Privacy Notice

Last updated: August 2026

1. Who We Are

Experience Transformation (XPT) Ltd is a specialist transformation advisory firm incorporated in Ireland, with its registered office in Dublin. We are the data controller responsible for your personal data.

2. What Personal Data We Collect

2.1 Client and Prospective Client Data

Names, job titles, business email addresses, business telephone numbers, and business postal addresses of individuals at client and prospective client organisations. This data is collected through direct business correspondence, meetings, introductions, and publicly available professional sources (e.g. LinkedIn, company websites).

2.2 Website Visitor Data

When you visit XPTransformation.com, we may collect: IP address, browser type and version, pages visited, time and date of visit, and referring URL. If you download a gated resource, we collect the information you provide in the download form (typically name, email address, and company name).

2.3 Engagement and Billing Data

For active client engagements: names and contact details of client personnel we work with, billing contact details, purchase order references, and payment records.

2.4 Supplier and Partner Data

Names, contact details, and billing information of suppliers, contractors, and professional partners.

3. How We Use Your Personal Data

We use personal data for the following purposes and on the following legal bases:

Purpose	Legal Basis	Data Categories
Delivering advisory and transformation services	Performance of a contract (Art. 6(1)(b))	Client contact data, engagement data
Business development and relationship management	Legitimate interests (Art. 6(1)(f))	Client and prospective client data
Invoicing, billing, and financial administration	Performance of contract; legal obligation (Art. 6(1)(b), (c))	Billing and payment data
Sending strategic briefs, insights, or updates	Legitimate interests (Art. 6(1)(f))	Name, email, job title, company
Operating and improving XPTransformation.com	Legitimate interests (Art. 6(1)(f))	Website visitor data
Responding to gated resource downloads	Consent (Art. 6(1)(a))	Name, email, company
Legal, tax, and regulatory compliance	Legal obligation (Art. 6(1)(c))	As required by applicable law

4. Who We Share Your Data With

We do not sell personal data. We may share personal data with:

Service providers: including our accountant and bookkeeper (for billing data), email hosting provider, accounting platform, and banking providers — each acting as a data processor under appropriate contractual safeguards.

Professional advisers: including our solicitors, tax advisers, and insurance brokers, where necessary for the operation of our business.

Regulatory authorities: where required by law, including the Irish Revenue Commissioners, the Data Protection Commission, and any other authority to which we are legally obliged to disclose information.

We do not share personal data with any other third parties unless required by law or with your explicit consent.

5. International Data Transfers

XPT is an Irish-registered company operating globally. Where we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

United Kingdom: Transfers are covered by the EU-UK adequacy decision (currently in force). Standard Contractual Clauses are available as a fallback mechanism.

Switzerland: Transfers are covered by the EU-Switzerland adequacy decision and comply with the Swiss Federal Act on Data Protection (FADP).

United States: Where applicable, transfers rely on the EU-US Data Privacy Framework, Standard Contractual Clauses, or other appropriate safeguards as required by GDPR Chapter V.

Where a specific client engagement requires access to personal data in a jurisdiction without an adequacy decision, we will implement Standard Contractual Clauses or other appropriate safeguards before any transfer takes place.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law:

Active client engagement data: for the duration of the engagement plus six (6) years, to comply with Irish tax and accounting obligations and contractual limitation periods.

Prospective client data: for up to two (2) years from last meaningful contact. If no engagement materialises, data is deleted or anonymised.

Billing and financial records: six (6) years from the end of the relevant financial year, as required by Irish tax legislation.

Website analytics data: twenty-six (26) months.

Gated download data: until consent is withdrawn, or two (2) years from collection if no further engagement.

For full details, our Data Retention Policy is available on request at privacy@xptransformation.com.

7. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

• Right of access Art. 15 You have the right to request a copy of the personal data we hold about you.
• Right to rectification Art. 16 You have the right to request that we correct any inaccurate or incomplete personal data.
• Right to erasure Art. 17 You have the right to request that we delete your personal data, subject to our legal obligations to retain certain records.
• Right to restriction of processing Art. 18 You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability Art. 20 You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object Art. 21 You have the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis. Where you object to processing for direct marketing purposes, we will cease such processing immediately.
• Right to withdraw consent Art. 7(3) Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, contact us at privacy@xptransformation.com. We will respond within one (1) month of receiving your request.

8. Cookies and Website Tracking

Essential cookies: required for the basic operation of the website (e.g. session management). These do not require consent.

Analytics: where analytics tools are implemented, they are configured to anonymise IP addresses and are only activated with your consent via a cookie consent banner.

We do not use advertising cookies, retargeting pixels, or tracking technologies for advertising purposes.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. These include encrypted communications (TLS/SSL on all data in transit), access controls on all systems, multi-factor authentication on all business-critical accounts, and regular review of security practices.

10. Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Irish Data Protection Commission:

We would appreciate the opportunity to address any concerns before a complaint is made to the DPC. Please contact us at privacy@xptransformation.com in the first instance.

11. Changes to This Notice

We may update this privacy notice from time to time. The "last updated" date at the top of this notice indicates when it was most recently revised. Material changes will be communicated via the website.