Privacy Policy

At Atoxor, we are committed to protecting and respecting your privacy. This Privacy Policy outlines how we collect, use, store, and protect your personal data when you use our services, visit our website, or engage with us in any other way.

Data Controller

Atoxor Ltd is the data controller responsible for the personal data described in this Privacy Policy.

Registered office: The Old Bakery, 90 Camden Road, Tunbridge Wells, England, TN1 2QP
Email: info@atoxor.co.uk

Last updated: 4th August 2026

1. Information We Collect

We collect different types of personal data depending on how you interact with us. The data we collect includes:

1.1 Personal Information You Provide

Contact details (e.g. name, email address, phone number, company name) when you fill out forms on our website or contact us directly.
Project-related information when engaging with our services (e.g. information required for SOP development or consultation services).
Transaction and billing information when you purchase our products or services. Payment-card information is processed directly by our payment service provider and is not stored by Atoxor Ltd.
Mailing-list information, including your email address and a record of your consent, when you join our mailing list to receive the Capability Maturity Assessment, marketing emails and framework updates.

1.2 Information Collected Automatically

Cookies and Tracking Data: When you visit our website, we use cookies and similar tracking technologies to enhance your experience and gather analytics about how our site is used.
Device Information: We may collect information about the device you use to access our site (e.g. IP address, browser type).

2. How We Use Your Information
We use the personal data we collect for the following purposes:

To provide and maintain our services: This includes creating and delivering SOPs, consultancy services, and handling support requests.
To communicate with you: Sending you updates about your project, responding to enquiries, and providing the Capability Maturity Assessment, marketing emails and framework updates where you have consented to receive them.
To administer our mailing list: Managing subscriptions, maintaining records of consent and processing unsubscribe requests.
To improve our services: Using analytics data to enhance user experience on our website.
For legal and compliance purposes: Ensuring compliance with applicable laws and regulations, including the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended.

3. Legal Basis for Processing

Under the UK General Data Protection Regulation and the Data Protection Act 2018, we rely on the following legal bases when processing your personal data:

Consent: We rely on your consent when you join our mailing list to receive marketing emails and framework updates and when we use cookies or similar technologies that require consent. You may withdraw your consent at any time.
Contractual necessity: We process personal data where this is necessary to enter into or fulfil a contract with you, including supplying purchased products, delivering consultancy services, processing payments and providing customer support.
Legal obligation: We process personal data where necessary to meet our legal, accounting, taxation and regulatory obligations.
Legitimate interests: We process personal data where reasonably necessary to operate and protect our business, respond to enquiries, administer customer and business relationships, maintain website security, prevent fraud and improve our services, provided that these interests are not overridden by your rights and freedoms.

Where we rely on legitimate interests, we consider the necessity and proportionality of the processing and its potential effect on the individuals concerned.

4. How We Share Your Data
We do not sell or rent your personal data. However, we may share your data in the following circumstances:

Service Providers: We may share your data with third-party service providers, including website hosting, form management, email marketing and payment service providers, who help us operate our website and deliver our services and communications. These providers process personal data on our behalf and are required to handle it securely and in accordance with applicable data protection requirements. Our service providers include Google, which provides website analytics and, where enabled, advertising, audience and conversion-measurement services.
Compliance: We may share your data where we are required to do so by law or in response to legal requests.
Business Transfers: In the event of a merger, acquisition, or asset sale, your personal data may be transferred.

5. How We Store and Protect Your Data

We are committed to ensuring that your information is secure. We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Our Wix-hosted website uses encrypted HTTPS connections to protect data transmitted between users and the website, and Wix applies encryption to data stored on its platform. Access to personal data is restricted through appropriate account permissions and access controls.

Data Storage: Personal data may be stored and processed in the United Kingdom and in other countries in which our service providers operate.
International Data Transfers: Some of our service providers may store or process personal data outside the United Kingdom. Where this constitutes a restricted international transfer under UK data-protection law, we ensure that an appropriate transfer mechanism is in place. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission Standard Contractual Clauses, or another lawful safeguard or exception. You may contact us at info@atoxor.co.uk for further information.
Data Retention: We retain personal data only for as long as reasonably necessary for the purpose for which it was collected. When determining an appropriate retention period, we consider the nature and sensitivity of the information, the purposes for which it is processed, contractual requirements, applicable limitation periods and our legal, accounting, taxation and regulatory obligations. Enquiry, customer, project, transaction and financial records may therefore be retained for different periods. These periods are documented in our internal retention arrangements and are reviewed periodically.
Mailing-List Retention: We retain your email address and mailing-list consent information while you remain subscribed. If you withdraw your consent or unsubscribe, we will stop sending you marketing emails and framework updates. We may retain a minimal record of your email address and unsubscribe status to ensure that your preference continues to be respected.

6. Your Rights Under UK Data Protection Law

Under the UK GDPR and the Data Protection Act 2018, you may have the following rights regarding your personal data, depending on the circumstances and the lawful basis on which we process it:

Right to Access: You can request a copy of the personal data we hold about you.
Right to Rectification: You can request corrections to any inaccurate or incomplete personal data.
Right to Erasure: You can request the deletion of your personal data under certain circumstances.
Right to Restrict Processing: You can request the restriction of processing of your personal data under certain circumstances.
Right to Data Portability: In certain circumstances, where processing is based on consent or contract and is carried out by automated means, you can request the personal data that you provided to us in a structured, commonly used and machine-readable format
Right to Object: You can object to the processing of your personal data where we rely on legitimate interests as the legal basis for processing.
Right to Withdraw Consent: If you have provided consent for us to process your personal data, including consent to receive marketing emails and framework updates, you have the right to withdraw that consent at any time. You can withdraw your consent by using the unsubscribe link included in our emails or by contacting us at info@atoxor.co.uk.
Right to Object to Direct Marketing: You have the right to object at any time to the use of your personal data for direct marketing. If you exercise this right, we will stop using your personal data for that purpose.
Right to Lodge a Complaint: If you are unhappy with how we process your personal data, you have the right to lodge a complaint with a supervisory authority, such as the Information Commissioner's Office (ICO) in the UK.

7. Data Breach Notification

If a personal data breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a personal data breach is likely to result in a high risk to affected individuals’ rights and freedoms, we will also notify those individuals without undue delay, unless an applicable legal exception applies.

We maintain appropriate records of personal data breaches and the actions taken in response to them.

8. Automated Decision-Making and Profiling

We do not use solely automated decision-making that produces legal effects or similarly significant effects concerning individuals.

Where advertising technologies are enabled and you have provided the required consent, limited profiling may be used to measure advertising effectiveness, understand website interactions, create advertising audiences and provide more relevant advertising. The technologies currently in use are identified through our Cookie Settings.

9. Data Protection Impact Assessments

Where a proposed data-processing activity is likely to result in a high risk to individuals’ rights and freedoms, we carry out a Data Protection Impact Assessment before the processing begins. This helps us identify and minimise privacy and data-protection risks and determine the safeguards required.

10. Cookie Policy

We use cookies and similar storage and access technologies on our website. Some technologies are necessary for the website to operate. Other technologies are used only where consent is required and has been obtained, unless an applicable legal exception permits their use without consent.

Our cookie controls allow users to manage their preferences. Further information about the technologies used, their providers, purposes and duration is provided through our cookie settings.

Types of Cookies We Use:

Essential Cookies: Necessary for the website to function, maintain security and provide features requested by users. These cookies cannot be switched off through our cookie controls.

Analytics Cookies: With your consent, we use analytics cookies, including Google Analytics, to understand how visitors use our website, such as which pages are visited, how visitors navigate the site and how the website performs. We use this information to improve our website, content and user experience.

Marketing and Advertising Technologies: Where enabled, and with your consent, we may use Google Ads and similar advertising technologies to measure the effectiveness of advertising campaigns, understand whether advertisements lead to website visits, resource requests, form submissions or purchases, create or use advertising audiences and, where applicable, provide more relevant advertising.

These technologies may use cookies or similar identifiers and may collect or receive information about your device, browser, IP address, advertising identifiers and interactions with our website. This information may be shared with Google or another advertising service provider for the purposes described above.

Advertising technologies that require consent will not be activated until the relevant consent has been obtained through our cookie controls. The specific technologies currently enabled, their providers, purposes and duration are identified through our Cookie Settings.

You can change or withdraw your cookie choices at any time through our Cookie Settings

11. Children's Privacy
Our services are not intended for individuals under the age of 16. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected such data, we will take steps to delete it.

12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with the updated date at the top. A version history or changelog will be provided to help you understand the updates.

13. Contact Us and Data Protection Complaints
If you have any questions, concerns or complaints about this Privacy Policy or how we process your personal data, please contact:

Atoxor Ltd at : info@atoxor.co.uk

Atoxor Ltd is the data controller responsible for the personal data described in this Privacy Policy.

Registered office: The Old Bakery, 90 Camden Road, Tunbridge Wells, England, TN1 2QP

To make a data-protection complaint, please use the subject line “Data Protection Complaint” where possible.

We will acknowledge receipt of a data-protection complaint within 30 days. We will take appropriate steps to investigate the complaint without undue delay, keep you informed where appropriate and notify you of the outcome without undue delay.

You also have the right to lodge a complaint with the Information Commissioner’s Office. We would welcome the opportunity to consider your concerns directly before you approach the ICO, although you are not required to contact us first.

14. Version History

26/09/2024: Initial version of the policy.
04/08/2026: Updated to include the Capability Maturity Assessment mailing list, marketing emails, framework updates, consent records, retention and unsubscribe arrangements.