Privacy Policy

1. Who We Are and Scope

ITLOX, Inc., a corporation incorporated in the State of Delaware, USA, is the data controller for personal data collected through the itlox.com website and related pre-sales and marketing activities. ITLOX, Inc. is the parent company of the ITLOX group. Its principal business address is 1111B S Governors Ave # 91881, Dover, DE 19904, United States; its registered office and registered agent in Delaware are Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713.

ITLOX LTD (England and Wales, company number 16587309, registered office 167-169 Great Portland Street, London W1W 5PF) provides development, support and operational services to the group, and handles enquiries submitted through this website on behalf of ITLOX, Inc. ITLOX LTD is not a separate controller of that data.

Other companies in the group publish their own privacy information for their own products: RadMah, Inc. and AegisWire, Inc. are the controllers for personal data collected through their own websites and services.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you:

• Visit or interact with the itlox.com website
• Submit an enquiry, interest registration, or contact form
• Subscribe to ITLOX communications
• Enter into a commercial relationship with ITLOX
• Use any ITLOX product or service where ITLOX acts as a data controller

Where ITLOX processes personal data on behalf of enterprise customers (acting as a data processor), the terms of the applicable Data Processing Agreement govern that processing.

2. Personal Data We Collect

2.1 Data You Provide Directly

• Identity data: name, job title, company name
• Contact data: email address, phone number, postal address
• Account data: login credentials, account preferences, subscription details
• Communication data: enquiry content, support request details, feedback
• Payment data: billing address, payment method details (processed by our payment processor; we do not store full card numbers)
• Technical requirements and use case information provided during sales enquiries

2.2 Data Collected Automatically

• Technical data: IP address, browser type and version, operating system, device identifiers
• Usage data: pages visited, time spent on pages, referring URLs, exit pages, click paths
• Cookie data: as described in our Cookie Policy

2.3 Data from Third Parties

• Publicly available professional information (e.g. LinkedIn profiles, company websites) for business development purposes
• Information from analytics providers and advertising platforms (where you have consented to their data collection)
• Referral information from partners or affiliates

2.4 Sensitive Data

We do not intentionally collect special category personal data (health, biometric, genetic, racial or ethnic origin, political opinions, religious beliefs, sexual orientation) through the itlox.com website. If such data is provided voluntarily in a communication, we will handle it with heightened care and only process it where a lawful basis under GDPR Article 9 applies.

3. Lawful Basis and Purposes for Processing

We process personal data only where we have a valid lawful basis under UK GDPR Article 6. The table below summarises our main processing activities:

4. Processors, Sub-Processors, and Disclosure

We do not sell, trade, or rent your personal data. We may share your data with the following categories of recipients:

4.1 Service Providers and Processors

We engage trusted third-party processors who act on our instructions and are bound by data processing agreements:

• Microsoft (Microsoft Corporation / Microsoft Ireland Operations Ltd) — cloud hosting for this website (Azure, UK South), and business email delivery and mailbox storage for enquiries (Microsoft 365 / Microsoft Graph)
• Google (Google LLC / Google Ireland Ltd) — website analytics via Google Analytics 4, set only where you have consented, and automated abuse prevention on our forms via reCAPTCHA v3
• Usercentrics A/S (Cookiebot) — cookie consent management and storage of your consent record

4.2 Legal and Regulatory Disclosure

We may disclose personal data where required by law, court order, or regulatory authority, or where necessary to protect the rights, property, or safety of ITLOX, its customers, or the public. We will notify you of such disclosure where legally permitted.

4.3 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, personal data may be transferred to the successor entity, subject to the same privacy protections as described in this policy. We will notify you of any such transfer.

5. International Data Transfers

ITLOX operates globally and your personal data may be transferred to and processed in countries outside the UK and European Economic Area ("EEA"), including the United States. We ensure appropriate safeguards are in place for all international transfers:

• Adequacy decisions: We transfer data to countries with an ICO or EU adequacy decision where available
• Standard Contractual Clauses: For transfers to processors in countries without a UK adequacy decision we rely on the UK Addendum to the EU SCCs or the UK IDTA, and we assess the risk of a transfer before it begins
• US transfers: Our US-based processors are Microsoft (email delivery and hosting) and Google (site analytics and reCAPTCHA). Each is engaged under its published data protection terms incorporating the UK Addendum or EU SCCs

You may request a copy of the transfer mechanisms we rely on by contacting dpo@itlox.com.

6. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security programme includes:

• Encryption of personal data in transit (TLS 1.2+) and at rest
• Access controls and authentication requirements for staff accessing personal data
• Regular security assessments and vulnerability management
• Incident response procedures that follow ICO notification requirements (72-hour notification for qualifying breaches)
• Contractual security requirements imposed on all data processors

No internet transmission is completely secure. While we employ strong safeguards, we cannot guarantee absolute security of data transmitted over the internet. In the event of a personal data breach affecting your rights and freedoms, we will notify you and the ICO without undue delay as required by UK GDPR Article 33-34.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. Our standard retention periods are:

Data is securely deleted or anonymised after the applicable retention period expires, unless longer retention is required by law or is necessary for the establishment, exercise, or defence of legal claims.

8. Your Rights

Under UK GDPR and (where applicable) EU GDPR, you have the following rights in relation to your personal data:

9. California Residents — CCPA / CPRA Notice

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) may provide you with additional rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you and the purposes for which it is used
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: ITLOX does not sell personal information and does not share it for cross-context behavioural advertising
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA rights

To exercise your California rights, contact privacy@itlox.com. We will respond within 45 days.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website. Full details of the cookies we use, their purposes, legal basis, and how to manage your preferences are set out in our Cookie Policy. You can manage your cookie preferences at any time via the Cookie Settings link in our website footer.

11. Children's Privacy

ITLOX services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child under 18, we will take immediate steps to delete that information. If you believe we have collected personal data from a child, please contact privacy@itlox.com.

12. Supervisory Authority and Complaints

You have the right to lodge a complaint with a supervisory authority if you believe your personal data has been processed unlawfully. We ask that you contact us first at dpo@itlox.com as we are committed to resolving complaints directly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, legal requirements, or best practice. We will post the updated policy with a new "Last updated" date. For material changes affecting your rights, we will notify you by email (where we hold your address) or through a prominent notice on our website. Your continued use of ITLOX services after the effective date of an updated policy constitutes your acknowledgment of the changes.

14. Contact Us