Privacy Policy

1. Who we are

Xova is the data controller for the personal data described in this policy. Xova is a trading name of Business Finance Market Limited, a company registered in England & Wales (Company No. 12035429) with its registered office at 15 Parsons Court, Welbury Way, Aycliffe Business Park, County Durham, DL5 6ZE.

You can contact us about anything in this policy by emailing hello@xova.co.uk or by writing to us at our registered office address above.

2. What personal data we collect

Depending on how you interact with us, we may collect:

• Contact and identity details: your name, work email address, phone number, job title and company name when you request a demo, contact us or subscribe to updates.
• Business details: information about your brokerage or firm that you share with us, such as team size, the lenders you work with and your current processes.
• Technical and usage data: IP address, browser type, device information, pages visited and how you interact with this website, collected through cookies and similar technologies (see our Cookie Policy).
• Communications: records of emails, calls and meetings with you, including any feedback you give us.

We do not knowingly collect special category data (such as health information) through this website, and this website is not intended for children.

3. How and why we use your data

We only use your personal data where the law allows us to. The table below summarises our purposes and lawful bases under UK GDPR:

• Responding to demo requests and enquiries: to contact you, arrange demonstrations and discuss our platform. Lawful basis: legitimate interests and steps towards a contract at your request.
• Providing and improving our services: to operate the website, understand how it is used and improve it. Lawful basis: legitimate interests.
• Marketing communications: to send you insights, product news and event invitations where you have asked to receive them or where we are permitted to do so for business contacts. Lawful basis: consent or legitimate interests; you can opt out at any time.
• Legal and regulatory obligations : to keep records, prevent fraud and comply with the law. Lawful basis: legal obligation and legitimate interests.

4. Who we share your data with

We do not sell your personal data. We may share it with trusted third parties who process it on our behalf, under contract and only as instructed:

• Customer relationship management (CRM) and marketing platforms used to manage demo requests and communications (for example, HubSpot).
• Website hosting, analytics and error-monitoring providers.
• Professional advisers such as lawyers and accountants, where necessary.
• Regulators, law enforcement or courts where we are legally required to do so.

If our business is sold or merged, your data may be transferred to the new owners, who will continue to use it only as described in this policy.

5. International transfers

Some of our service providers are based outside the United Kingdom. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or transfers to countries covered by UK adequacy regulations.

6. How long we keep your data

We keep personal data only for as long as we need it for the purposes described above, including to satisfy legal, accounting or reporting requirements. Enquiry and demo-request data is typically kept for up to 24 months after our last meaningful contact with you, unless a business relationship continues or the law requires a longer period. When data is no longer needed, it is securely deleted or anonymised.

7. Your rights

Under UK data protection law, you have the right to:

• Request access to the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to erase your data in certain circumstances.
• Object to or restrict how we process your data.
• Request a copy of your data in a portable format.
• Withdraw consent at any time where we rely on consent.
• Opt out of marketing at any time by using the unsubscribe link in our emails or contacting us.

To exercise any of these rights, email hello@xova.co.uk. We respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113, though we would welcome the chance to resolve your concern first.

8. Security

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse, including access controls, encryption in transit and limiting access to those who need it. No method of transmission over the internet is completely secure, but we work hard to protect your information and review our measures regularly.

9. Changes to this policy

We may update this policy from time to time. The latest version will always be posted on this page with its "last updated" date. If we make significant changes, we will take reasonable steps to bring them to your attention.