Privacy Policy
Last updated: 27th October 2026
LXA London (“we”, “us”, “our”) is committed to protecting your personal data. This policy explains what we collect when you use www.lxa.london, why we collect it, who we share it with and what rights you have.
We are the data controller for the personal data described in this policy.
LXA Projects Ltd
Registered in England and Wales, company number 07872806
15 Bell Yard Mews, London SE1 3TY
Telephone: +44 (0)203 980 9200
Email: lxa.london@wearelxa.com
Data protection enquiries: lxa.london@wearelxa.com
1. What this policy covers
This policy covers personal data we collect through this website, and personal data you give us by email or telephone in connection with it.
It does not cover other websites we link to. See section 12.
2. The personal data we collect
2.1 When you contact us through the website
Our contact form asks for:
Field | Required |
|---|---|
Name | Yes |
Email address | Yes |
Subject | Yes |
Message (up to 5,000 characters) | Yes |
Please do not include sensitive personal information in the message field. We only need enough to understand and respond to your enquiry.
2.2 When you contact us directly
If you email or telephone us we will hold your name, contact details and the contents of your correspondence.
2.3 When you simply visit the site
Our hosting and security providers process limited technical data automatically, including your IP address, browser type and version, device type, the pages you visit and the date and time of your visit. This is used to serve the site, keep it secure and protect it from automated abuse.
2.4 What we do not do
We do not use website analytics, advertising pixels, remarketing tags or session recording on this website. We do not sell personal data. We do not use automated decision making or profiling that produces legal or similarly significant effects.
3. Why we use your data, and our lawful basis
Under UK GDPR we must have a lawful basis for processing personal data. Ours are:
What we do | Why | Lawful basis |
|---|---|---|
Respond to your enquiry and correspond with you | To answer the question you asked us | Legitimate interests: responding to people who contact us. Where your enquiry concerns engaging our services, taking steps at your request prior to entering a contract |
Keep a record of enquiries and correspondence | To maintain an accurate business record and to evidence what was agreed | Legitimate interests: running our business and keeping proper records |
Serve the website, keep it available and secure, and block automated abuse | To protect the site and its users | Legitimate interests: network and information security |
Comply with legal and regulatory obligations | Where the law requires it | Legal obligation |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights. You can object to this processing at any time (see section 9).
We do not send marketing emails from data collected through this website. If that changes, we will ask for your consent first and every message will carry an unsubscribe link.
4. Cookies and similar technologies
This website does not use advertising or analytics cookies, and does not track you across other websites.
The following are set for the site to work and to keep it secure. These are “strictly necessary” and do not require your consent under the Privacy and Electronic Communications Regulations.
Cookie or technology | Set by | Purpose | Duration |
|---|---|---|---|
_cfuvid | Cloudflare | Distinguishes real visitors from automated traffic so rate limiting works correctly. Contains no personally identifying information | Session |
Cloudflare Turnstile | Cloudflare | Checks that the person submitting the contact form is not a bot. Replaces a CAPTCHA and does not track you across sites | Short lived, on form use |
Webflow session cookies | Webflow | Delivers the website and remembers basic state | Session |
If we add any non-essential cookies in future, we will ask for your consent through a banner before they are set, and you will be able to withdraw it.
You can block or delete cookies in your browser settings. Parts of the site may not work properly if you block strictly necessary cookies.
5. Who we share your data with
We do not sell or rent personal data. We share it only with the following, and only as far as necessary:
Recipient | Role | What for |
|---|---|---|
Webflow, Inc. | Processor | Website hosting and storage of contact form submissions |
Cloudflare, Inc. | Processor | Content delivery, security and bot protection |
Google LLC | Processor | Serving web fonts and JavaScript libraries. Your IP address is transmitted to Google in order to load these |
Mapbox, Inc. | Processor | Displaying the map on our contact page. Your IP address is transmitted to Mapbox in order to load it |
Microsoft 365 | Processor | Receiving and storing enquiry emails |
Brylliant Solutions | Processor | Building and maintaining the website |
Professional advisers, insurers, auditors | Controller or processor | Where needed for legal, accounting or insurance purposes |
Law enforcement, regulators, courts | Controller | Where we are required to disclose by law |
Each processor acts on our instructions under a written contract that meets Article 28 of the UK GDPR.
6. International transfers
Some of our providers are based outside the United Kingdom, including in the United States. Where personal data is transferred outside the UK we rely on one of the following:
- UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it
- The International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment
You can request details of the safeguards in place by contacting us.
7. How long we keep your data
Data | Retention |
|---|---|
Enquiries that do not lead to any engagement | 12 months from last contact, then deleted |
Enquiries and correspondence relating to a project or client relationship | For the duration of the relationship and 6 years afterwards, to match the limitation period for contract claims |
Technical and security logs | As set by our hosting and security providers, typically 30 days |
Where we no longer need personal data we delete it or anonymise it.
8. How we protect your data
We maintain appropriate technical and organisational measures, including encryption of the website in transit (HTTPS), access controls so that staff only see what they need, bot protection on our forms, and arrangements with providers who are contractually bound to keep data secure.
No transmission over the internet can be guaranteed completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours and, where the risk is high, tell you.
9. Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your data, which is the purpose of this policy
- Access a copy of the personal data we hold about you
- Rectification of data that is inaccurate or incomplete
- Erasure of your data in certain circumstances
- Restrict processing in certain circumstances
- Data portability, where processing is based on consent or contract and carried out by automated means
- Object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent at any time, where we rely on consent
To exercise any of these, contact lxa.london@wearelxa.com We will respond within one month. There is normally no charge. We may ask you to confirm your identity before we act.
10. Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right.
You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
11. Children
This website is aimed at businesses and professional clients. It is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe we have, contact us and we will delete it.
12. Links to other websites
This website contains links to other websites, including wearelxa.com, LinkedIn and Instagram. We have no control over those websites and we are not responsible for their content or for how they handle your personal data. This policy does not apply to them, and we recommend you read the privacy policy of any website before using it.
13. If our business changes hands
We may expand or reduce our business, and this may involve selling or transferring all or part of it. Where personal data you have provided is relevant to the part being transferred, it will be transferred with that part, and the new owner or newly controlling party will be permitted to use it for the purposes for which you originally supplied it, under the terms of this policy.
We may also disclose personal data to a prospective purchaser of our business or any part of it. In either case we will take steps with the aim of ensuring your privacy continues to be protected.
14. General
You may not transfer any of your rights under this policy to another person. We may transfer our rights under this policy where we reasonably believe your rights will not be affected.
If any court or competent authority finds that any provision of this policy, or part of a provision, is invalid, illegal or unenforceable, that provision or part will to the extent required be deemed deleted, and the validity and enforceability of the remainder will not be affected.
Unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a waiver of that, or any other, right or remedy.
This policy is governed by and interpreted according to the law of England and Wales. All disputes arising under it will be subject to the exclusive jurisdiction of the English and Welsh courts.
15. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. Where changes are significant we will say so on the website.