1. Who we are

This website is operated by Xpert IT Systems Ltd, referred to in this Privacy Policy as “Xpert IT Systems”, “XIS”, “we”, “us” or “our”.

Xpert IT Systems designs Artificial Intelligence Layers™ and intelligent operating systems. Our current activities include Business OS, the Revenue Recovery System, the XIS Specialist Network and the development of future robotics and cobot partnerships and delivery pathways.

For the purposes of applicable UK data protection law, Xpert IT Systems Ltd is the controller of personal information collected through this website, enquiry forms, application forms, consultation bookings, direct communications and our normal business activities.

In some client engagements, we may act as a processor where we handle personal information on behalf of a client while designing, implementing, supporting or coordinating their systems. The client will normally remain the controller of that information.

If you have any questions about this Privacy Policy or how your personal information is handled, contact us at [email protected].

2. Information we may collect

We may collect personal and business information when you use our website, submit a form, book a consultation, apply to join an XIS programme or network, contact us, become a client, work with us or interact with systems we operate.

This may include:

Your name, job title and business or trading name
Email address, telephone number and business contact details
Business website, location, industry, category, trade or service type
Information submitted through enquiry forms, eligibility forms, applications, questionnaires and consultation bookings
Information discussed during calls, meetings, consultations, reviews or delivery activity
Information about business knowledge, customers, processes, responsibilities, systems, workflows, decisions and Operating Logic
Information about enquiries, sales opportunities, follow-up activity, customer journeys and possible revenue leakage
Communication history, messages, meeting notes, tasks, decisions and service-related records
Payment, billing, invoicing and account information where relevant
Website usage information, including pages visited, form activity, booking activity, device information, approximate location, referral source and analytics data
Information required to design, implement, support or improve an Artificial Intelligence Layer™, Business OS or Revenue Recovery System
Information supplied by clients about their customers, prospects, staff, suppliers or other contacts where required for authorised service delivery

If you apply to join the XIS Specialist Network, we may also collect:

Your professional background, skills and specialist capabilities
Qualifications, certifications, accreditations and experience
Portfolio, CV, capability statement, case studies or professional profile information
Geographic coverage, availability and preferred delivery arrangements
Insurance, business structure and verification information
References or evidence used to assess professional suitability
Information about projects, outcomes and delivery experience

If you contact us regarding a robotics, cobot, manufacturer, supplier or distribution partnership, we may collect information about your organisation, products, commercial capability, geographic coverage and proposed relationship with XIS.

Please do not provide special category information, criminal offence information or other highly sensitive personal information unless we specifically request it and there is a valid reason and lawful basis for providing it.

3. How we collect information

We may collect information directly from you when you submit a form, book a consultation, apply to join the Specialist Network, email or message us, speak to us, become a client, enter into a commercial relationship or provide authorised access to systems for delivery.

We may also collect information automatically through website analytics, cookies, pixels, tracking technologies, CRM activity, booking tools and communication systems.

In some cases, we may receive business or professional information from publicly available sources, business websites, professional profiles, social media, directories, search engines, advertising platforms, referral partners, clients or other legitimate sources.

Where a client provides information about its customers, prospects, employees, suppliers or other contacts, we will process that information only for the authorised purposes of the relevant engagement and subject to the applicable contractual arrangements.

4. How we use your information

We use personal information to operate XIS, respond to enquiries, assess eligibility and applications, provide consultations, develop proposals, deliver services, manage relationships and improve our systems and methodology.

We may use your information to:

Respond to enquiries, messages and consultation requests
Book, confirm and manage calls, meetings and appointments
Send confirmations, reminders, follow-ups and service-related communications
Assess suitability for Business OS, Revenue Recovery or another XIS engagement
Diagnose revenue leakage, follow-up gaps, knowledge fragmentation, operational weaknesses and system requirements
Design Knowledge Architecture, Operating Logic and Artificial Intelligence Layers™
Configure, implement, support and improve Business OS and Revenue Recovery Systems
Prepare proposals, requirements, implementation plans, reviews and recommendations
Manage client onboarding, delivery, support, billing and account administration
Assess, verify and manage Specialist Network applications
Select suitable specialist capability for defined client requirements
Coordinate, oversee and evidence work delivered through the XIS Specialist Network
Assess manufacturer, supplier, reseller, distribution and robotics partnership opportunities
Maintain records of decisions, delivery activity, evidence, outcomes and lessons learned
Improve our website, services, methodology, systems, offers and internal processes
Send relevant service information or marketing communications where permitted
Maintain records for accounting, tax, contractual, compliance, legal, security and administrative purposes
Protect our business, clients, specialists, systems and users from misuse, fraud, security threats or unlawful activity

Where information may be used for a public case study, testimonial or identifiable evidence activity, we will agree the relevant scope and permissions with the person or organisation concerned.

We may use aggregated or de-identified information to improve XIS methodology, delivery standards, Business OS and the wider Artificial Intelligence Layer™ architecture where the information no longer identifies an individual.

5. Lawful bases for processing

We only process personal information where we have an appropriate lawful basis. The lawful basis will depend on why we are using the information and our relationship with you.

Our lawful bases may include:

Consent — where you have given clear permission for a particular use, communication, cookie or processing activity.
Contract — where processing is necessary to provide agreed services, manage a client or specialist relationship or take requested steps before entering into a contract.
Legitimate interests — where we have a legitimate business reason to respond to enquiries, assess applications, manage professional relationships, improve our systems, protect our business, carry out appropriate business-to-business communications or develop XIS, provided those interests are not overridden by your rights and interests.
Legal obligation — where processing is required for tax, accounting, employment, regulatory, compliance, legal or official purposes.

If we need to process special category information, we will also identify an appropriate additional condition and apply suitable safeguards.

6. Forms, applications, bookings and CRM systems

When you submit a form, complete an application, book a consultation or become a client or specialist, your details may be stored in our CRM, booking, communication, workflow and business management systems.

These systems help us manage enquiries, organise applications, maintain relationship history, schedule appointments, coordinate delivery, send relevant communications and keep accurate records.

We may use automated workflows to send form confirmations, email or SMS messages, appointment reminders, application updates, onboarding steps, service notifications and appropriate follow-up communications.

The use of an automated workflow to send or organise communications does not mean that a final eligibility, network admission or material commercial decision will necessarily be made without human review.

7. Artificial Intelligence Layers™ and automated processing

XIS may use Artificial Intelligence Layers™, AI-assisted systems, automation platforms, CRM systems and other business technology to support research, knowledge organisation, analysis, workflow design, system configuration, communication and service delivery.

AI-assisted systems may help us structure or summarise information, retrieve relevant business knowledge, identify gaps, compare evidence, prepare recommendations, support administrative work and improve consistency.

AI-generated or AI-assisted outputs may be incomplete or inaccurate. Where appropriate to the risk and purpose, we apply human review, professional judgement and other checks before relying on an output.

We do not currently use personal information to make solely automated decisions that produce legal or similarly significant effects on individuals. If that changes, we will provide appropriate information, identify a lawful basis and apply the safeguards required by law.

Where a client asks XIS to design or support an Artificial Intelligence Layer™ or other system that processes personal information, the client remains responsible for ensuring that its own lawful bases, privacy information, permissions, data quality, retention rules and governance arrangements are appropriate.

8. Specialist Network and third-party platforms

To operate our business and deliver services, we may use CRM, AI, automation, email, SMS, calendar, analytics, payment, website, hosting, storage, communication, accounting, reporting and project management platforms.

We may also use selected members of the XIS Specialist Network to support defined client requirements. Relevant specialists may be independent professionals or specialist companies.

Where a specialist needs access to personal information, access will be limited to what is reasonably necessary for the agreed requirement. We will use appropriate contractual, confidentiality, security and oversight arrangements according to the nature of the engagement.

Depending on the particular arrangement, a third party may act as our processor, sub-processor or as a separate controller responsible for its own processing. We will communicate relevant responsibilities where required.

Third-party providers may process personal information only as needed to provide their services, support authorised delivery, maintain security, comply with law or operate the relevant platform.

9. Marketing communications

We may send relevant business communications where you have requested information, submitted an enquiry, booked a consultation, become a client or specialist, opted in to receive updates or where another lawful basis permits the communication.

Marketing by email, SMS or other electronic methods may also be subject to the Privacy and Electronic Communications Regulations. Where consent is required, we will seek it. Where an appropriate business-to-business communication is permitted on another basis, we will still aim to keep messages relevant and easy to stop.

You have the right to object to direct marketing at any time. You can opt out by contacting us at [email protected] or by using any unsubscribe option included in the communication.

10. Cookies and website tracking

Our website may use cookies, pixels and similar storage or access technologies to provide essential functionality, understand how visitors use the website, measure performance, improve user experience and support appropriate marketing activity.

These technologies may be used for website functionality, analytics, performance measurement, embedded content, forms, booking tools, advertising platforms or CRM attribution.

Where required, we will seek consent before using non-essential cookies or similar technologies. You can also control cookies through your browser or any cookie controls made available on the website.

Some website features may not function correctly if cookies or other required technologies are disabled.

11. Sharing your information

We do not sell your personal information.

We may share limited personal information with trusted service providers, professional advisers, payment providers, accountants, legal advisers, technology providers and selected specialists where reasonably necessary to operate XIS, provide services, coordinate delivery, maintain security or comply with legal obligations.

Where XIS coordinates a client requirement through the Specialist Network, relevant information may be shared with the specialist selected to assess or deliver that requirement. We will seek to limit the information shared to what is necessary for the relevant purpose.

Specialist applicant information may be shared internally or with appropriate advisers or verification providers where needed to assess capability, identity, insurance, experience or network suitability.

We may share information where required by law, regulation, legal process, court order or official request, or where reasonably necessary to protect our business, systems, clients, specialists, users or others.

If Xpert IT Systems Ltd is involved in a merger, investment, restructuring, acquisition or sale of all or part of its business, relevant information may be disclosed subject to appropriate confidentiality and legal safeguards.

12. International transfers

Some technology providers and professional service providers may process or store personal information outside the United Kingdom.

Where a restricted international transfer takes place, we will seek to ensure that an appropriate transfer mechanism and any required safeguards are used. These may include UK adequacy regulations, approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, and any required risk assessment.

You can contact us if you would like further information about the safeguards relevant to a particular transfer.

13. Data retention

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate business, contractual, accounting, tax, compliance, security, legal and dispute-management purposes.

The appropriate retention period depends on factors including the type and sensitivity of the information, our relationship with you, the purpose for which it is used, legal or contractual requirements and whether the information is needed to establish, exercise or defend legal claims.

Enquiry, consultation and application records may be retained for a reasonable period so we can manage follow-up, understand previous communications, assess future suitability, prevent duplicate records and maintain appropriate business evidence.

Client and delivery records may be kept for longer where required for service support, accounting, tax, contract management, compliance, security or legal reasons.

Specialist Network records may be retained while a specialist remains under consideration or participates in the network and for an appropriate period afterwards for verification, delivery history, quality management, contractual, legal and administrative purposes.

When personal information is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it.

14. Your data protection rights

Depending on the circumstances and the lawful basis being used, UK data protection law may give you rights including:

The right to access your personal information
The right to request correction of inaccurate or incomplete information
The right to request deletion of personal information in certain circumstances
The right to restrict certain processing
The right to object to processing based on particular lawful bases
The right to object to direct marketing at any time
The right to data portability in applicable circumstances
The right to withdraw consent where processing is based on consent
Rights relating to qualifying automated decision-making where applicable
The right to complain to the Information Commissioner’s Office

These rights are not all absolute and may depend on the purpose and lawful basis for the processing.

To make a request, contact us at [email protected]. We may need to verify your identity before responding.

15. Security

We take reasonable and proportionate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, destruction or disclosure.

Measures may include access controls, authentication, password protection, account permissions, secure platforms, appropriate contractual requirements, system monitoring, backups, limited access and internal handling procedures.

Access to client or network information is limited according to role, requirement and the nature of the relevant engagement where reasonably practicable.

No website, email system, CRM, Artificial Intelligence Layer™, third-party platform, cloud service or online transmission can be guaranteed to be completely secure.

16. Client responsibilities

Where XIS designs, configures, supports or coordinates a system for a client, the client remains responsible for the personal information it controls and for ensuring that it has appropriate lawful bases, privacy information, permissions, data quality standards, retention rules and internal policies.

Clients are also responsible for ensuring that instructions given to XIS are lawful and that they are authorised to provide any personal information or system access required for delivery.

Where XIS acts as a processor, the relevant responsibilities, instructions and security requirements may be addressed in the client agreement or a separate data processing agreement.

Any general guidance provided by XIS does not replace independent legal advice or the client’s responsibility to comply with data protection, marketing, employment and sector-specific law.

17. Children’s data

Our current website and services are designed for businesses, professionals and commercial organisations. They are not directed at children, and we do not knowingly collect personal information from children through this website.

If a future XIS operating system or client engagement involves children’s information, appropriate additional privacy information, age-appropriate safeguards and contractual arrangements will be established before that processing begins.

18. Complaints

If you are unhappy with how we have handled your personal information, please contact us first at [email protected] so we can investigate and try to resolve the issue.

You also have the right to complain to the UK Information Commissioner’s Office. Information about making a complaint is available at ico.org.uk/make-a-complaint .

19. Changes to this policy

We may update this Privacy Policy to reflect changes to XIS, our services, systems, suppliers, legal obligations or how we process personal information.

Updates will be published on this page with a revised “last updated” date. Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected individuals where required.