Privacy Policy · XeonTek

1. Who We Are

XeonTek Ltd ("we", "us", "our") is a company registered in England and Wales with company number 08454858. Our registered office is 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom.

For any data protection enquiries, contact us at [email protected].

2. How We Use Personal Data

This website collects limited personal data. We do not require you to create an account and we do not process payments through this site. We use Google Analytics to understand how the site is used, and analytics cookies are only set if you consent to them.

Activity	Data involved	Purpose	Lawful basis	Retention
General contact enquiries	Name, email address, subject, message content	Responding to your enquiry and keeping a business record	Legitimate interests in responding to business enquiries, or steps before entering into a contract where your enquiry relates to potential work	Up to 24 months unless a longer period is needed
Recruitment or application enquiries	Name, email address, message content, role applied for, and any application details you choose to provide	Reviewing and responding to recruitment enquiries	Legitimate interests in managing recruitment, or steps before entering into an employment or contractor arrangement	Up to 12 months unless you are engaged by us or agree to a longer retention period
Turnstile anti-spam verification	Browser and device signals, IP address, challenge outcome, and security tokens processed by Cloudflare Turnstile	Protecting the contact form from spam and abuse	Legitimate interests in site security and abuse prevention	Retained by Cloudflare according to its service and security retention practices
Hosting, CDN, and security logs	IP address, request metadata, user agent, timestamps, and requested URLs, including PDF/whitepaper requests	Delivering the website, preventing abuse, and diagnosing issues	Legitimate interests in operating and securing the website	Retained by Cloudflare according to configured service and log retention settings
Email delivery	Contact form message data routed to our mailbox	Delivering your message to the relevant XeonTek mailbox	Legitimate interests or steps before entering into a contract, depending on the enquiry	Follows the relevant enquiry retention period above, unless needed for legal or compliance reasons
Aggregate traffic measurement	Page requested, referring page, country, browser and device type, and page performance timings. No cookies are set and no identifier is stored on your device	Understanding overall traffic levels and which pages are read, including for visitors who decline analytics cookies	Legitimate interests in understanding how our own website performs	Retained by Cloudflare according to its Web Analytics retention practices
Website analytics	Pages viewed, referring page, approximate location derived from a truncated IP address, device and browser type, and a randomly generated identifier stored in a cookie where you have consented	Understanding which pages and research papers are read, so we can improve them	Consent. Analytics cookies are set only after you accept them, and you can withdraw consent at any time	Up to 14 months in Google Analytics, subject to our configured retention setting
Legal or compliance correspondence	Correspondence and related business records	Handling legal, regulatory, or compliance matters	Legal obligation or legitimate interests	Up to 6 years where necessary

3. Cookies and Similar Technologies

Analytics cookies. We use Google Analytics 4 to understand how the site is used. It is loaded with Google Consent Mode, which means that until you accept, it runs without cookies and without any identifier that would let us recognise you again. If you accept, Google Analytics sets first-party cookies (named _ga and _ga_*) which typically last up to two years.

You can decline, and nothing else about the site changes. To change your mind later, clear this site's cookies and site data in your browser and the choice will be asked again on your next visit.

We do not use advertising or behavioural profiling cookies, and we have advertising signals switched off in Google Consent Mode at all times.

Aggregate traffic measurement. We also use Cloudflare Web Analytics, which is cookieless. It sets nothing on your device and stores no identifier that could be used to recognise you across visits or across other websites, so it does not require consent and is not affected by the choice above. It tells us how many people visit and which pages they read, nothing more.

Security. Cloudflare Turnstile is loaded on the contact and application forms to verify that submissions are legitimate. Turnstile may use cookies or similar technologies, browser signals, and security tokens for bot detection and abuse prevention. We treat this as strictly necessary for protecting the forms and the website, so it does not require consent.

Preferences. We store your light or dark theme choice and your cookie choice in your browser's local storage. These stay on your device, are never sent to us, and are strictly necessary to honour the preferences you have set.

4. Third-Party Processors and Transfers

We use Cloudflare, Inc. to host and secure this website, provide CDN services, run Turnstile, operate the form submission functions, and provide cookieless traffic measurement through Cloudflare Web Analytics. We use Brevo to deliver contact and application emails. We use Google Ireland Limited for Google Analytics, and only where you have consented to analytics cookies. These providers process personal data on our behalf as service providers.

Cloudflare and Google may process data outside the United Kingdom and European Economic Area. Where this happens, we rely on their data processing terms and appropriate transfer safeguards, such as standard contractual clauses and the UK Addendum or other safeguards recognised under UK data protection law.

We have IP anonymisation applied in Google Analytics, we do not enable Google Signals or advertising personalisation, and we do not share analytics data with Google for its own advertising purposes.

We do not sell or rent your personal data. We may disclose personal data where required by law or where necessary to protect our legal rights.

5. Automated Decision-Making and AI

This public website does not provide an AI system to visitors and does not use automated decision-making or profiling that produces legal or similarly significant effects. Contact form submissions are not used to train AI models.

XeonTek develops AI-enabled products and research, but product-level AI disclosures, risk information, and user documentation are provided in the relevant product or service context. This website itself does not make decisions about you using AI.

6. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), secure hosting infrastructure, and access controls. However, no method of transmission over the internet is completely secure.

7. Your Rights

Under the UK GDPR, you have the right to:

Access the personal data we hold about you
Rectify inaccurate or incomplete data
Request erasure of your data
Restrict or object to processing
Data portability — receive your data in a structured, machine-readable format
Withdraw consent at any time where consent is the lawful basis

To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

9. Contact

If you have questions about this Privacy Policy, contact us at [email protected].

XeonTek Ltd
Company number 08454858
Registered in England and Wales
27 Old Gloucester Street, London, WC1N 3AX, United Kingdom