Privacy Policy

Who we are

Zaxonite Systems Ltd is a UK technology company and the developer and operator of Zaxonite IQ, an identity risk intelligence and digital due-diligence decision-support platform.

For privacy or data-protection enquiries, contact: [email protected]

Information relating to customers and authorised users

When an organisation or authorised user creates or uses a Zaxonite IQ account, Zaxonite Systems may process information required to provide, secure and administer the service.

This may include:

• name and organisation information
• email address
• account and authentication information
• subscription and billing-related information
• service usage information
• communications and support enquiries
• security and operational information associated with use of the service

Passwords are not stored in plain text.

Information processed during Zaxonite IQ assessments

Depending on the information submitted for an assessment, Zaxonite IQ may process:

• name
• email address
• LinkedIn profile information supplied by the authorised user
• GitHub profile information
• telephone number
• website or domain information
• relevant publicly available professional-profile information
• technical domain and DNS information
• broad geographic indicators derived from available evidence
• assessment findings and derived risk, consistency and confidence information

Not every field is required for every assessment.

Zaxonite IQ does not scrape LinkedIn profile pages and does not require access to private GitHub information.

Where assessment information comes from

Assessment information may come from:

• information supplied by an authorised Zaxonite IQ user
• defined publicly available GitHub information
• supplied public websites or domains
• public DNS infrastructure
• public domain-registration infrastructure
• information derived locally by Zaxonite IQ through comparison, correlation, classification and scoring

Public availability of information does not mean that data-protection obligations cease to apply.

How Zaxonite IQ uses assessment information

Zaxonite IQ processes available evidence to identify consistency, corroboration, gaps, anomalies and potential risk indicators.

The platform may generate derived information including Trust Score, Risk Level, Evidence Confidence, supporting findings, Critical Alerts & Next Steps and other decision-support guidance.

Zaxonite IQ performs automated analysis and profiling as part of producing an assessment. It is designed as a decision-support tool and is not intended to make a solely automated final decision producing legal or similarly significant effects on an assessed person.

Results do not verify or prove a person's identity, legitimacy, suitability, honesty or wrongdoing and should not be used as the sole basis for an employment, engagement or other significant decision.

Our role and our customers' role

The data-protection role of Zaxonite Systems Ltd depends on the processing involved.

For customer-initiated Zaxonite IQ assessments, the organisation carrying out the assessment will generally determine why the assessment is being undertaken and how its results are used. Customers are responsible for ensuring that their use of Zaxonite IQ has an appropriate lawful basis and that applicable transparency and data-protection requirements are met.

Zaxonite Systems Ltd also processes personal information for purposes it determines itself, including operation, administration, security, support and management of its services. In those circumstances, Zaxonite Systems Ltd has its own responsibilities under applicable data-protection law.

Lawful bases for processing

Where Zaxonite Systems Ltd determines the purposes and means of processing personal information, the lawful basis used depends on the purpose and circumstances of that processing.

We may process personal information where:

• processing is necessary to provide or administer a service or contract with an individual, or to take requested steps before entering into that contract;
• processing is necessary for our legitimate interests or those of a third party, where those interests are not overridden by the rights and interests of the individual; or
• processing is necessary for compliance with a legal obligation.

Our legitimate interests may include operating and securing Zaxonite IQ and our website, administering customer organisations and authorised users, preventing and investigating misuse or security incidents, providing customer support, maintaining appropriate service and business records, and protecting our services and business operations.

For customer-initiated Zaxonite IQ assessments, the customer will generally determine the purpose of the assessment and is responsible for identifying and documenting the appropriate lawful basis for its processing. Zaxonite Systems Ltd does not determine the customer's lawful basis merely by providing the Zaxonite IQ service.

Data minimisation and retention

Zaxonite IQ is designed to minimise unnecessary collection and retention of assessment information.

The current service does not maintain a permanent database of assessed-person profiles or permanent completed-assessment history.

Generated privacy-minimised PDF reports are temporarily available through the application for a maximum of 30 minutes and are not maintained as a permanent customer report archive.

Customer organisation and user account information is retained while the customer account and commercial relationship remain active, where required to provide, administer and secure the Zaxonite IQ service.

Following closure of a customer account, ordinary account and service-administration information will normally be retained for up to 90 days and then deleted or anonymised, unless specific information must be retained for a longer period for legal, regulatory, accounting, security, fraud-prevention, dispute or legal-claims purposes.

Accounting, tax and relevant financial records may normally be retained for six years from the end of the relevant financial year, or for longer where required by law. Assessment usage records required for billing or commercial record-keeping may be retained with the associated records. These usage records do not contain the assessed person's identity or assessment content.

Authentication sessions, verification and password-reset records, and incomplete registration records are retained only for as long as required for their security or registration purpose and expire in accordance with their applicable validity periods.

Routine customer-support communications may normally be retained for up to 24 months after the relevant matter is closed, subject to earlier deletion where appropriate or longer retention where required for a specific legal, security, accounting, rights-request or dispute-related purpose.

Where information must be retained in connection with a security incident, misuse investigation, complaint, individual-rights request, dispute or legal claim, Zaxonite Systems Ltd will retain only the information reasonably necessary for that purpose and will review its continued retention when that purpose ends.

Service providers and external services

Zaxonite Systems uses infrastructure and external services where necessary to operate Zaxonite IQ and perform supported assessment functions.

The production application and customer-account database are hosted using DigitalOcean infrastructure in its London region.

Depending on the evidence supplied for an assessment, limited information may also be involved in requests to public GitHub infrastructure, supplied public websites or domains, DNS infrastructure and public domain-registration infrastructure.

Zaxonite IQ is designed so that the complete assessment dataset is not routinely transmitted to a third-party intelligence, scoring, generative-AI, telephone-intelligence or PDF-generation provider.

International transfers

Although the Zaxonite IQ production application and customer-account database are hosted using DigitalOcean infrastructure in its London region, some service providers and external services used by Zaxonite Systems Ltd may process personal information outside the United Kingdom.

This may include international processing associated with infrastructure and service providers such as DigitalOcean, Stripe and GitHub, depending on the service or assessment function involved.

Where personal information is subject to a restricted international transfer, Zaxonite Systems Ltd takes steps to ensure that an appropriate transfer mechanism or safeguard is in place where required by applicable data-protection law. Depending on the circumstances, these safeguards may include applicable UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement or the UK Addendum to approved Standard Contractual Clauses.

For further information about safeguards relevant to personal information for which Zaxonite Systems Ltd is responsible, contact [email protected].

Payment processing

Subscription payments are processed using Stripe. Zaxonite Systems does not need to collect or store customers' full payment-card details within the Zaxonite IQ application.

Security

Zaxonite Systems applies technical and organisational controls intended to protect customer accounts and information processed through the service. More information is available on our Privacy & Security page.

Special category and criminal-offence information

Zaxonite IQ is not designed to intentionally collect or infer special category personal data or criminal-offence information.

Customers must not intentionally submit this information into assessment fields that are not designed for such processing.

Your data-protection rights

Depending on the circumstances and applicable data-protection law, individuals may have rights relating to their personal information, including rights of access, correction, erasure, restriction, objection and data portability.

Where Zaxonite Systems Ltd relies on legitimate interests as its lawful basis, individuals may have the right to object to that processing. Any objection will be considered in accordance with applicable data-protection law and the circumstances of the processing.

Where a request concerns an assessment carried out by a Zaxonite IQ customer, it may be necessary for the request to be handled by or in conjunction with the organisation responsible for that assessment.

For privacy enquiries or requests concerning information for which Zaxonite Systems Ltd is responsible, contact: [email protected]

Complaints

If you have concerns about how Zaxonite Systems Ltd handles your personal information, please contact [email protected].

Individuals may also have the right to complain to the UK Information Commissioner's Office.

ICO registration

Zaxonite Systems Ltd — ICO registration details will be published following completion of registration.

Changes to this Privacy Policy

We may update this Privacy Policy when our services, processing activities or legal obligations change. The current version will be published on this page with its latest revision date.