Last updated: 29 October 2026
XASPRO Consultancy ("we", "us", "our") is based in Greater London. This policy explains what personal data we collect when you use this website, why we collect it, and the choices you have.
1. Who we are
XASPRO Consultancy is the data controller for the personal data described in this policy. If you have questions about this policy or how we handle your data, contact us at [email protected].
2. What we collect
Contact form submissions. When you submit our contact form, we collect your name, email address, company (if provided), the service you're interested in, and your message, so we can respond to your enquiry.
Newsletter subscriptions. If you subscribe to our mailing list, we store your email address and the date you subscribed. You can unsubscribe at any time using the link in every email we send.
Email engagement. For emails we send to subscribers, we track whether an email was opened and which links were clicked, using a tracking pixel and wrapped links. This helps us understand what content is useful and avoid sending emails nobody reads.
Website analytics. We collect basic, first-party analytics on this site - the pages you visit, the referring page, and outbound link clicks - tied to an anonymous session identifier stored in a cookie. We do not use third-party analytics or advertising trackers, and we do not sell or share this data.
Client portal accounts. If you're a client with an active engagement, we create an account for you (name, email, and login credentials) so you can view your project's status, milestones, and deliverables. Project data, milestones, and any files we share with you are only accessible to your account.
3. How we use your data
We use the data described above to:
- Respond to enquiries and provide quotes
- Deliver the services you've engaged us for, including through the client portal
- Send newsletter or campaign emails to subscribers who've opted in
- Understand how visitors use our website so we can improve it
- Meet our legal and accounting obligations
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
4. Legal basis for processing
Where UK/EU GDPR applies, we rely on:
- Consent - for newsletter subscriptions and contact form submissions (you tick a box confirming you agree to this policy)
- Contract - for data we need to deliver an engagement you've asked us to carry out, including client portal access
- Legitimate interests - for first-party website analytics and email engagement tracking, used only to understand and improve our own service
5. Who we share data with
We use a small number of service providers to run this site and deliver our services - for example, our hosting provider and our email delivery provider. These providers only process data on our instructions and don't use it for their own purposes. We don't share your data with anyone else unless required by law.
6. How long we keep data
- Contact form submissions are kept for as long as needed to handle your enquiry and for a reasonable period afterwards for our records.
- Subscriber data is kept until you unsubscribe or ask us to delete it.
- Client portal accounts and project data are kept for the duration of the engagement and for a reasonable period afterwards to meet contractual and legal obligations.
- Analytics data is retained only as long as needed to be useful for understanding site trends, and is not kept indefinitely.
7. Your rights
Under UK GDPR, you have the right to:
- Ask what personal data we hold about you, and get a copy of it
- Ask us to correct inaccurate data
- Ask us to delete your data (subject to any legal obligation to keep it)
- Withdraw consent at any time, including unsubscribing from emails
- Object to processing based on legitimate interests
- Complain to the Information Commissioner's Office (ICO) if you think we've mishandled your data
To exercise any of these rights, email us at [email protected].
8. Cookies
We use a small number of first-party cookies: one to keep you signed in (for admin and client portal accounts) and one to identify an anonymous browsing session for analytics. We don't use third-party advertising or tracking cookies.
9. Changes to this policy
We may update this policy from time to time as our services change. The "last updated" date at the top of this page reflects the most recent revision.