Privacy Policy

Last updated: 22 July 2026

Xanalys Ltd (“Xanalys”, “we”, “us”) is committed to protecting your privacy. This Privacy Policy explains what personal information we collect through our website xanalys.org (the “Site”) and in the course of our business, how we use and share it, and the rights available to you. It should be read together with our Cookie Policy, which describes the cookies and similar technologies used on the Site.

1. Who we are

Xanalys Ltd is a company registered in England and Wales (Company No. 06603135, VAT No. GB 942 6590 05) with its registered office at Market Court, 20-24 Church Street, Altrincham, Cheshire, WA14 4DW, England. Xanalys is part of the Harris group of companies. For the purposes of the UK GDPR and EU GDPR, Xanalys Ltd is the controller of personal information collected through the Site.

You can contact us about privacy matters at privacy@xanalys.com or by writing to the address above.

2. Personal information we collect

Information you provide to us. When you contact us through the enquiry form on the Site, by email, or by telephone, we collect the information you choose to give us, such as your name, email address, organisation, job title, and the content of your message. If you apply for a job with us, we collect the information contained in your application.

Information collected automatically. When you visit the Site, we and our service providers collect certain information automatically, subject to your cookie consent choices where required. This includes device and browser information, IP address, pages visited, and how you interact with the Site (via Google Analytics 4, only with your consent), information used to detect bots and protect the Site (via Google reCAPTCHA and Cloudflare bot management), and standard server logs maintained by our hosting provider for security purposes. The cookies involved are listed in full in our Cookie Policy.

Information from business relationships. If you or your organisation do business with us, we collect contact and professional information needed to manage that relationship, such as names, business contact details, and correspondence.

We do not collect special category (sensitive) personal information through the Site, and the Site is not directed at children.

3. How and why we use personal information

We use personal information for the following purposes, relying on the legal bases shown:

We do not use personal information for automated decision-making that produces legal or similarly significant effects, and we do not use it for targeted advertising.

4. Cookies and similar technologies

The Site uses cookies as described in our Cookie Policy. Except for strictly necessary cookies, no cookies are set until you give consent through the cookie banner. You can change or withdraw your consent at any time using the “Consent Preferences” button at the bottom left of any page. We also honour the Global Privacy Control (GPC) signal and other legally recognised universal opt-out signals.

5. Who we share personal information with

We share personal information only as described below. We do not sell personal information for money, and we never have.

• Service providers who support the operation of the Site and our business, acting on our instructions: our website hosting provider (SiteGround), Google LLC (Google Analytics 4, only with your consent, and Google reCAPTCHA for spam protection), Cloudflare, Inc. (bot management supporting the delivery of Site resources), and providers of IT, email and business systems.
• Group companies. Xanalys is part of the Harris group of companies, and we may share information within the group where necessary for the purposes described in this policy, subject to appropriate safeguards.
• Professional advisers such as lawyers, auditors and insurers, where necessary.
• Authorities and other parties where required by law, including to comply with legal obligations, enforce our rights, or in connection with a corporate transaction such as a merger or acquisition.

To the extent that the use of analytics cookies constitutes “sharing” or a “sale” under the CCPA/CPRA, you may opt out at any time via the cookie banner, the “Consent Preferences” button, or by enabling Global Privacy Control in your browser.

6. International transfers

We are based in the United Kingdom. Some of our service providers (including Google LLC and Cloudflare, Inc.) are located in, or process information in, the United States and other countries outside the UK and the European Economic Area. Where personal information is transferred internationally, we rely on appropriate safeguards recognised under UK and EU law, such as the UK Extension to the EU-US Data Privacy Framework, adequacy regulations, the UK International Data Transfer Agreement, or Standard Contractual Clauses, as applicable.

7. How long we keep personal information

We keep personal information only for as long as necessary for the purposes described in this policy. Enquiry correspondence is retained for as long as needed to handle the enquiry and any follow-up, and business records are retained in line with legal, accounting and contractual requirements. Cookie lifetimes are set out in our Cookie Policy, and records of your consent choices are retained as evidence of compliance. When personal information is no longer needed, we delete or anonymise it.

8. How we protect personal information

We apply appropriate technical and organisational measures to protect personal information against unauthorised access, loss or misuse. Xanalys is certified to ISO/IEC 27001, the international standard for information security management. No transmission over the internet can be guaranteed to be completely secure, but we work to protect your information in line with recognised industry standards.

9. Your rights

9.1 If you are in the UK or the European Economic Area

You have the right to request access to your personal information, to have it corrected or erased, to restrict or object to our processing of it (including processing based on legitimate interests), to data portability, and to withdraw consent at any time where processing is based on consent (including cookie consent, via the “Consent Preferences” button). To exercise these rights, contact us at privacy@xanalys.com. You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the authority in your country of residence.

9.2 If you are a California resident

Under the CCPA/CPRA you have the right to know what personal information we collect, use and disclose; to access a copy of it; to correct inaccurate information; to delete it; to opt out of the sale or sharing of personal information; and not to be discriminated against for exercising these rights.

In the last 12 months we have collected the following categories of personal information: identifiers (such as name, email address and IP address); professional information (such as organisation and job title, where you provide them); and internet activity information (such as device, browser and Site usage data). We collect it from you directly and from your device, use it for the purposes in section 3, and disclose it to the categories of recipients in section 5. We do not collect sensitive personal information and do not use or disclose personal information for purposes requiring a right to limit.

We do not sell personal information for money. To the extent analytics cookies constitute “sharing” or a “sale”, you can opt out via the cookie banner, the “Consent Preferences” button, or a Global Privacy Control signal, which we honour as a valid opt-out request. You may also exercise any of your rights by emailing privacy@xanalys.com. You may use an authorised agent to submit requests on your behalf; we will verify requests using the information you provide and may ask for additional information where needed to confirm your identity.

9.3 Other US states and other jurisdictions

Residents of other US states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Texas and others), and individuals in other jurisdictions, may have similar rights of access, correction, deletion and opt-out under their local laws. We will honour valid requests in accordance with applicable law; contact us at privacy@xanalys.com to exercise them.

10. Children

The Site is intended for business audiences and is not directed at children under 18. We do not knowingly collect personal information from children, and we do not sell or share the personal information of anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Third-party websites

The Site contains links to other websites, including those of our partners and service providers. This policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to read the privacy policy of any website you visit.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the “Last updated” date above, and where the changes significantly affect you, we will take reasonable steps to bring them to your attention.

13. Contact us

If you have any questions about this Privacy Policy or how we handle personal information, or wish to exercise any of your rights, please contact us at privacy@xanalys.com, via our contact page, or write to:

Xanalys Ltd, Market Court, 20-24 Church Street, Altrincham, Cheshire, WA14 4DW, England