WEBSITE PRIVACY POLICY

Last updated: 11 September 2026

This Website Privacy Policy (the “Policy”) explains how INXYTECH LTD, registration number HE 447934, with registered office at Agias Zonis, 12, Agias Zonis Court, Flat/Office 401, 3027, Limassol, Cyprus (“INXY”, “we”, “us” or “our”), processes personal data in connection with the public website available at https://www.inxy.io/ (the “Website”). For the processing described in this Policy, INXYTECH LTD acts as the data controller unless stated otherwise.

1. Scope of this Policy

This Policy applies to personal data processed when you browse the Website, use public contact or demo-request forms, interact with Website communication tools, apply for a role through the Website, subscribe to communications where available, or otherwise communicate with us in connection with the Website.

This Policy does not describe personal data processing carried out in connection with services or other product-specific activities. Those activities are governed by the relevant product, provider, contractual and privacy documentation.

2. Personal data we collect

Depending on how you use the Website, we may collect the following categories of personal data:

   1. Technical and usage data: IP address, browser type and version, device type, operating system, language, approximate location derived from IP address, referring page, pages viewed, timestamps, session information, interaction data, diagnostic data and security logs.

  2. Contact and enquiry data: name, email address, phone number, company or organisation, job title and any information you include in a message, demo request, partnership request or other communication.

  3.Recruitment data: name, contact details, LinkedIn profile, CV/resume, employment and education history, information provided in an application and related correspondence.

  4.Marketing preferences: subscription choices, communication preferences and records of consent or opt-out, where marketing communications are offered.

  5.Cookie and similar-technology data: identifiers and information collected by cookies, local storage, pixels and comparable technologies as described in Section 10.

You are not required to provide personal data merely to read public Website content, other than technical data that is generated automatically when your device communicates with the Website. Where a form marks information as required, we may be unable to respond to or process the relevant request if you do not provide that information.

3. How we collect personal data

Directly from you when you submit a form, contact us, apply for a role, request a demo, communicate with us or make a privacy request.

Automatically from your browser or device through server logs, cookies and similar technologies when you visit or interact with the Website.

From service providers supporting Website hosting, analytics, communications, security, recruitment or form processing, to the extent necessary for those services.

From publicly available professional or business sources where reasonably relevant to a business enquiry or recruitment process and permitted by applicable law.

4. Purposes and legal bases

You may use the Website for lawful purposes, including reviewing information about INXY and assessing whether products or services may be relevant to your business.

Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and whether your interests or fundamental rights override our interests. Where processing is based on consent, you may withdraw that consent at any time without affecting processing carried out before withdrawal.

5. Marketing communications

If you ask to receive updates or marketing communications, or where applicable law otherwise permits us to send business marketing, we may use your contact details to provide information about INXY, its products, events or content. You can unsubscribe at any time using the unsubscribe mechanism in the communication or by contacting us. We may retain a minimal suppression record to ensure that your opt-out is respected.

6. Recipients and service providers

We may disclose personal data where reasonably necessary to the following categories of recipients:

  1. Website hosting, infrastructure, security, content-delivery and technical service provider;

  2.Analytics and user-experience providers, including Google Analytics, Plausible Analytics, Umami, where those tools are enabled and subject to the consent requirements described in Section 10;

  3.Providers of contact forms, CRM, email, communications, customer-support or scheduling tools;

  4.Recruitment and applicant-management providers where you apply for a role;

  5.Our personnel and group companies on a need-to-know basis;

  6.Professional advisers such as lawyers, auditors and consultants;

 7. Public authorities, regulators, courts or law-enforcement bodies where disclosure is required or permitted by law;

 8. A buyer, investor or successor in connection with a corporate transaction, subject to appropriate safeguards.

Service providers processing personal data on our behalf are required to process it only for authorised purposes and to apply appropriate confidentiality and security measures.

7. International transfers

Some service providers or their group companies may process personal data outside the European Economic Area (“EEA”). Where personal data is transferred to a country that is not subject to an applicable European Commission adequacy decision, we use an appropriate transfer mechanism where required, such as the European Commission Standard Contractual Clauses, together with supplementary measures where appropriate. You may contact us for further information about the safeguards relevant to your personal data.

8. Retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, taking into account legal, contractual, security and dispute-resolution requirements. In particular:

  1.Website security and technical logs are retained for a limited period appropriate to security, troubleshooting and abuse-prevention needs, unless a longer period is required for investigation or legal purposes.

  2. Contact, demo and partnership enquiries are retained for as long as necessary to handle the enquiry and for a reasonable period afterwards to maintain business records and manage follow-up or potential claims.

  3. Marketing data is processed until you opt out, withdraw consent where consent is the basis, or the data is otherwise no longer required; a minimal suppression record may be retained thereafter.

  4. Recruitment data is retained for the duration of the relevant recruitment process and for a limited period afterwards as reasonably necessary for legal or administrative purposes, or longer where you have agreed to consideration for future roles.

  5.Cookie and similar-technology data is retained for the periods described in Section 10 or until you delete it or withdraw consent, where applicable.

9. Your data protection rights

Subject to the conditions and limitations in applicable law, you may have the right to:

1.Request access to your personal data and obtain a copy;

2.Request correction of inaccurate or incomplete personal data;

3. Request deletion of your personal data;

4.Request restriction of processing;

5.Object to processing based on legitimate interests, including an absolute right to object to direct marketing;

6.Receive personal data you provided to us in a structured, commonly used and machine-readable format and, where applicable, transmit it to another controller;

7.Withdraw consent at any time where processing is based on consent; and

8.Lodge a complaint with a competent supervisory authority.

For INXYTECH LTD, the lead supervisory authority is the Office of the Commissioner for Personal Data Protection in Cyprus. You may also have the right to complain to the supervisory authority in the EU/EEA country of your habitual residence, place of work or the place of an alleged infringement.

10. Cookies and similar technologies

10.1 What cookies are

Cookies are small text files or similar identifiers stored on or accessed from your device when you visit a website. We may also use local storage, pixels or comparable technologies. These technologies can be used to remember preferences, operate Website functionality, protect security, measure Website performance and understand how visitors interact with Website content.

We also use measurement tools that do not store or read any information on your device. These are described in Section 10.4 below.

10.2 How we manage consent

The Website uses **Consent Pro** as its consent management platform. Consent Pro is loaded through Google Tag Manager before any measurement or marketing tag and sets all consent signals to "denied" by default.

Tags that rely on cookies or similar technologies, including Google Analytics 4, are configured to fire only after you have given the corresponding consent. Until you accept analytics cookies, Google Analytics does not run, no Google Analytics cookies are set and no Google Analytics data is transmitted. We do not use Google's advanced consent mode and therefore do not send cookieless pings to Google before consent.

We apply this opt-in consent framework globally, regardless of the country from which you access the Website.

10.3 Cookie categories

Strictly necessary technologies are used to provide Website functionality, maintain security, remember language and privacy choices, or perform functions specifically requested by you. Analytics and performance cookies, currently limited to Google Analytics 4, are used only after you have given consent through the Website’s cookie banner or settings.

‍
We do not use advertising, retargeting or cross-site profiling technologies on the Website. If such technologies are introduced, they will be subject to applicable consent and transparency requirements before activation. Rejecting optional cookies will not prevent you from accessing the public Website, although some non-essential functionality or personalisation may be unavailable.

10.4 Analytics that do not use cookies

In addition to Google Analytics 4, we use Plausible Analytics and Umami to measure Website performance. These services are configured without cookies or browser storage and are not used for cross-site tracking. They provide statistics such as page views, referral sources, approximate country, device type and browser.

‍
Umami generates a session hash from technical information, including the visitor’s IP address, user agent and website identifier, to distinguish sessions without using cookies. We do not use Umami distinct identifiers to identify logged-in users or combine activity across devices.
‍

Plausible Analytics processes analytics data within the European Union. Umami is used on infrastructure located in the European Union or the United States, subject to the transfer safeguards described in Section 7.

‍
Because these tools do not store or access information on your device, their use does not require consent under Article 5(3) of the ePrivacy Directive and applicable national implementing laws. The processing of analytics information remains subject to the GDPR and is based on our legitimate interests (Article 6(1)(f) GDPR) in understanding Website use, diagnosing issues and improving content. You may object to this processing as described in Section 9.

10.5 Cookies and similar technologies used on the Website

Plausible Analytics and Umami do not set cookies and do not store identifiers in your browser's local or session storage, and are therefore not listed in the table above.

‍10.6 Managing your choices

You can accept or reject optional cookies through the Website's cookie banner or settings. You may withdraw your consent at any time by reopening those settings and changing your selection. You can also configure your browser to block or delete cookies; however, browser-level blocking may affect Website functionality. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

11. Security

We implement technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. No internet transmission or storage system can be guaranteed to be completely secure, and you should take reasonable steps to protect your own devices and communications.

12. Automated decision-making

We do not use personal data collected solely through ordinary browsing of the public Website to make decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. Website analytics may involve automated measurement or segmentation of usage patterns, but not such legally or similarly significant decisions.

13. Children

The Website is intended for business and professional audiences and is not directed to children. We do not knowingly seek to collect personal data from children through the public Website.

14. Third-party links

The Website may link to third-party websites or services. This Policy does not apply to personal data processed independently by those third parties. We recommend reviewing their privacy information before providing personal data to them.

15. Changes to this Policy

We may update this Policy from time to time to reflect changes to the Website, our processing activities, service providers or applicable law. The current version will be published on the Website with an updated “Last updated” date. Where required by law, we will provide additional notice or request renewed consent.

16. Contact

To exercise your data protection rights or ask questions about this Policy, you may contact INXYTECH LTD at its registered office stated above or through the email: [email protected]