1. Who This Notice Is For

1.1 This notice applies to visitors to chexperts.co.uk and people who contact us through the website. This includes people who request information, book a demonstration or enquire about working with Chexperts. It also explains how we use cookies and similar storage or access technologies.

1.2 Business-contact, account, billing and Platform-user data relating to organisations that use our services is covered by our Privacy Notice (Clients). Personal data used to carry out a BPSS Background Check is covered by the Candidate Privacy Notice made available during the Candidate process.

1.3 We do not sell personal data. Non-exempt cookies and similar technologies are not used until the required choice has been made. You can reopen Cookie Settings at any time.

​

2. Who We Are and How to Contact Us

2.1 Chexperts Ltd ("Chexperts", "we", "us" or "our") is a company registered in England and Wales under company number 15617945. We are the Controller of the personal data described in this notice. Our ICO registration number is ZB722879.

2.2 Our registered office is Martinique House, Camp Road, Bordon, GU35 0HJ.

2.3 For privacy and data-protection enquiries, contact dpo@chexperts.co.uk. For general enquiries, contact hello@chexperts.co.uk or telephone 0203 307 4380. Our website is chexperts.co.uk.

​

3. Personal Data We Collect and Where It Comes From

3.1 We may collect and use the following categories of personal data:

(a) Information you provide. This may include your name, organisation, job title, work or personal contact details, the content of enquiries, demo requests, messages, preferences and files you choose to send. This information normally comes from you, your organisation or another person who refers or introduces you.

(b) Technical and usage data. This may include your IP address, browser and device information, pages viewed, referral source, approximate location, security events, timestamps and similar log data. This information comes from our website, hosting, security and permitted analytics technologies.

(c) Business-development data. This may include professional interests, marketing preferences and records of our communications and engagement with you. It may come from you, our communications, your organisation and public professional sources.

(d) Cookie and preference data. This may include cookie identifiers, consent or objection choices, permitted usage statistics and functionality preferences. It is collected through cookies, local storage and similar technologies described in clause 5.

3.2 Where a field is marked as required, we need that information to respond to the request or provide the relevant service. If you do not provide it, we may be unable to respond or progress the enquiry.

​

4. How and Why We Use Personal Data

4.1 We use personal data for the following purposes and lawful bases:

(a) Enquiries and demonstrations. We respond to requests, provide information and take steps towards a possible contract. We rely on steps before entering a contract where applicable and otherwise on our legitimate interests in responding and developing our business.

(b) Business relationships. We understand interest in our services, maintain professional relationships and follow up relevant conversations. We rely on our legitimate interests in operating and growing a business-to-business service.

(c) Website operation and security. We deliver the website, troubleshoot problems, detect misuse, protect systems and keep appropriate security records. We rely on our legitimate interests in providing a secure and reliable website and on legal obligation where applicable.

(d) Analytics and improvement. We understand how the website is used and improve content, performance and user journeys. We rely on consent where required for the technology and otherwise on legitimate interests where a lawful storage-and-access exception applies and an easy objection is available.

(e) Business-to-business marketing. We send relevant information about Chexperts services, events and developments where permitted. We rely on legitimate interests or consent, depending on the recipient and communication. You may object or opt out at any time.

(f) Legal and regulatory matters. We comply with law, respond to regulators or authorities, prevent fraud and establish, exercise or defend legal claims. We rely on legal obligation and legitimate interests.

4.2 Where we rely on legitimate interests, those interests include operating and protecting our website and business, responding to enquiries, developing professional relationships, improving our services, preventing fraud and misuse, and protecting legal rights. We balance those interests against your rights and reasonable expectations.

​

5. Cookies and Similar Technologies

5.1 What these technologies are. A cookie is a small file stored on or accessed from your device. Similar technologies include local storage, pixels, tags, software development kits and device identifiers. In this notice, we refer to all of them as "technologies". The rules apply whether or not the information is personal data.

5.2 Your choices. Your choices are as follows:

(a) Strictly necessary and exempt technologies. Technologies that are strictly necessary to provide a service you request, or that fall within another applicable legal exception, may be used without consent.

(b) Optional technologies. Other technologies are not used until you have made the required positive choice. Continuing to browse, silence or a pre-ticked box is not treated as consent.

(c) Statistical or appearance and functionality exceptions. Where we rely on a statistical-purpose or appearance-and-functionality exception, we provide clear information and a simple, free way to object.

(d) Changing your choice. You can reopen Cookie Settings at any time to change or withdraw a choice. Withdrawal applies to future use and does not make earlier lawful use unlawful.

(e) Effect of rejecting optional technologies. Rejecting optional technologies does not prevent you from using the core website, although some optional features may not work.

5.3 Categories and legal position. The main categories of technologies and their legal position are:

(a) Communication technologies. These are used solely to transmit a communication over an electronic communications network. Consent is not required where the communication exception applies.

(b) Strictly necessary technologies. These are essential to provide a service or feature you request, including core security, fraud prevention, authentication and session functions. Consent is not required where the strictly necessary exception applies.

(c) Statistical-purpose technologies. These are used solely to collect statistical information about how the website or service is used, with a view to improving it. Consent may not be required if all conditions are met, the information is suitably aggregated and you have a simple, free way to object. Otherwise, consent is required.

(d) Appearance or functionality technologies. These are used solely to adapt or enhance how the service appears or functions in line with your preferences. Consent may not be required if all conditions are met and you have a simple, free way to object. Otherwise, consent is required.

(e) Advertising, cross-site tracking and social tracking. These are used for profiling, re-targeting, advertising, social tracking or related measurement. Consent is required before use.

(f) Other optional technologies. These include analytics, embeds or functions that do not fit an exception. Consent is required before use.

5.4 Current essential website technologies. At the date of this notice, the following first-party Wix technologies are commonly used for security, resilience and core site functionality. The live Cookie Settings panel provides the current implementation-level list, including any optional technology that is enabled:

(a) XSRF-TOKEN. Provided by Wix.com Ltd for fraud detection and protection of requests. It is essential and normally lasts for the session.

(b) hs. Provided by Wix.com Ltd for legacy Hive security. It is essential and normally lasts for the session.

(c) svSession. Provided by Wix.com Ltd for security, stability and core site functions. It is essential and normally lasts for 12 months.

(d) SSR-caching. Provided by Wix.com Ltd for rendering and performance. It is essential and normally lasts for 24 hours.

(e) TS*. Provided by Wix.com Ltd for attack detection and security. It is essential and normally lasts for the session.

(f) bSession. Provided by Wix.com Ltd for system effectiveness and operation. It is essential and normally lasts for 24 hours.

(g) fedops.logger.sessionId. Provided by Wix.com Ltd for session error and resilience logging. It is essential and normally lasts for 12 months.

(h) Consent preference. Provided by Wix or the relevant consent-management provider to store your cookie consent and objection choices. It is essential and its duration is shown in Cookie Settings.

5.5 Optional and third-party technologies. Optional technologies may be introduced by analytics tools, embedded videos, maps, social-media features, advertising platforms, third-party Wix applications or custom code. The live Cookie Settings panel identifies the current provider, purpose, category and duration and allows you to control them. Where a third party acts as an independent Controller, it may also process information under its own privacy notice.

We do not treat a technology as lawful merely because it is described in this notice. The required technical blocking, consent or objection control must also be in place.

5.6 Browser and device controls. Most browsers allow you to delete or block cookies and manage site permissions. Blocking all cookies may prevent parts of the website from working correctly. Browser settings do not replace the website controls where consent or an objection mechanism is required.

 

6. Who Receives Personal Data

6.1 We may share personal data with the following recipients where necessary and lawful:

(a) Service providers. Website hosting, content-delivery, communications, analytics, consent-management, security and IT-support providers acting for us.

(b) Professional advisers. Lawyers, accountants, auditors and insurers.

(c) Authorities. Regulators, courts, law-enforcement bodies and public authorities where disclosure is required or permitted by law.

(d) Corporate transaction recipients. A prospective purchaser, investor or successor in connection with a corporate transaction, subject to appropriate confidentiality protections.

(e) People involved at your request. Your organisation or another person you ask us to involve in the enquiry.

6.2 We do not sell personal data.

 

7. International Transfers

7.1 Some service providers may process personal data outside the United Kingdom. Where a restricted transfer is made, we use an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the European Commission Standard Contractual Clauses, another legally recognised safeguard, or a permitted exception where applicable.

 

8. How Long We Keep Information

8.1 We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, security and reporting requirements and to establish, exercise or defend legal claims.

8.2 Our normal retention periods are:

(a) General enquiries and demo requests. Normally up to 24 months after the last meaningful contact, unless the matter becomes part of a contract, complaint or legal claim.

(b) Prospect and business-development records. Normally up to 24 months after the last meaningful contact, or earlier if no longer relevant. A minimal suppression record may be retained to respect an opt-out.

(c) Recruitment enquiries and applications. Normally up to 6 months after the relevant recruitment exercise, unless a longer period is agreed for future opportunities or required for a legal matter.

(d) Server, security and technical logs. Normally up to 12 months, unless a longer period is reasonably required to investigate an incident or protect legal rights.

(e) Cookie and preference records. For the duration shown in Cookie Settings or in clause 5.4. Consent and objection records may be retained for a reasonable period to demonstrate and respect your choices.

(f) Contracts, payments and tax records. Where a website enquiry becomes a customer or supplier relationship, relevant records are retained under the Business Privacy Notice, normally for up to 7 years after the relevant financial year or relationship.

(g) Complaints and legal claims. For as long as reasonably necessary to investigate, resolve and protect legal rights.

8.3 We may keep information for longer where required by law, a regulator, an active dispute, a security investigation or a legal hold. We may delete or anonymise it earlier when it is no longer needed.

 

9. Security

9.1 We use technical and organisational measures appropriate to the nature and sensitivity of the information, including access controls, encryption where appropriate, security monitoring, supplier controls, staff confidentiality and training, and measures aligned to our Cyber Essentials Plus certification. No system can be guaranteed completely secure, but we review and improve our controls over time.

 

10. Your Rights

10.1 Subject to legal conditions and exemptions, you may have the following rights:

(a) Access. To ask for a copy of the personal data we hold about you.

(b) Correction. To ask us to correct inaccurate or incomplete personal data.

(c) Erasure or restriction. To ask us to erase personal data or restrict how it is used in certain circumstances.

(d) Objection. To object to Processing based on legitimate interests and to object at any time to direct marketing.

(e) Portability. To receive certain personal data in a portable format where the right applies.

(f) Withdrawal of consent. To withdraw consent where we rely on consent, without affecting earlier lawful Processing.

10.2 To exercise a right, contact dpo@chexperts.co.uk. We may need to verify your identity and may ask for information needed to locate the relevant records.

 

11. Marketing Choices

11.1 You can opt out of marketing at any time by using the unsubscribe link in a message or contacting us. Service and security messages are not marketing and may still be sent where necessary.

 

12. Automated Decision-Making

12.1 We do not use website-visitor data to make decisions based solely on automated Processing that produce legal or similarly significant effects. We may use automated security, spam and fraud-detection tools to protect the website and communications.

 

13. Data-Protection Complaints

13.1 You can make a data-protection complaint by emailing dpo@chexperts.co.uk or writing to our registered office. Please describe what happened, the information concerned and the outcome you are seeking.

13.2 We will acknowledge a data-protection complaint within 30 days. We will take appropriate steps to investigate it, keep you informed where appropriate and tell you the outcome without undue delay.

13.3 You may also complain to the Information Commissioner's Office (ICO): ico.org.uk; telephone 0303 123 1113; or write to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We encourage you to contact us first so the issue can be investigated promptly.

 

14. Changes to This Notice

14.1 We may update this notice when our website, technologies, Processing activities or the law changes. The version and date at the beginning identify the current notice. We will bring material changes to attention where appropriate before they take effect.

 

15. Contact

15.1 Chexperts Ltd, company number 15617945, Martinique House, Camp Road, Bordon, GU35 0HJ.

15.2 Privacy and data-protection enquiries: dpo@chexperts.co.uk. General enquiries: hello@chexperts.co.uk. Telephone: 0203 307 4380. Website: chexperts.co.uk. ICO registration: ZB722879.