Privacy Policy

Overview

This Privacy Policy explains how XO Ventures LTD, trading as theXOlab ("theXOlab", "we", "us", or "our"), collects, uses, stores, and protects personal information when you visit our website, contact us, or engage with our services.

We are committed to handling personal information responsibly, transparently, and only where there is a legitimate reason to do so.

This policy applies to information collected through thexolab.com and to information provided to us directly in connection with enquiries and our business relationship with clients.

• Company: XO Ventures LTD
• Trading as: theXOlab
• Website: thexolab.com
• Privacy contact: support@thexolab.com
• Address: Silverstream House, 45 Fitzroy Street, London, W1T 6EB

1. Information We Collect

1.1 Website enquiries

When you submit an enquiry through our website, we may collect the following information:

• Name
• Role or job title
• Company
• Business email address
• Phone number
• How you found us
• Service you are interested in
• Information included in your message, including your goals, targets, business hurdles, systems, tools, and other information you choose to provide

You are not required to provide information beyond what is reasonably necessary for us to respond to your enquiry. However, if you do not provide certain information, we may not be able to respond fully or assess whether our services are appropriate for your requirements.

1.2 Information provided during our business relationship

If you become a client, we may collect and use information necessary to provide our services, manage the relationship, communicate with you, administer projects, issue invoices, and maintain appropriate business records.

The information we handle will depend on the nature of the engagement and the services being provided.

2. How We Use Personal Information

We use personal information for purposes including:

• Responding to enquiries and requests for information
• Understanding your requirements and determining how we may support your business
• Managing prospective and existing client relationships
• Managing sales opportunities and enquiries
• Providing and administering our services
• Communicating with clients and prospective clients about work or enquiries
• Maintaining accurate business and CRM records
• Managing contracts, invoices, and payments
• Meeting legal, regulatory, accounting, and administrative obligations
• Protecting the security and integrity of our systems and information

We do not use website enquiry information for unrelated marketing purposes without an appropriate legal basis.

3. Legal Basis for Processing

Where UK data protection law applies, we process personal information on an appropriate lawful basis.

Depending on the circumstances, this may include:

Legitimate interests - Where processing is necessary for our legitimate business interests, such as responding to an enquiry, managing a prospective client relationship, operating our business, or maintaining appropriate business records.

Contract - Where processing is necessary to enter into or perform a contract with you.

Legal obligation - Where we are required to process or retain information to comply with a legal or regulatory obligation.

Consent - Where we ask for your consent for a specific use of your information and consent is the appropriate legal basis. Where we rely on consent, you may withdraw that consent at any time.

4. How We Store Information

Information relating to website enquiries may be stored within our business systems, including:

• Email and other Google Workspace tools
• HubSpot, which we use to manage enquiries and sales
• Our website and associated systems

We take reasonable steps to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure.

Access to information is limited to what is reasonably necessary for the relevant business purpose.

5. Client CRM Data

As part of our consulting services, we may be given access to CRM systems and other business systems operated by our clients.

This may involve accessing customer and prospect information held within a client's CRM. Where necessary to deliver our services, we may also export or copy CRM records and contacts into appropriate Google Workspace tools.

In these circumstances, we may be processing personal information on behalf of our client, rather than determining the purposes for which that information is used ourselves.

Where we act as a processor on behalf of a client, our processing will be governed by the client's instructions and the applicable contractual arrangements, including any required data processing agreement.

We will only access and use client CRM data to the extent reasonably necessary to provide the agreed services.

6. Service Providers

We use third-party service providers to operate our business and provide our services. These may include:

Google Workspace - We use Google Workspace for business email, document storage, file management, and other business operations.

HubSpot - We use HubSpot to manage enquiries, prospective clients, sales opportunities, and related CRM information.

Other service providers may be used where reasonably necessary to operate the business or provide our services.

Where a third party processes personal information on our behalf, we take reasonable steps to ensure appropriate data protection and security arrangements are in place.

7. Sharing Personal Information

We do not sell personal information.

We may share personal information where reasonably necessary:

• With service providers who support our business operations
• Where required to provide our services
• Where you have asked us to do so
• Where required by law, regulation, legal process, or a lawful request from a competent authority
• Where necessary to protect our rights, property, security, or the security of others

Where we work with client CRM data, information will be handled in accordance with the client's instructions and applicable contractual arrangements.

8. International Data Transfers

Some of the service providers we use may process information outside the United Kingdom.

Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is made in accordance with applicable UK data protection law and that appropriate safeguards are in place where required.

9. Data Retention

We retain personal information for as long as reasonably necessary for the purposes for which it was collected.

This may include the period necessary to:

• Respond to and manage an enquiry
• Maintain a prospective or existing client relationship
• Provide our services
• Maintain appropriate business and financial records
• Resolve disputes
• Establish, exercise, or defend legal claims
• Comply with legal, regulatory, accounting, or other obligations

We periodically review the information we hold and will delete or securely dispose of personal information when it is no longer reasonably necessary to retain it, subject to any legal or contractual requirement to retain it for longer.

Client CRM information processed on behalf of a client will be retained and deleted in accordance with the client's instructions and the applicable contractual arrangements.

10. Cookies

Our website may use cookies or similar technologies that are necessary for the website to function correctly.

We do not currently use analytics for the purpose of tracking or analysing visitors to the website.

Because website technologies and third-party services may change, we may update this section if the cookies or technologies used by the website change.

Where required by law, we will obtain consent before using non-essential cookies or similar technologies.

11. Your Data Protection Rights

Depending on the circumstances and applicable law, you may have rights in relation to your personal information, including the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information in certain circumstances
• Request restriction of processing in certain circumstances
• Object to certain processing, including processing based on legitimate interests
• Request portability of information in certain circumstances
• Withdraw consent where we rely on consent as our legal basis

These rights are subject to certain legal conditions and exemptions.

If you would like to exercise a right or ask a question about how we handle your information, contact us at: support@thexolab.com

We may need to verify your identity before responding to certain requests.

12. Complaints

If you have concerns about how we have handled your personal information, we encourage you to contact us first so that we can understand and address the issue.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

The ICO provides guidance on data protection rights and accepts complaints where you believe your personal information has not been handled in accordance with applicable data protection law.

13. Data Security

We take reasonable technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

No method of transmitting or storing information is completely secure. However, we take appropriate steps for the nature and circumstances of the information we handle.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, services, systems, legal requirements, or the way we process personal information.

The latest version will be published on this website with the date it was last updated.

15. Contact

If you have any questions about this Privacy Policy or how we handle personal information, please contact:

XO Ventures LTD
Trading as: theXOlab
Email: support@thexolab.com
Address: Silverstream House, 45 Fitzroy Street, London, W1T 6EB

We aim to respond to privacy and data protection enquiries within a reasonable period and in accordance with applicable legal requirements.

Warm regards

theXOlab
XO Ventures LTD