// Legal

Privacy Policy

Last updated: 16 September 2026

Xponentshift Limited ("XponentShift", "we", "us" or "our") is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, and the rights you have over it under the EU General Data Protection Regulation (GDPR) and Irish data protection law.

1. Who We Are

Xponentshift Limited is a software development and digital transformation company registered in Ireland, with its registered office at 1 McElwain Terrace, Newbridge, Co. Kildare. We are the data controller for the personal data described in this policy.

2. Information We Collect

We collect personal data in the following ways:

  • Information you provide directly through forms — such as your name, email address, phone number and company details when you fill in a contact or grant-enquiry form, request a proposal, or message our AI chatbot. This information is never shared with external parties.
  • Chatbot conversations — messages you send to our AI assistant are logged, together with a session identifier, so we can respond to your enquiry and improve the service.
  • Automatically collected data — technical information such as IP address, browser type, device information, pages visited and referring URLs, collected via cookies and similar technologies (see our Cookie Policy for details). We use this information to keep our website secure, diagnose technical issues and understand overall site performance. It is stored by XponentShift and our hosting and analytics providers in server and access logs for a limited period, and is not used to identify you individually.
  • Analytics data — anonymised or pseudonymised usage data (page views, click events, scroll depth and session recordings with form inputs masked) collected only where you have consented to analytics cookies. This data is collected and stored by our analytics provider, PostHog (hosted in the EU), which processes it on our behalf under a data processing agreement and in compliance with GDPR.

3. How We Use Your Information

The information you provide helps us create well-researched proposals and solutions for your enquiries, so we can serve you better. We use the personal data we collect to:

  • Respond to enquiries and provide quotes or proposals for our services;
  • Operate and improve our website, chatbot and grant-matching tools;
  • Communicate with you about your enquiry, project or grant application;
  • Analyse how visitors use our website and the traffic on it, to identify ways to improve it;
  • Meet our legal, accounting and regulatory obligations.

4. Legal Basis for Processing

Under GDPR, we rely on the following legal bases to process your personal data:

  • Contract (GDPR Art. 6(1)(b)) — to take steps at your request before entering into, or to perform, a contract with you, such as preparing a proposal or delivering agreed services;
  • Consent (GDPR Art. 6(1)(a)) — for optional analytics and tracking cookies, which you can withdraw at any time via our cookie preferences;
  • Legitimate interests (GDPR Art. 6(1)(f)) — to respond to enquiries, maintain site security, prevent fraud and improve our services, balanced against your rights and interests;
  • Legal obligation (GDPR Art. 6(1)(c)) — where we must retain records to meet our tax, accounting or other regulatory obligations under Irish and EU law.

5. Cookies & Tracking Technologies

We use strictly necessary cookies to run the site, and optional analytics cookies to understand how it is used. Analytics cookies are only stored once you accept them via our cookie banner. See our Cookie Policy for the full list of cookies and how to manage your preferences at any time.

6. Data Sharing & Third Parties

We do not sell your personal data to any third parties. Information you submit through our contact and enquiry forms is used only by Xponentshift Limited to respond to you — it is not accessed by, or shared with, any third-party marketing or advertising tools. The only data accessible to, and stored by, a third party in the ordinary course is the anonymised or pseudonymised analytics data described in Section 2, which our analytics provider processes on our behalf. We otherwise share data only with trusted service providers who process it on our behalf, including:

  • Cloud hosting and infrastructure providers;
  • Our database provider, for securely storing enquiry, lead and chatbot data;
  • Analytics providers, for anonymised or pseudonymised usage statistics;
  • Email and communication tools, to respond to your enquiries.

These providers are contractually required to protect your data and only process it for the purposes we specify. We may also disclose data where required by law or to protect our legal rights.

7. Data Retention

We retain personal data only for as long as necessary, and no longer than:

  • Chatbot and enquiry data — for as long as needed to manage the relevant business relationship, after which it is deleted or anonymised;
  • Analytics data — a maximum of 7 years, in line with our analytics provider PostHog's own data retention policy;
  • Tax, accounting and financial records — approximately 7 years, as required under Irish financial and tax regulations.

You can ask us to delete your data at any time by contacting us at info@xponentshift.com — see Section 9 (Your Rights) below for details. We respond to deletion requests within 30 days.

8. Data Security

We use appropriate technical and organisational measures — including encrypted transport, access controls and secure hosting — to protect your personal data against unauthorised access, loss or misuse. No method of transmission or storage is completely secure, but we work to continuously improve our safeguards.

9. Your Rights

Under GDPR, you have the right to:

  • Access the personal data we hold about you;
  • Request correction of inaccurate or incomplete data;
  • Request erasure of your data ("right to be forgotten");
  • Restrict or object to certain processing;
  • Request a copy of your data in a portable format;
  • Withdraw consent at any time, where processing is based on consent;
  • Lodge a complaint with the Irish Data Protection Commission (DPC) at dataprotection.ie.

To exercise any of these rights, contact us at info@xponentshift.com.

10. International Data Transfers

Some of our service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or reliance on an adequacy decision.

11. Children's Privacy

Our website and services are directed at businesses and are not intended for individuals under 16. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when it was last revised.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us at: