Privacy Policy

HeXPlanIT Limited — Website Privacy Notice

Last updated: 18 October 2026

1. Data Controller

HeXPlanIT Limited ("HeXPlanIT", "we", "us" or "our") is the data controller responsible for personal information collected through our corporate website, www.hexplanit.com, and associated website enquiries.

As data controller, HeXPlanIT determines the purposes and means of processing this personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended, and other applicable UK data protection legislation.

Company: HeXPlanIT Limited
Registered office: 71-75, Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company registration number: 16691383
Privacy contact: Barry Whitfield

This notice applies to our public website and related business communications. It does not cover personal data processed within the HeXPlanIT software platform under separate customer or platform arrangements.

2. Personal Information We Collect

Depending on how you interact with our website, we may collect:

Contact information: Your name, business email address, telephone number and other contact details you provide.

Professional information: Your organisation, job title and business interests where supplied.

Enquiry information: Messages, requests for demonstrations, service enquiries, meeting requests and subsequent correspondence.

Technical information: IP address, browser type, device information, website access times and technical or security logs generated through website operation.

Website usage information: Information about how visitors interact with the website, where collected through analytics or similar technologies.

We collect information directly from you when you submit an enquiry or contact us. Some technical information may be collected automatically when you visit our website.

We do not intentionally request patient records, medical histories or other special category personal data through our public website. Please do not include such information in general enquiries.

3. Why We Collect and Use Personal Information

We process personal information for the following purposes:

Purpose

• Lawful basis
• Responding to enquiries and requests for information
• Legitimate interests in responding to business communications, or steps taken at your request before entering into a contract
• Arranging demonstrations, meetings and discussions
• Legitimate interests or pre-contractual steps, as applicable
• Developing prospective business relationships
• Legitimate interests in operating and developing our business
• Operating, maintaining and securing our website
• Legitimate interests in providing a secure and reliable website
• Maintaining business correspondence and relevant records
• Legitimate interests or compliance with legal obligations, as applicable
• Non-essential website analytics and cookies

The applicable UK GDPR lawful basis, together with consent where required under electronic communications law

Where we rely on legitimate interests, we consider the necessity of processing and its impact on individuals' rights and freedoms.

We do not use website enquiry information to make solely automated decisions that produce legal or similarly significant effects on individuals.

4. Business Communications and Marketing

If you contact HeXPlanIT about our services, we may use your information to respond to your enquiry and conduct relevant follow-up communications.

We will only send unsolicited electronic marketing communications where permitted by applicable UK law, including the Privacy and Electronic Communications Regulations (PECR).

Where consent is required, we will request it. You may opt out of marketing communications at any time by contacting us or using an unsubscribe facility where provided.

We do not sell personal information to third-party advertisers or data brokers.

5. Sharing Personal Information

We may share personal information with trusted service providers where necessary to operate our website and respond to enquiries.

These may include:

• Website hosting and technical infrastructure providers.
• Business email and communications providers.
• Website maintenance and security service providers.
• Analytics providers, where applicable.
• Professional advisers or public authorities where disclosure is legally required or otherwise lawful.

Where a service provider processes personal information on our behalf, we will put appropriate contractual and security arrangements in place.

We do not disclose enquiry information to unrelated third parties for their independent marketing purposes.

6. International Data Transfers

Some technology or communications service providers may process or access personal information outside the United Kingdom.

Where an international transfer is subject to UK data protection transfer requirements, we will use an applicable UK adequacy arrangement or appropriate safeguards, such as an approved International Data Transfer Agreement or UK Addendum, as required.

Further information about applicable transfer arrangements may be requested using the privacy contact details above.

7. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, accounting and business record-keeping requirements.

Our retention approach is as follows:

• General enquiries: Normally retained for up to 24 months following the last substantive communication, unless an ongoing business relationship or another justified requirement warrants longer retention.
• Business relationship records: Retained for the duration of the relationship and any applicable subsequent legal or record-keeping period.
• Technical and security logs: Retained according to documented operational and security requirements.
• Marketing contact information: Retained while there is a lawful basis to contact you, subject to periodic review and your applicable rights.

Information may be deleted, anonymised or retained for longer where reasonably necessary to establish, exercise or defend legal claims or comply with legal obligations.

8. Information Security

We apply appropriate technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration or loss.

These may include access controls, secure communications, appropriate authentication, system maintenance and restrictions on access to personal information.

No internet-based transmission or storage system can be guaranteed completely secure.

9. Your Data Protection Rights

Subject to applicable legal conditions and exceptions, you may have the right to:

• Request access to personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request erasure of personal information.
• Request restriction of processing.
• Object to processing, including processing based on legitimate interests.
• Request data portability where applicable.
• Withdraw consent at any time where processing relies on consent.
• Exercise applicable rights concerning automated decision-making.

To exercise these rights, contact us using the privacy email address provided in Section 1.

We will respond in accordance with applicable statutory requirements.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection supervisory authority, at www.ico.org.uk.

10. Cookies and Website Analytics

Our website may use cookies or similar technologies necessary for its operation, security and functionality.

We may also use analytics or other optional technologies to understand website performance and visitor interactions.

Where consent is required under applicable electronic communications law, we will obtain it before using the relevant technologies. Visitors will be provided with information about applicable cookies and available controls.

Further information will be available in our Cookie Policy or website cookie settings, where applicable.

11. External Websites

Our website may contain links to external websites operated by third parties.

We are not responsible for the privacy practices of those organisations. Visitors should review their respective privacy notices before providing personal information.

12. Changes to This Notice

We may update this Privacy Notice to reflect changes in our website, business activities, service providers or legal obligations.

The latest version will be published on this website, together with its revision date.

13. Contact

For enquiries concerning this notice, our processing of personal information or your data protection rights, please contact:

HeXPlanIT Limited
Barry Whitfield
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ