Skip to content
Book a call

Privacy notice

Version 3.0 · Last updated 2 November 2026

This notice explains how Innovatex Global collects and uses personal data when you visit our website, contact us, book a call, sign up for our insights or work with us, and the rights you have under UK data protection law.

1. Who we are

Innovatex Global is a trading name of Innovatex Global Ltd. Our office is at Suite 3.10, 16 Robertson Street, Glasgow G2 8DS, United Kingdom.

We are the controller of the personal data described in this notice, which means we decide how and why it is used. We are not required to appoint a Data Protection Officer. Questions about this notice or your personal data can be sent to:

2. The personal data we use, why, and our lawful basis

UK data protection law requires a lawful basis for each use of personal data. Ours are set out below.

When you send us an enquiry

Data: your name, work email address, organisation, phone number (if you give it), the topic you choose, your message, and the date, time and version of this notice you were shown.

Why: to reply to you, discuss whether and how we can help, and keep a record of our correspondence.

Lawful basis: our legitimate interests in responding to enquiries about our services (Article 6(1)(f) UK GDPR). Where you are enquiring for yourself, for example as a sole trader, it is also necessary to take steps at your request before entering into a contract (Article 6(1)(b)). The tick box on our contact and booking forms confirms that you have read this notice; we do not rely on it as consent.

When you book a call

Data: your name, work email address, organisation, job title, the topic you choose, any notes you add, the date and time you book, the time zone your browser reports, and the date, time and version of this notice you were shown. To prevent abuse of the booking form we briefly keep a one-way scrambled (hashed) version of your IP address; it cannot be turned back into your IP address and is deleted after one hour.

Why: to arrange and hold the call, send you a confirmation with a calendar invitation, send reminders 24 hours and 1 hour before, let you reschedule or cancel, and follow up on what we discussed.

Lawful basis: as for enquiries — our legitimate interests in arranging calls with people interested in our services, and, where you book for yourself, steps at your request before entering into a contract. Confirmations and reminders are service messages about your booking, not marketing.

When you sign up for insights by email

Data: your work email address and a record of when and how you signed up.

Why: to send you our articles and updates.

Lawful basis: your consent (Article 6(1)(a) UK GDPR and regulation 22 of the Privacy and Electronic Communications Regulations 2003). You can withdraw it at any time using the unsubscribe link in any email or by contacting us.

When you use our website

Security and spam protection: our website security and firewall software processes your IP address, browser and device information and the pages you request, to keep the website secure and detect attacks. On pages with a form, and on the login page, Google reCAPTCHA checks how the page is used (for example your IP address, browser and device information, and mouse and keyboard activity) to tell people from automated spam. Lawful basis: our legitimate interests in keeping our website and the people who use it safe.

Analytics: only if you accept analytics cookies, we use Google Analytics to understand how the website is used — for example which pages are visited, how visitors arrive, their device and approximate location (country and city). Google Analytics does not store full IP addresses. Lawful basis: your consent, which you can change at any time (see our cookie policy).

When we work with you or your organisation

Data: names, job titles and business contact details of people at our clients and prospective clients, and correspondence and records relating to our engagements.

Lawful basis: performance of our contract with you (Article 6(1)(b)) or, where the contract is with your organisation, our legitimate interests in delivering and managing it; and compliance with our legal obligations, for example accounting and tax record-keeping (Article 6(1)(c)).

Personal data we receive in the course of an engagement — for example during an internal audit or a fraud investigation, which may include information about suspected offences — is handled under the terms of that engagement and the data protection conditions that apply to it, not under this website notice.

Records of consent and legal claims

We keep records of the consents and acknowledgements you give so that we can show we have complied with the law (Article 6(1)(c)). We may also use personal data where necessary to establish, exercise or defend legal claims (Article 6(1)(f)).

Information we do not ask for

We do not ask for special category data (such as health, ethnicity or religious beliefs) or information about criminal offences through this website. Please do not include it in a message or booking note.

Our services are for organisations, and this website is not intended for children. Under the Data Protection Act 2018, a young person in Scotland aged 12 or over is presumed to be able to exercise their own data protection rights.

3. Where we get personal data from

Mostly from you. Sometimes a colleague gives us your details, for example when they book a call that you will attend, or your organisation does so when we work with it.

You do not have to give us personal data. Without the details marked as required on a form, however, we cannot reply to your enquiry or arrange your call.

4. Who we share it with

We do not sell personal data or use it for advertising. We share it only with:

  • Service providers who act on our instructions under written contracts:
    our website hosting provider; the developer of our website firewall (Defiant Inc., Wordfence), which receives IP addresses involved in attacks; our email and office software provider; the video-call service used for your call (Microsoft Teams, Zoom or Google Meet); Google (reCAPTCHA spam protection on forms and the login page, and Analytics only with your consent); and our backup storage provider.
  • Our professional advisers, such as lawyers, accountants and insurers, where necessary.
  • Law enforcement agencies, regulators, courts and other authorities, where we are legally required to or where it is necessary to prevent or detect crime.
  • A buyer or successor if our business, or part of it, is sold or reorganised, under equivalent protections.

5. Transfers outside the UK

Some of our providers (for example Google, Microsoft, Zoom and Defiant) are based in, or may access data from, the United States or other countries outside the UK. Where personal data is transferred outside the UK, we make sure it is protected by:

  • UK adequacy regulations, including the UK–US “data bridge” for US organisations certified to it; or
  • the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses issued under UK law.

You can ask us for more information about these safeguards.

6. How long we keep it

  • Enquiries that do not lead to work: 24 months after our last contact with you.
  • Bookings: automatically anonymised 24 months after the meeting date, unless we go on to work together.
  • Insights sign-ups: until you unsubscribe. We then keep your email address on a suppression list only, so that we do not email you again.
  • Client and engagement records: six years after the engagement ends. This meets our accounting and tax record-keeping obligations and covers the five-year prescriptive period for claims under the Prescription and Limitation (Scotland) Act 1973.
  • Analytics data: 14 months.
  • Security logs: normally no more than 90 days, unless needed to investigate an incident.
  • Records of consent and acknowledgements: for as long as we hold the related data, and then for up to six years where needed to show we complied with the law.

7. How we protect it

We use encrypted (HTTPS) connections, a website firewall, two-factor authentication and least-privilege access for our staff, regular updates and off-site backups. Only people who need personal data for their work can access it.

8. Your rights

Under UK data protection law you have the right to:

  • access the personal data we hold about you and receive a copy of it;
  • have inaccurate data corrected and incomplete data completed;
  • have your data erased in certain circumstances;
  • restrict how we use your data in certain circumstances;
  • object to our use of your data where we rely on legitimate interests (and at any time to direct marketing, which we will then stop);
  • data portability, where we rely on consent or a contract and process your data by automated means; and
  • withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.

To use any of these rights, contact us at info@innovatexglobal.com. There is normally no charge. We may need to confirm your identity first. We will respond within one month, which can be extended by up to two further months for complex or multiple requests; if so, we will tell you why within the first month.

9. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at info@innovatexglobal.com. We will acknowledge your complaint within 30 days, look into it and let you know the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, which covers Scotland: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

10. Changes to this notice

We review this notice regularly and will update it when our practices or the law change. The version number and date at the top show when it last changed. The version shown to you is recorded each time you submit a form or book a call. If we make a significant change that affects you, we will tell you directly where we can.

Last updated 2 November 2026