InnovateXP Privacy Policy

InnovateXP Limited is the data controller for personal data collected through innovatexp.co and the InnovateXP-managed tools described on this website, unless a separate written agreement states otherwise for a client deployment.

• Legal name: InnovateXP Limited
• Website: https://www.innovatexp.co
• Privacy contact: privacy@innovatexp.co
• General enquiries: via the contact or booking pages on this website

Depending on how you interact with us, we may collect:

• Identity and contact data: name, email, phone/WhatsApp, company, job title
• Booking and enquiry data: preferred time slots, service interest, workflow health check answers, quotation wizard selections
• Technical data: IP address, browser type, device, pages viewed, referral source, cookies and similar identifiers
• Communications: messages you send through forms, email, WhatsApp, or meeting notes you choose to share
• AI workflow inputs: business process descriptions, anonymised workflow examples, and content you submit for consulting, training, or pilot scoping — not customer lists, payroll, or financial records unless explicitly agreed in a signed project scope
• Client project data: where we implement CRM, event, or automation systems under contract, processing is governed by the relevant service agreement and data processing terms

We use personal data to:

• Respond to enquiries, bookings, and support requests
• Deliver consulting, training, coaching, and implementation services
• Operate website features such as calendars, forms, analytics, and internal routing
• Improve site performance, security, and user experience
• Send service-related communications you request or reasonably expect
• Comply with law, resolve disputes, and enforce agreements

Where GDPR applies, we rely on one or more of the following legal bases:

• Consent — for optional marketing, non-essential cookies, or where you explicitly opt in
• Contract — to respond to your request or perform services you ask us to deliver
• Legitimate interests — to operate, secure, and improve our website and services, balanced against your rights
• Legal obligation — where retention or disclosure is required by applicable law

InnovateXP may use third-party platforms to operate this website and deliver AI-assisted workflows. These may include hosting (e.g. Vercel), analytics, calendar/booking integrations, email or messaging tools, and AI model providers (e.g. Azure OpenAI, Google Cloud, Alibaba Cloud, AWS) configured per project scope.

We configure tools to minimise unnecessary personal data, use encryption in transit where supported, and avoid using your confidential project data to train public models unless you explicitly agree in writing.

• We do not sell personal data
• Sub-processors are selected for security and contractual safeguards
• Cross-border transfers, where they occur, are protected by appropriate safeguards such as contractual clauses or equivalent measures required by PDPO and GDPR

We use cookies and similar technologies for essential site operation, preferences (such as theme), and limited analytics to understand traffic and improve performance. Non-essential analytics may be deferred or limited on mobile where configured.

You can control cookies through your browser settings. Blocking essential cookies may affect booking or form features.

We retain personal data only for as long as needed for the purposes above, unless a longer period is required by law or legitimate business records.

Enquiry and booking records are typically retained for up to 24 months unless an active client relationship continues. Client project data retention follows the relevant contract.

We apply reasonable technical and organisational measures including access controls, encrypted connections (HTTPS), scoped API credentials, and least-privilege handling for production systems.

No method of transmission or storage is completely secure. Please do not submit highly sensitive personal data through public website forms.

Under PDPO and, where applicable, GDPR, you may have the right to:

• Request access to personal data we hold about you
• Request correction of inaccurate data
• Request deletion or restriction of processing, subject to legal and contractual limits
• Object to certain processing based on legitimate interests
• Withdraw consent where processing is consent-based
• Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (Hong Kong) or your local EU/UK supervisory authority

Our services are intended for businesses and adults. We do not knowingly collect personal data from children under 16 through this website.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be highlighted on this page.