systems (who made a change and when), and our systems' operational logs.
• Why: to keep our systems and your information secure and to show who did what.
• Basis: legitimate interests in security and accountability.

3. AI and automated decisions

We do not currently use AI models to analyse Audit information. If that changes, we will update this notice before we start. We do not make decisions about you based solely on automated processing.

4. Who we share it with

We do not sell personal data. We share it only with the providers who process it for us, below, and where the law requires.

5. International transfers

Our own systems and database are in the UK. Some of the providers above process data outside the UK, as the table shows. Where they do, the safeguard is the one shown for that provider, set out in its own data protection terms.

If you would rather not have your details held by our booking provider, email hello@xploratech.ai and we will arrange the call directly.

6. How long we keep it

When a period ends, we delete the data.

7. How we protect it

Our systems run in Amazon Web Services' London region. Recordings, transcripts and uploads are held in private, encrypted storage. Portal sign-in requires a password and an authenticator app, and our staff accounts require multi-factor authentication. Access is limited to the XPLORATECH staff who need it.

8. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased in certain circumstances;
• restrict how we use it;
• receive it in a structured, machine-readable format;
• object to processing based on legitimate interests, including the recording of an Audit Call;
• withdraw consent where we rely on it.

Some data we must or may keep despite a request, for example accounting records we are required to keep, or records we need to establish or defend legal claims. If so, we tell you what we keep and why.

To exercise any of these rights, email hello@xploratech.ai. We respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

9. Cookies

Our website does not set its own cookies and does not use tracking, advertising or analytics cookies. Our booking tool, Cal.com, loads on our website only when you open the booking window, and on the Audit Call booking page in the customer portal. When it loads, it sets cookies on its own domain for its security, and more when you use it.

The customer portal sets one cookie when you sign in, to keep you signed in. It cannot be read by scripts on the page and expires when your sign-in session does.

10. Changes to this notice

We update this notice when how we handle personal data changes, and show the date and version at the top.