Last Updated: 10th October 2025

1. Introduction

Welcome to EXANTRI Ltd (“we”, “us”, “our”). We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU GDPR, and relevant international privacy standards.

By accessing our services — including our website, digital platforms, digital twin solutions, consulting services, or any associated applications — you agree to the terms of this Privacy Policy.

2. Who We Are

EXANTRI Ltd - We act as the Data Controller for the personal data we collect and process. In some cases, we may also act as a Data Processor when handling data on behalf of our clients.

3. Information We Collect

We may collect and process the following categories of personal data:

a) Information you provide directly:

• Name, job title, and contact details (email, phone number, address) 
• Company or employer details
• Login credentials (where applicable) 
• Payment and billing information 
• Information shared during consultations, surveys, or support requests

b) Information collected automatically:

• Technical data such as IP address, browser type, device identifiers, and operating system
• Usage data including pages visited, time spent on the site, and referring URLs 
• Cookies and similar technologies (see Section 10 below) 

c) Information received from third parties:

• Business partners, service providers, or publicly available sources 
• Information shared by clients when we act as a data processor 

4. How We Use Your Information

We use personal data for the following purposes, always on a lawful basis under data protection law:

• Service delivery: To provide our digital twin, 3D scanning, AR, AI, and consulting services. 
• Contract performance: To fulfil contractual obligations and deliver agreed-upon services. 
• Customer support: To respond to enquiries, support requests, and technical issues. 
• Marketing and communications: To provide relevant updates, newsletters, and promotions (only with your consent or where legitimate interests apply). 
• Compliance and legal obligations: To meet regulatory requirements and respond to lawful requests. 
• Analytics and improvements: To monitor service usage, improve functionality, and enhance user experience.

5. Legal Bases for Processing

We rely on one or more of the following legal bases under UK GDPR and international data protection laws:

• Performance of a contract: When processing is necessary to deliver our services. 
• Legitimate interests: When processing is required for business purposes that do not override your rights (e.g., analytics, product development). 
• Consent: When you have explicitly given consent for specific uses (e.g., marketing communications). 
• Legal obligation: When processing is necessary to comply with legal requirements. 

6. Data Sharing and Disclosure

We only share personal data with:

• Trusted service providers and partners who assist us in delivering our services (subject to strict data processing agreements). 
• Professional advisors (e.g., legal, accounting) where necessary. 
• Regulatory or law enforcement authorities when required by law
• International affiliates or partners — always under legally recognised safeguards. 

We do not sell, rent, or trade your personal information to third parties.

7. International Data Transfers

Where we transfer data outside the UK or the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK ICO or EU Commission 
• Adequacy decisions under UK or EU law 
• Binding Corporate Rules (BCRs) where applicable 

8. Data Retention

We retain personal data only as long as necessary to fulfil the purposes outlined in this policy or as required by law, regulation, or contractual obligations. Once no longer required, data is securely deleted, anonymised, or archived.

9. Your Rights

Under the UK GDPR, EU GDPR, and other applicable privacy laws, you have the following rights:

• Access: Request a copy of your personal data. 
• Rectification: Correct inaccurate or incomplete information. 
• Erasure: Request deletion of your data (“right to be forgotten”). 
• Restriction: Limit how we process your data. 
• Data portability: Receive your data in a structured, machine-readable format. 
• Objection: Object to processing based on legitimate interests or direct marketing. 
• Withdraw consent: Where consent was the legal basis, you may withdraw it at any time.
   

To exercise any of these rights, please contact us directly.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your browsing experience, analyse traffic, and deliver relevant content. You can manage your cookie preferences via your browser settings or our cookie consent tool. For more details, please see our [Cookie Policy].

11. Data Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration, or misuse. This includes encryption, access controls, regular audits, and secure data storage practices aligned with ISO/IEC 27001 and 27701 standards.

12. Third-Party Links

Our website and platforms may contain links to third-party websites. We are not responsible for the privacy practices of these websites and encourage you to review their policies before providing any personal information.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal changes, best practices, or new services. The most recent version will always be available on our website, and significant changes will be communicated to you directly.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we process your data, please contact:

Data Protection Officer
EXANTRI Ltd
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) in the UK or your local data protection authority.

Compliance Statement

This Privacy Policy is designed to comply with:

UK GDPR and the Data Protection Act 2018
EU General Data Protection Regulation (GDPR)
California Consumer Privacy Act (CCPA) – where applicable
International privacy principles, including ISO/IEC 27701