Privacy Policy for Exavor Limited

Last update: September 01, 2026

  1. 1. About this policy

    1.1. This policy explains how Exavor Limited ("Exavor", "we", "us", "our") collects, uses, shares and protects personal data when you: (a) visit exavorlimited.com (the "Website"); (b) contact us through the Website contact form, by email or by any other means; or (c) deal with us as a client, prospective client, supplier, partner or other business contact.

    1.2. Name and Address of the controller:

    Controller for the purposes of the UK General Data Protection Regulation (GDPR UK) and other provisions related to data protection is:

    Exavor Limited

    Website: exavorlimited.com

    Email: [email protected]

    Address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

    1.3. We process personal data in accordance with the UK General Data Protection Regulation (Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland).

  2. 2. What we collect, why, on what legal basis, and for how long

    This table is the core of this policy. It sets out, for each category of personal data, the purpose of the processing, the lawful basis we rely on under Article 6 UK GDPR, and how long we keep the data.

    Category and examples Purpose Lawful basis (Art. 6 UK GDPR) Retention
    Enquiry data — your name, email address, telephone number (if you give it), organisation, the subject and content of your message, and anything else you choose to include in the contact form or in an email to us. To receive, assess and respond to your enquiry; to contact you about it; to decide whether we can work together. Art. 6(1)(b) steps taken at your request before entering into a contract, where your enquiry concerns our services.

    Art. 6(1)(f) our legitimate interest in responding to enquiries addressed to us and in operating our business, where you write to us for any other reason or on behalf of an organisation.     		24 months from the date of our last substantive contact with you.
    Correspondence data — email addresses, message headers and routing data, message content, attachments, and the contact details in your signature block. To manage and keep a record of our correspondence; to evidence what was requested, offered or agreed; to establish, exercise or defend legal claims. Art. 6(1)(f) our legitimate interest in administering the business, keeping accurate records and protecting our legal position. 24 months from the date of our last substantive contact with you.
    Technical and security data — IP address, date and time of each request, the URL requested, HTTP response code, bytes transferred, and the user-agent string (browser type and version, operating system). To deliver the Website to your device; to keep it available and secure; to detect, investigate and respond to faults, abuse, bots and attacks; to keep access logs as evidence. Art. 6(1)(f) our legitimate interest in network and information security and in keeping the Website functioning correctly. This interest is expressly recognised in Recital 49 UK GDPR. 30–90 days in rolling server logs, then automatically overwritten, except where a specific log is retained for the investigation of a security incident.

  3. 3. Where we get your personal data from

    3.1. Directly from you, when you complete the contact form, send us an email, speak to us, or give us information in the course of a business relationship.

    3.2. Automatically, when you use the Website. Our web server and our hosting provider generate the technical, security data. This happens whether or not you contact us.

  4. 4. Legitimate interests: how we balance them

    4.1. Where we rely on Article 6(1)(f) UK GDPR, the law requires us to weigh our interest against your interests, rights and freedoms. We have carried out and documented a legitimate interests assessment for each such purpose.

    4.2. You may ask us for a summary of any legitimate interests assessment by writing to [email protected].

  5. 5. Who we share personal data with

    5.1. We do not sell personal data. We do not share it with advertising networks, data brokers or affiliate networks for their own marketing or profiling purposes.

  6. 6. How we keep personal data secure

    6.1. No transmission over the internet can be guaranteed to be completely secure. Please do not send us sensitive information such as health data, identity documents or payment card details through the Website contact form. If you need to send us something sensitive, contact us first and we will agree a secure method.

    6.2. If a personal data breach occurs, we assess it without delay.

  7. 7. How long we keep personal data

    7.1. The retention periods are set out in the table in section 2. They reflect what we need the data for, any legal or accounting obligation to keep it, and the periods within which claims can be brought against us.

    7.2. When a period expires, we delete the data or irreversibly anonymise it.

  8. 8. Your rights

    8.1. Under the UK GDPR you have the following rights, free of charge:

    • Access. To be told whether we hold personal data about you and, if we do, to receive a copy of it together with information about how we use it.

    • Rectification. To have inaccurate personal data corrected and incomplete data completed.

    • Erasure. To have your personal data deleted where there is no good reason for us to continue holding it.

    • Restriction. To ask us to suspend the use of your personal data, for example while its accuracy is being checked.

    • Objection. To object to processing based on our legitimate interests, on grounds relating to your particular situation. Where we process your data for direct marketing, your right to object is absolute — we will stop immediately.

    • Portability. To receive the personal data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where this is technically feasible.

    • Withdrawal of consent. Where we rely on your consent, to withdraw it at any time.

    • Automated decisions. Not to be subject to a decision based solely on automated processing that produces legal effects for you or similarly significantly affects you. We do not take such decisions. To exercise any of these rights, email [email protected].

    8.2. Response times. We will respond to requests to exercise your data protection rights without undue delay and within the time limits required by the UK GDPR and the Data Protection Act 2018. Where those laws permit us to extend or to pause that period — for example, because your request is complex or numerous, or because we reasonably require further information from you to verify your identity or to identify what your request relates to — we will notify you and explain our reasons.

  9. 9. Changes to this policy

    We may update this policy from time to time. The current version is always published on the Website with the date at the top. If we make a change that materially affects how we use your personal data, we will take reasonable steps to bring it to your attention, and where the change requires your consent we will ask for it before the change takes effect.

  10. 10. Contact

    Questions about this policy or about how we handle personal data: [email protected].