Privacy Policy

You have the right to object to processing based on legitimate interests at any time.

4. Sharing Your Information

We do not sell personal data. We may share information with:

• Service providers who support our operations (e.g. website hosting, email delivery, CRM, analytics providers), under contractual confidentiality and data protection obligations
• Professional advisors (e.g. legal, accounting) where necessary
• Regulators or authorities where required by law
• A successor entity in the event of a merger, acquisition, or sale of business assets

We do not transfer personal data outside the UK/EEA unless appropriate safeguards are in place (e.g. Standard Contractual Clauses or an adequacy decision).

5. Cookies and Tracking

Our Site uses cookies and similar technologies to:

• Enable core site functionality
• Understand aggregate visitor behaviour (analytics)
• Support marketing/retargeting

You can control cookies through your browser settings or via our cookie consent banner. Disabling non-essential cookies will not affect your ability to browse the Site, but may limit certain features.

[Insert a cookie table here listing specific cookies, providers, purpose, and duration once your cookie audit is complete.]

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, including:

• For the duration of any ongoing engagement or relationship, plus a reasonable period afterward for record-keeping
• As required to comply with legal, accounting, or reporting obligations
• Marketing contact data is retained until you unsubscribe or object, and periodically reviewed for relevance

7. Your Rights (UK/EEA Visitors)

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data (subject to legal exceptions)
• Object to or restrict certain processing
• Request data portability
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk

To exercise any of these rights, contact us at enquiry@exorisk.global

7A. US Visitors — State Privacy Rights

As we market our services to businesses in the United States, this section addresses rights available to individuals under applicable US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and comparable laws in states such as Virginia, Colorado, Connecticut, and Utah.

Scope note: Many US state privacy laws provide narrower protections (or exemptions) for personal data collected in a business-to-business context — for example, data about an individual acting in their role as an employee, owner, director, officer, or contractor of a company we deal with. Where such exemptions apply, this section may not confer additional rights beyond those described elsewhere in this policy. We include it to be transparent about our practices regardless.

Categories of personal information we collect, per the categories defined under CCPA/CPRA, may include: identifiers (name, email, phone, IP address); commercial information (services enquired about); internet or network activity (Site usage data); and professional or employment-related information (job title, company).

We do not sell or share personal information (as those terms are defined under CCPA/CPRA) for cross-context behavioural advertising, and we have not done so in the preceding 12 months.

Your rights, subject to applicable exemptions, may include the right to:

• Know what personal information we have collected and how it is used
• Request deletion of personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information, or of targeted advertising
• Not be discriminated against for exercising these rights

To make a request, contact us at enquiry@exorisk.global. We will verify your request using reasonable means before responding, and you may designate an authorised agent to act on your behalf where permitted by law.

We do not knowingly collect personal information from California residents under 16 for purposes of sale or sharing.

7B. Email Marketing (CAN-SPAM)

For marketing emails sent to recipients in the United States, we comply with the CAN-SPAM Act. This means we will:

• Not use false or misleading header information or deceptive subject lines
• Identify the message as an advertisement where required
• Include our valid physical postal address in marketing emails
• Provide a clear and conspicuous way to opt out of future emails, and honour opt-out requests promptly
• Not sell or transfer your email address to third parties after receiving an opt-out request

You can unsubscribe from marketing emails at any time using the link provided in the email, or by contacting us at enquiry@exorisk.global

8. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. No system is completely secure, and we cannot guarantee absolute security of information transmitted to us.

9. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review their privacy policies independently.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page indicates when it was last revised. Material changes will be communicated where appropriate.

11. Contact Us

If you have questions about this Privacy Policy or how we handle your personal data, please contact:

ExoRisk Limited, 167 – 169, Great Portland Street, 5th Floor, London, United Kingdom, W1W 5PF, enquiry@exorisk.global