// Legal

Privacy Policy

Last updated: 16 September 2026

Xponentshift Limited ("XponentShift", "we", "us" or "our") is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, and the rights you have over it under the EU General Data Protection Regulation (GDPR) and Irish data protection law.

1. Who We Are

Xponentshift Limited is a software development and digital transformation company registered in Ireland, with its registered office at 1 McElwain Terrace, Newbridge, Co. Kildare. We are the data controller for the personal data described in this policy.

2. Information We Collect

We collect personal data in the following ways:

  • Information you provide directly — such as your name, email address, phone number and company details when you fill in a contact or grant-enquiry form, request a proposal, or message our AI chatbot.
  • Chatbot conversations — messages you send to our AI assistant are logged, together with a session identifier, so we can respond to your enquiry and improve the service.
  • Automatically collected data — technical information such as IP address, browser type, device information, pages visited and referring URLs, collected via cookies and similar technologies (see our Cookie Policy for details).
  • Analytics data — anonymised or pseudonymised usage data (page views, click events, scroll depth and session recordings with form inputs masked) collected only where you have consented to analytics cookies.

3. How We Use Your Information

We use the personal data we collect to:

  • Respond to enquiries and provide quotes or proposals for our services;
  • Operate and improve our website, chatbot and grant-matching tools;
  • Communicate with you about your enquiry, project or grant application;
  • Understand how visitors use our website so we can improve it;
  • Meet our legal, accounting and regulatory obligations.

4. Legal Basis for Processing

Under GDPR, we rely on the following legal bases to process your personal data:

  • Contract — to take steps at your request before entering into, or to perform, a contract with you;
  • Consent — for optional analytics and tracking cookies, which you can withdraw at any time;
  • Legitimate interests — to respond to enquiries, maintain site security and improve our services;
  • Legal obligation — where we must retain records for tax, accounting or regulatory purposes.

5. Cookies & Tracking Technologies

We use strictly necessary cookies to run the site, and optional analytics cookies to understand how it is used. Analytics cookies are only set once you accept them via our cookie banner. See our Cookie Policy for the full list of cookies and how to manage your preferences at any time.

6. Data Sharing & Third Parties

We do not sell your personal data. We share it only with trusted service providers who process it on our behalf, including:

  • Cloud hosting and infrastructure providers;
  • Our database provider, for securely storing enquiry, lead and chatbot data;
  • Analytics providers, for anonymised or pseudonymised usage statistics;
  • Email and communication tools, to respond to your enquiries.

These providers are contractually required to protect your data and only process it for the purposes we specify. We may also disclose data where required by law or to protect our legal rights.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law (for example, tax and accounting records). Chatbot and enquiry data is retained for as long as needed to manage the relevant business relationship, after which it is deleted or anonymised.

8. Data Security

We use appropriate technical and organisational measures — including encrypted transport, access controls and secure hosting — to protect your personal data against unauthorised access, loss or misuse. No method of transmission or storage is completely secure, but we work to continuously improve our safeguards.

9. Your Rights

Under GDPR, you have the right to:

  • Access the personal data we hold about you;
  • Request correction of inaccurate or incomplete data;
  • Request erasure of your data ("right to be forgotten");
  • Restrict or object to certain processing;
  • Request a copy of your data in a portable format;
  • Withdraw consent at any time, where processing is based on consent;
  • Lodge a complaint with the Irish Data Protection Commission (DPC) at dataprotection.ie.

To exercise any of these rights, contact us at info@xponentshift.com.

10. International Data Transfers

Some of our service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or reliance on an adequacy decision.

11. Children's Privacy

Our website and services are directed at businesses and are not intended for individuals under 16. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when it was last revised.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us at: