1. Who we are
Inxtinct Ltd (“Inxtinct”, “we”, “our” or “us”) provides cybersecurity consultancy, compliance support, live cybersecurity training and Inxtinct Learning, an online training platform for organisations and their authorised learners.
Inxtinct Ltd is registered in England and Wales (company number 13880993). Our registered office is 20–22 Wenlock Road, London, N1 7GU, United Kingdom. For all privacy enquiries, contact [email protected].
This policy explains how personal information is handled when you visit our website, enquire about or use our services, or access Inxtinct Learning through an organisation.
2. Our role and our customers' role
For website enquiries, client relationship management and our own business administration, Inxtinct ordinarily determines why and how relevant personal information is processed and acts as a data controller.
For learner accounts and training records processed on behalf of an organisation using Inxtinct Learning, the organisation ordinarily determines the purposes of processing and acts as the controller, while Inxtinct acts as its processor. The applicable customer contract and data processing agreement govern those arrangements. Inxtinct may be a separate controller for limited platform information needed to meet its own legal obligations or protect its services.
An organisation's own privacy notice may explain how it uses its employees' training records. Learners should contact their organisation for questions about why training is assigned or how their results are used internally.
3. Information we process
Website and business enquiries. When you contact us, we receive the details you provide: your name, work email, enquiry message and, if provided, phone number, organisation and company size. Our contact forms store submitted enquiry details and a submission date in Airtable so we can respond and manage follow-up. We may also receive basic technical and security information about use of our website.
Consultancy and live training. We handle relevant business contacts, project communications, training bookings and materials provided in connection with an agreed engagement. The precise information involved depends on the scope of the work and the applicable client agreement.
Inxtinct Learning. Organisations may provide learner names, email addresses, account and organisational identifiers, roles and training assignments. The platform processes course enrolment, learning progress, training completion status, assessment results and relevant activity records. Organisation administrators can see individual learners' progress and whether assigned training has been completed. Where available in a customer's configuration, other assessment and training activity information may also be visible to authorised administrators.
Organisation-created learning content. Customers can upload their own courses and other training materials for distribution to their authorised learners. The customer is responsible for deciding what content to upload and whom to assign it to.
Website analytics. If you consent, our website uses Google Analytics to help us understand website usage and improve the site. Analytics is blocked until you opt in. See our Cookie Policy.
4. Why we use information and our lawful bases
We use relevant information to respond to enquiries; negotiate and deliver services; administer consultancy and live training; provide and secure Inxtinct Learning; manage business relationships, invoicing and legal records; and fulfil applicable legal obligations.
Depending on the circumstances, our lawful basis as controller may be taking steps before or performing a contract, complying with a legal obligation, or our legitimate interests in operating and protecting our business and responding to enquiries. We rely on consent for optional Google Analytics tracking on our website. You can withdraw that consent using Cookie settings in the footer.
When acting as a processor for an Inxtinct Learning customer, we process learner information on the customer's documented instructions under the applicable contractual arrangements, rather than selecting an independent lawful basis for the customer's training activities.
5. Access to learner records
Inxtinct Learning is licensed to organisations under annual business contracts. Authorised customer administrators can manage learning assignments and view learners' progress and completion status, as well as assessment information made available within the platform. Customers determine which learners and administrators receive access.
When an organisation's contract ends, platform access is disabled immediately and licences are revoked for all its users. Under Inxtinct's current operational process, associated learner records are retained after access ends until the organisation submits an authorised deletion request. The handling of records at contract end must also comply with applicable data-protection law and the customer's data processing agreement, including any required choice to return or delete personal data. See Section 8.
6. Service providers and sharing
We do not sell personal information or share it for third parties' own marketing purposes.
Operating our services necessarily involves service providers acting on our behalf. Inxtinct Learning runs on Amazon Web Services (AWS) infrastructure in the London, United Kingdom region. We use Airtable to store website enquiries and Google reCAPTCHA to protect enquiry forms against spam and automated abuse. reCAPTCHA loads when you interact with a form or submit it and may receive technical device, browser and interaction signals. We also use Google Analytics on the website when visitors have consented. Depending on an engagement, relevant information may be processed by providers that deliver email, infrastructure, security or business administration functions. These arrangements are for providing and supporting our services, not selling customer or learner information.
We may disclose information where required by law or where necessary to establish, exercise or defend legal rights. Access to customer information in a consultancy engagement is governed by its agreed scope and confidentiality arrangements.
7. Where information is processed
Our Inxtinct Learning application is hosted on AWS servers in London, UK. This does not mean every service associated with our business processes information only in the UK: Google Analytics and other providers may process information in other locations. Where a restricted international transfer occurs, we will use an applicable lawful transfer mechanism or exception as required by UK data protection law.
8. Retention and deletion
For enquiries, retention depends on the time needed to answer the request, manage relevant follow-up and keep a proportionate record of the discussion. For client and contractual information, we consider the engagement, ongoing administration, applicable accounting or legal record-keeping duties, and the need to establish, exercise or defend legal claims. These criteria differ by record category; this notice does not promise a fixed deletion date that our systems do not implement.
For Inxtinct Learning, we disable access and revoke licences immediately when an organisation's annual contract ends, but our current process is to retain learner data until an authorised manual deletion request is received from the organisation. Deletion requests can be sent to [email protected]. We verify that instructions come from an authorised representative and handle them under the customer agreement and applicable law. Where required, data may need to be returned rather than deleted; legally required records may be retained.
Our customer data processing agreements must provide for the controller's choice to have personal data returned or deleted at the end of processing. We do not present indefinite retention after termination as an unconditional right. Backups and legally required records may be subject to separate, documented handling procedures.
9. Security
We take reasonable technical and organisational steps to protect the information we process, including controlling access to accounts and systems. No website or platform can be guaranteed to be completely secure. Please report suspected security or privacy issues to [email protected], without sending passwords or private keys.
10. Cookies and Google Analytics
Our website uses essential storage where necessary to provide functions such as remembering cookie choices. Optional Google Analytics is not activated until you select “Accept analytics” or enable it through preferences.
The cookie banner offers Reject optional, Accept analytics and preference controls. Your choice is remembered for 180 days, subject to browser settings, and you can change it at any time via Cookie settings in every footer. See our Cookie Policy for further details.
11. Your rights
Subject to applicable law and exceptions, you may have rights to access, correct or erase your personal information, restrict or object to certain processing, and obtain portability of information in relevant circumstances. You can withdraw consent where it is the basis of processing.
Email [email protected] to make a request. Where learner information is controlled by your organisation, we may refer you to that organisation or assist it in responding.
You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
12. Employees of different ages
Inxtinct Learning is supplied to organisations for workforce training. Organisations determine which employees and other authorised learners may use it. The platform is not marketed directly to children, but we do not assume that every authorised learner is aged 18 or over. Organisations should ensure their enrolment decisions and use of learner records comply with applicable privacy and employment requirements.
13. Changes and contact
We may revise this policy as our services or legal obligations change. The updated version will be posted here with a new date.
Inxtinct Ltd
20–22 Wenlock Road, London, N1 7GU, United Kingdom
Company number: 13880993
[email protected]