Legal
Contents
01
WXS Partners is a management consulting practice specialising in workplace strategy, portfolio optimisation, and hybrid work governance for enterprise clients. We operate this website at wxspartners.com (the "Site").
For the purposes of the UK GDPR and EU GDPR, WXS Partners is the data controller responsible for your personal data collected through this Site. Our registered contact address and data controller details are set out in Section 10.
GDPR scope
This policy applies to all personal data processed in connection with this website, whether you are based in the UK, the European Economic Area (EEA), or elsewhere. We are committed to meeting the standards of the UK GDPR and EU GDPR in all cases.
02
We collect only the data that is necessary for the purposes described below. We do not sell personal data, and we do not use it for purposes other than those stated here.
| Data | How collected | Purpose |
|---|---|---|
| Name, email address, company name, message content | Contact form on the Site, processed via Static Forms | To respond to your enquiry and, where relevant, to pursue a potential business relationship |
| IP address, browser type, device type, pages visited, time on site, referral source | Google Analytics 4 (GA4), automatically on site visit — only after consent is given | To understand how visitors use the Site and to improve its content and performance |
| Cookie identifiers | Automatically placed in your browser by GA4, only after consent is given | To enable analytics measurement across sessions. See Section 8 for full cookie details. |
We do not knowingly collect data from children under the age of 16. If you believe we have inadvertently done so, please contact us immediately using the details in Section 10.
03
Under the GDPR, we must have a lawful basis for processing your personal data. We rely on the following:
| Processing activity | Lawful basis |
|---|---|
| Responding to contact form enquiries | Legitimate interests (Article 6(1)(f)) — it is in our mutual interest to respond to business enquiries submitted voluntarily through this Site. |
| Analytics via Google Analytics 4 | Consent (Article 6(1)(a)) — we obtain your consent via our cookie banner before any GA4 tracking is activated. You may withdraw consent at any time via Cookie settings in the footer. |
| Retaining records of correspondence | Legitimate interests (Article 6(1)(f)) — maintaining records of business communications is a standard and proportionate practice for a professional services firm. |
Legitimate interests balancing
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You have the right to object to any processing carried out on this basis — see Section 7.
04
| Data | Retention period |
|---|---|
| Contact form enquiries (email correspondence) | Up to 3 years from the date of last contact, or as long as reasonably required to manage the business relationship |
| Analytics data (GA4) | 14 months by default, as configured in Google Analytics. |
| Cookie consent records (wxs_cookie_consent) | 12 months, in line with consent validity periods under GDPR guidance |
At the end of the applicable retention period, personal data is deleted or irreversibly anonymised. We review retention periods periodically to ensure they remain proportionate.
05
We do not sell or rent your personal data to third parties. We share data only with the service providers listed below, each engaged under a data processing agreement (DPA) that requires them to protect your data to GDPR standards.
| Recipient | Role | Data shared | Location |
|---|---|---|---|
| Static Forms | Contact form processor | Name, email address, company name, and message content submitted via the contact form | European Union — GDPR compliant |
| Infomaniak Network SA | Website hosting and email provider | Email correspondence from contact form submissions; website traffic logs | Switzerland (Geneva) — subject to an adequacy decision recognised under UK GDPR and EU GDPR |
| Google LLC (Google Analytics 4) | Website analytics processor | Anonymised/pseudonymised usage data; cookie identifiers — only after consent is given | USA — transferred under Standard Contractual Clauses (SCCs). See Section 6. |
We may also disclose personal data where required to do so by law, court order, or competent regulatory authority.
Note on Infomaniak
Infomaniak is headquartered in Geneva, Switzerland. Switzerland benefits from an adequacy decision from both the European Commission and the UK Secretary of State, meaning data transferred there is treated as offering an equivalent level of protection to the GDPR.
06
Where personal data is transferred outside the UK or EEA, we ensure that appropriate safeguards are in place:
Switzerland (Infomaniak): covered by adequacy decisions under both UK GDPR and EU GDPR. No further safeguards are required.
United States (Google Analytics 4): Google LLC participates in the EU-US Data Privacy Framework and has executed Standard Contractual Clauses (SCCs) for data transfers. Google also offers IP anonymisation in GA4, which we have enabled, meaning full IP addresses are not stored or transferred. For further information, see Google's Privacy Policy.
07
Under the UK GDPR and EU GDPR, you have the following rights in relation to your personal data:
Right of access
Request a copy of the personal data we hold about you.
Right to rectification
Ask us to correct inaccurate or incomplete data.
Right to erasure
Request deletion of your data where there is no compelling reason for us to continue holding it.
Right to restrict processing
Ask us to limit how we use your data in certain circumstances.
Right to data portability
Receive your data in a structured, machine-readable format where technically feasible.
Right to object
Object to processing based on legitimate interests. We must stop unless we can demonstrate compelling grounds.
Right to withdraw consent
Where processing is based on consent (e.g. analytics cookies), you may withdraw at any time via Cookie settings in the footer.
Right not to be profiled
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
To exercise any of these rights, contact us using the details in Section 10. We will respond within one calendar month. We may need to verify your identity before fulfilling a request.
08
We use cookies on this Site. Cookies are small text files placed on your device that allow us to recognise your browser across visits. No analytics cookies are set until you have given consent via the cookie banner that appears on your first visit.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| _ga | Analytics (GA4) | Distinguishes unique users for traffic analysis | 2 years |
| _ga_K6TH8ZV69N | Analytics (GA4) | Persists session state for Google Analytics | 2 years |
| wxs_cookie_consent | Functional (strictly necessary) | Remembers your cookie consent choice so the banner does not reappear on subsequent visits | 12 months |
You may change or withdraw your consent at any time by clicking Cookie settings in the footer of any page on this Site, or by adjusting your browser settings to block or delete cookies.
We have configured GA4 with IP anonymisation enabled, meaning Google receives only a truncated form of your IP address and cannot reconstruct your full address from what is stored.
We do not use cookies for advertising, remarketing, or any purpose beyond the analytics use described above.
09
We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
Continued use of this Site following a material change constitutes your acknowledgement of the updated policy. Where changes require your renewed consent, we will ask for it explicitly.
10
If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your data, please contact us:
Response time
We aim to respond to all privacy requests within one calendar month of receipt, as required by GDPR Article 12.
If you are not satisfied with our response, or believe we are processing your data unlawfully, you have the right to lodge a complaint with a supervisory authority:
UK: Information Commissioner's Office (ICO) — ico.org.uk — 0303 123 1113
EU: The supervisory authority in your country of residence or where the alleged infringement took place. A list is available at edpb.europa.eu.