Last updated: 26 May 2026.
This page explains what personal data we collect when you use xpera.co.uk, why we collect it, and what your rights are. We aim to keep it short and in plain English.
Who we are
The data controller is FASTANDEAZY LTD (company number 10610274), trading as Xpera. Registered office: 7 Rutherford Gate, Shenley Lodge, Milton Keynes, United Kingdom. You can reach us at colin.rees@xpera.co.uk.
We are a small consultancy. There is no Data Protection Officer — Colin Rees handles privacy queries directly.
What we collect and why
When you fill in a contact form
We collect your name, email address, and whatever you write in the message. We use this to reply to your enquiry and, if a working relationship follows, to manage the engagement.
Lawful basis: legitimate interest in responding to business enquiries. If you choose not to proceed, we’ll delete your details on request.
How long we keep it: 24 months from your last contact, then we delete it. If the enquiry leads to an engagement, we retain it for the contract duration plus 6 years (UK accounting record requirements).
When you visit the site
If you consent via our cookie banner, we use Google Analytics 4 to count visits and understand which pages get read. With Consent Mode v2, this works in a privacy-respecting way: IP addresses are not stored, and visitor IDs are not linked to any other Google service.
If you decline cookies, no analytics cookies are set. Google may still receive a cookieless “ping” used only for aggregate, modelled statistics.
For a detailed list of cookies, see our Cookie Policy.
Lawful basis: consent (which you can withdraw at any time via the Manage Consent link in the footer).
How long: Google Analytics retains user-level data for 14 months. Modelled aggregates are retained indefinitely but cannot be tied back to you.
Server logs
Our web host records IP addresses and request data for security and diagnostic purposes. We don’t analyse these logs for marketing.
Lawful basis: legitimate interest in keeping the site secure and operational. How long: 30 days.
Who we share data with
We don’t sell or share your personal data with anyone for marketing purposes. The following third parties process data on our behalf:
- GoDaddy (web hosting and email) — UK/EU infrastructure.
- Google LLC (Analytics) — US, covered by the UK Extension to the EU-US Data Privacy Framework.
- Cloudflare, Inc. (CDN, security) — US, covered by the UK Extension to the EU-US Data Privacy Framework.
Each of these providers has its own privacy notice; we have data processing agreements in place where required.
Your rights
Under UK GDPR you can ask us to:
- tell you what personal data we hold about you;
- correct it if it’s wrong;
- delete it (subject to legal retention rules);
- limit how we use it;
- port it to another provider;
- object to processing based on legitimate interest.
Email colin.rees@xpera.co.uk with your request. We aim to respond within one calendar month, as required by law.
If you’re not satisfied with our response, you can complain to the Information Commissioner’s Office (the UK regulator) at ico.org.uk/concerns or on 0303 123 1113.
Children
This site is aimed at business audiences. We don’t knowingly collect data from anyone under 16.
Changes to this statement
If we update this Privacy Statement, we’ll change the date at the top. Substantive changes (new data uses, new processors) will be flagged on the homepage.