Privacy Policy

1. Overview & Who We Are

Improx Group is the data controller for personal data processed through our website and service engagements. We are a multi-disciplinary business services firm providing Consulting, Cloud, Digital Marketing, Data & AI, BPO, Software Development, IT Services, and Virtual Assistant services to businesses globally.

Our website is intended for business-to-business audiences. We do not knowingly market to individuals under the age of 18.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

2.1 Information You Provide

• Contact information: Full name, email address, phone number, company name, job title.
• Enquiry content: Messages, project briefs, or documents you send us through our contact forms or by email.
• Contract data: Information needed to enter into and perform a service agreement, including billing address, company registration details, and payment information (processed by our secure payment partners).
• Account credentials: Where we provide client portal access, your login details.
• Communications: Records of emails, calls, meetings, and other correspondence with us.
• Feedback & surveys: Responses to questionnaires, testimonials, or satisfaction surveys.

2.2 Information Collected Automatically

• Usage data: Pages visited, time spent, clicks, scroll depth, referring URL, and exit pages.
• Technical data: IP address, browser type and version, operating system, device type, screen resolution, and language settings.
• Cookie data: Data collected via cookies and similar tracking technologies (see Section 10).

2.3 Information from Third Parties

• Referrals: Information shared by a mutual contact who referred you to us.
• Professional networks: Publicly available professional information from platforms such as LinkedIn.
• Analytics providers: Aggregated and anonymised data from tools such as Google Analytics.

3. How We Collect Your Data

We collect data through the following means:

• Contact & enquiry forms on our website.
• Email and telephone communications you initiate with us.
• Cookies and tracking technologies when you browse our website.
• Newsletter subscriptions and event registrations.
• Service delivery — data you or your organisation share during the course of our engagement.
• Business development activities such as networking events, conferences, or referrals.

4. How We Use Your Personal Data

We use personal data for the following purposes:

• Responding to enquiries: To reply to your questions, provide quotations, and discuss potential engagements.
• Service delivery: To provide the services outlined in our agreements, including communication, project management, and reporting.
• Billing & contracts: To issue invoices, process payments, and manage our contractual relationship.
• Marketing & communications: To send relevant content, industry insights, and service updates to individuals who have opted in or with whom we have a legitimate business relationship.
• Website improvement: To analyse usage patterns, test new features, and improve the usability and content of our website.
• Security & fraud prevention: To detect, prevent, and respond to potential security incidents or fraudulent activity.
• Legal compliance: To comply with applicable laws, regulations, and court orders, and to defend or exercise our legal rights.
• Business operations: For internal record-keeping, auditing, and business administration purposes.

5. Legal Basis for Processing (GDPR)

Where GDPR or equivalent legislation applies, we rely on the following legal bases:

Where we rely on legitimate interests, you have the right to object to the processing (see Section 11).

6. Sharing Your Personal Data

We do not sell, rent, or trade your personal data. We may share your data with:

• Service providers: Trusted third parties who support our operations, such as cloud hosting providers, CRM platforms, project management tools, payment processors, and email delivery services. These providers act as data processors and are contractually bound to process data only on our instructions.
• Professional advisers: Our lawyers, accountants, and auditors, who are subject to professional confidentiality obligations.
• Regulatory authorities: Government bodies, courts, or law enforcement when required by law or to protect our legal rights.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred as part of that transaction, subject to equivalent privacy protections.
• With your consent: Any other parties where you have provided explicit consent.

We ensure all third parties respect the security of your data and treat it in accordance with applicable law.

7. International Data Transfers

Improx Group operates internationally. Your data may be transferred to, stored in, and processed in countries outside the United Kingdom or European Economic Area (EEA).

Where such transfers occur, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Adequacy decisions by the UK ICO or European Commission; or
• Other lawful transfer mechanisms as recognised under applicable law.

You may request details of the specific mechanisms used for any transfer by contacting us at the details in Section 15.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements.

• Client records: Retained for 7 years from the end of the engagement to comply with financial record-keeping requirements.
• Enquiry data (non-clients): Retained for 12 months from the date of last contact, unless you request earlier deletion.
• Marketing consent records: Retained until you withdraw consent, plus a further 3 years for legal evidence purposes.
• Website analytics data: Typically retained in aggregated or anonymised form; identifiable data retained for up to 26 months.

When data is no longer required, it is securely deleted or anonymised.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (TLS) and at rest where appropriate;
• Access controls and role-based permissions for internal systems;
• Regular security assessments and vulnerability testing;
• Staff training on data protection and security awareness;
• Incident response procedures for data breaches.

Where we suspect a personal data breach that affects your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform you without undue delay.

10. Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience and analyse site traffic.

Types of Cookies We Use

Managing Cookies

When you first visit our website, you will be presented with a cookie consent banner. You can manage your preferences at any time through your browser settings. Note that disabling certain cookies may impact functionality.

For more information about cookies and how to control them, visit allaboutcookies.org.

11. Your Data Protection Rights

Depending on your location and the applicable law, you may have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may ask us to correct inaccurate or incomplete data.
• Right to Erasure: You may ask us to delete your data where there is no compelling reason for us to continue processing it.
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances.
• Right to Data Portability: You may request a copy of data you provided to us in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right Not to be Subject to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing where those decisions have significant effects on you.

To exercise any of these rights, please contact us at privacy@improxgroup.com. We will respond within one month of receiving your request. We may need to verify your identity before fulfilling your request.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the relevant supervisory authority (e.g., the ICO in the UK at ico.org.uk).

12. Children's Privacy

Our website and services are directed at business professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it promptly.

13. Third-Party Links

Our website may contain links to third-party websites, plugins, or services. Clicking on those links may allow third parties to collect data about you. We do not control these websites and are not responsible for their privacy practices. We encourage you to read the privacy notice of every website you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page;
• Display a notice on our website for 30 days following significant changes; and
• Notify active clients by email where the changes materially affect how we use their data.

We encourage you to review this page periodically. Your continued use of our services after changes take effect constitutes your acceptance of the updated policy.

15. Contact Us & Data Protection Officer

For any questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern, please contact us:

We aim to respond to all legitimate requests within one calendar month. If your request is particularly complex or numerous, we may extend this by a further two months and will notify you accordingly.