Privacy Policy

Privacy Policy

Last updated: 30th October 2026

EPX Limited is committed to protecting your privacy. This policy explains how we collect, use, store, and share your personal information, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

EPX Limited, trading as EPX IT, is the data controller for your personal data. Our company number is 05400600 and our ICO registration number is ZA138147. You can contact us at:

Address: EPX IT, New Beacon Building, Stafford Enterprise Park, Weston Road, Stafford, Staffordshire, ST18 0BF
Email: MPennington@epx.co.uk
Phone: 01785 878 311

Our privacy lead, Mark Pennington, is responsible for overseeing data protection matters and is your point of contact for any privacy questions.

2. What Information We Collect

We may collect your name, email address, phone number, company name, job title, and any details you share when contacting us or using our services. When you visit our website we also collect your IP address, browser type, and usage data through cookies. If you are a client, we process information generated through the delivery of our services, such as support tickets and system logs.

3. How We Use Your Information

We use your information for the following purposes, relying on the lawful basis shown in brackets:

• Responding to enquiries and preparing quotes (legitimate interests, or steps you ask us to take before you enter a contract with us yourself).
• Delivering IT services and support to clients (performance of a contract if you are our client yourself, such as a sole trader, or legitimate interests if you work for a client business).
• Sending marketing communications where you have opted in (consent), or to existing business contacts (legitimate interests).
• Improving our website and services (legitimate interests).
• Meeting our legal and regulatory obligations (legal obligation).

4. Use of AI Tools

We use approved AI tools to help us run and improve our service, for example to draft and summarise documents and to help our support team work through tickets. Some run inside our own Microsoft environment. Others come from AI companies acting as our data processors. Their data processing agreements do not allow them to train their models on your data, and limit how long they keep it.

We share only the minimum needed. We never send credentials to any AI tool, and we never send sensitive personal data to an AI tool outside our own Microsoft environment. The AI tool that runs inside that environment can work with sensitive personal data we already hold there.

A person always reviews AI output, and we do not make decisions about you that have a legal or similarly significant effect by automated means alone. If you think a decision about you relied on AI, email MPennington@epx.co.uk and a person will review it and give you their own view.

Each use of an AI tool relies on the same lawful basis as the purpose it serves under "How We Use Your Information". If you are our client yourself, such as a sole trader, that is the performance of our contract with you. If you work for a client business, or you contact us or visit our website, it is our legitimate interest in running our service efficiently. You can object to that under "Your Rights".

These providers are sub-processors. See "Who We Share Your Information With" for how we protect any data transferred outside the UK, and "Your Rights" for how to object to this processing or contact us.

5. Who We Share Your Information With

We share your information only where necessary, with:

• Trusted technology providers and sub-processors who help us deliver our services (including cloud providers and the AI tool providers referenced above).
• Professional advisers such as accountants and lawyers.
• Regulators or law enforcement where we are legally required to do so.

Some of our technology providers, including our AI tool providers, process personal data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations, or on the UK transfer clauses in our data processing agreements with them (the International Data Transfer Agreement or the UK Addendum). You can ask us for a copy of the safeguards that apply using the contact details in this notice. We never sell your personal data.

6. How Long We Keep Your Information

We keep enquiry data for up to 2 years from last contact, client data for 6 years after the end of our contract, and marketing data until you unsubscribe. Website analytics data is retained for up to 26 months. Data is securely deleted or anonymised when no longer needed.

7. Your Rights

Under UK GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to our processing, to receive your data in a portable format, and to withdraw consent at any time where processing is based on it. You also have the right not to be subject to decisions made solely by automated processing.

To exercise any of these rights please contact us at MPennington@epx.co.uk. We will respond within one month.

If you are unhappy with how we handle your data, please tell us first at MPennington@epx.co.uk and we will acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

8. Cookies

Our website uses cookies to help it function and to understand how visitors use the site. Essential cookies are used for security and basic functionality. Non-essential cookies (such as analytics) are only used with your consent, which you can give or withdraw through our cookie banner or your browser settings.

9. Embedded Content

Our website may include embedded content from other sites (such as videos or maps). These third parties may collect data about you and use cookies in the same way they would if you visited their site directly.

10. Changes to This Policy

We may update this policy from time to time to reflect changes to our services, technology, or legal obligations. The date at the top of this policy shows when it was last revised.

Document reference: POL-PRIV-001  |  Version 2.2  |  [30.10.26]