Privacy notice

This notice explains how XCurve AI ("we", "us", "our") collects and uses personal information when you visit our website, contact us, book or attend our training, or work with us. We are the controller of the personal information described here.

Who we are and how to contact us

XCurve AI is a UK company based in London. Our registered company name, company number and registered office address are shown at the foot of every page of this website.

If you have any questions about this notice or how we use your information, email us at cs@xcurveai.com.

The information we collect

We collect only what we need for the purposes below.

• Enquiries and quote requests: your name, email address, organisation, phone number if you give it, the type of enquiry, your message and any details about the training you need, such as the number of learners, delivery preferences and timing.
• How you found us: the page you sent your enquiry from and, if you arrived from a campaign link or another website, the campaign or referring site.
• Bookings and training: the names and contact details of attendees, the course and date booked, billing details, attendance and completion records, and any accessibility or dietary needs you choose to tell us about.
• Payments: when online payment is available, card payments are handled by our payment provider. We do not see or store your full card details.
• Correspondence: emails and other messages you exchange with us.
• Technical information: basic information your browser sends when you visit, such as your IP address, browser type and the pages you request, which our hosting and security services use to run and protect the website.

How and why we use your information

Data protection law requires us to have a lawful basis for each use of your information.

• To reply to enquiries and prepare proposals: our legitimate interests in responding to people who contact us, or steps you ask us to take before entering into a contract.
• To provide training and consulting we have agreed with you or your organisation: performance of a contract, or our legitimate interests where the contract is with your employer.
• To issue invoices, keep accounts and meet tax and other legal requirements: legal obligation.
• To keep the website and our services secure, prevent spam and fraud, and improve how they work: our legitimate interests.
• To send news and marketing emails: your consent, which you can withdraw at any time using the unsubscribe link in each email or by contacting us. Where you are an existing customer we may rely on the soft opt in for similar services, and you can opt out at any time.

We do not sell your personal information, and we do not use it for automated decisions that have legal or similarly significant effects on you.

Who we share it with

We share personal information only where needed, with:

• service providers who help us run our business, such as our website hosting and database provider (servers in Frankfurt, Germany), our email delivery provider, our file storage provider, our spam protection provider and, when online booking opens, our payment provider;
• your employer or the organisation that booked your place, for example to confirm attendance or completion;
• professional advisers such as accountants, lawyers and insurers;
• authorities, regulators or others where the law requires it.

Our service providers act on our instructions and must keep your information secure.

International transfers

We aim to store personal information in the UK or the European Economic Area. Some of our service providers, or their support teams, may access information from other countries. When that happens we make sure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

How long we keep it

• Enquiries and related correspondence: up to 24 months after our last contact, unless they lead to a contract.
• Booking, attendance and completion records: for as long as needed to provide the service and confirm completion, and then for up to 6 years.
• Financial and tax records: 6 years, as the law requires.
• Records of your marketing choices: up to 6 years after you withdraw consent, so we can show we respected your choice.
• Technical logs: around 30 days.

We review these periods regularly and delete or anonymise information we no longer need.

Your rights

You have the right to:

• ask for a copy of your personal information;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use it;
• object to our use of it, including for direct marketing;
• ask us to transfer information you gave us to you or another organisation;
• withdraw your consent at any time, where we rely on consent.

Some rights depend on our lawful basis and other circumstances. To use any of them, email cs@xcurveai.com. We will reply within one month. We may need to confirm your identity first.

Children

Our courses are designed for adults. Where we run programmes for students under 18, we arrange them through their school, college or university, which shares only the information needed to run the session. We do not knowingly collect information directly from children.

Security

We use appropriate technical and organisational measures to protect your information, including encryption in transit, access controls and two step sign in for staff accounts.

Complaints

If you are unhappy with how we have used your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Changes to this notice

We may update this notice from time to time. The date at the top shows when this version took effect, and earlier versions are listed on this page.