‍Privacy Policy

Last updated: 23 July 2026

1. Introduction

‍Exo Engineering Int. Ltd (“Exo Engineering”, “we”, “us”, “our”) is committed to protecting the privacy of everyone who contacts us, works with us, or visits our websites. This policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it. ‍

This policy applies to our websites, exo-engineering.co.uk and livingwindfarms.com, and to the personal data we collect through enquiries, project delivery, recruitment, and related business activities. It does not cover Exo Environmental Ltd, which is a separate legal entity with its own privacy arrangements.

livingwindfarms.com is a project showcase site. It does not currently collect personal data directly, any enquiries made through it are directed to our main contact channels on exo-engineering.co.uk, so the practices described in this policy apply there too.

This policy should be read alongside our Cookie Policy, which explains in more detail how we use cookies and similar technologies on our websites.

2. Who we are

Exo Engineering Int. Ltd is the data controller responsible for your personal data.

  • Company Name: Exo Engineering Int. Ltd

  • Company Number: 13949988

  • Registered Office: The Enterprise Centre, University of East Anglia, Norwich Research Park, Norwich, Norfolk, NR4 7TJ, United Kingdom

  • Contact (Data Protection Lead): william@exo-engineering.co.uk

If you have any questions about this policy or how we handle your personal data, please contact our Data Protection Lead using the details above.

3. The personal data we collect

We collect personal data in the following ways:

3.1 Enquiries

When you contact us by phone, email, or through the contact form on our website, we collect details such as your name, email address, phone number, company name, job title, and the content of your enquiry. This information is stored in our customer relationship management (CRM) system, HubSpot.

3.2 Clients and projects

Once an enquiry becomes a project, we collect and hold further information necessary to deliver our services, including contact details, correspondence, and project related documentation. Project records are stored on our internal systems, Microsoft 365 and our Synology Drive server.

3.3 Marketing preferences

If you contact us for a reason relevant to our services, we will normally add you to our newsletter and marketing mailing list, on the basis that you would reasonably expect to hear from us. You can opt out of marketing emails at any time (see Section 5).

3.4 Job applicants

If you apply for a role with us, whether through our careers page or by emailing your CV directly, we collect the personal data contained in your application, such as your name, contact details, employment history, qualifications, and any other information you choose to share with us.

3.5 Invoicing and accounts

If you become a client, we collect billing details, such as name, company, and address, in order to raise and manage invoices through our accounting software, Xero.

3.6 Website usage data

We use cookies and similar technologies to understand how our websites are used. Full details are set out in our separate Cookie Policy.

4. How we use your personal data, and our lawful basis

Under UK data protection law, we must have a valid legal basis to use your personal data. The table below sets out our main purposes and the lawful basis we rely on for each.

5. Marketing communications

Where you have contacted Exo Engineering about a matter relevant to our services, we will normally add you to our email marketing list without asking you to separately opt in first. This reflects the “soft opt-in” allowed under UK electronic marketing rules for existing business contacts.

Every marketing email we send includes an unsubscribe link and access to your marketing preferences, and you're welcome to opt out at any time. Opting out of marketing does not affect service related communications, such as messages about an ongoing project.

6. Who we share your data with

We share personal data with a small number of trusted third parties who help us run our business, including:

  • HubSpot, our CRM and email marketing platform, used to store enquiry and contact data and to send marketing emails

  • Xero, our accounting software, used to manage invoicing

  • Microsoft 365, used for day to day document storage and communication

  • Synology Drive, our internal server, used to store project records

  • WeTransfer, used occasionally to transfer larger files

  • Google Analytics and Squarespace Analytics, used to understand website usage (see our Cookie Policy)

  • Google Ads, used for online advertising (see our Cookie Policy)

We do not sell your personal data to third parties. We may also share personal data with subcontractors or partner organisations where necessary to deliver a specific project, and with regulators, law enforcement, or professional advisers where we are legally required to do so.

7. International data transfers

Some of the providers we use, including HubSpot, Microsoft, Google, and Squarespace, may store or process personal data outside the United Kingdom, including in the United States. Where this happens, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Addendum or Standard Contractual Clauses, so that your data continues to receive a level of protection consistent with UK data protection law.

“Int.” in our company name reflects our company name only. Exo Engineering is a UK-registered company with UK-based operations, though we work with clients on projects internationally.

8. How long we keep your data

We keep personal data for as long as it is needed for the purposes described in this policy. Since our record-keeping needs vary by type of data, our approach is as follows:

  • Enquiry and contact data held in HubSpot is generally retained until you ask us to delete it, or until we no longer have a legitimate reason to hold it.

  • Project and client records held on Microsoft 365 and our Synology Drive server are reviewed periodically, and are typically deleted after around 4 years of inactivity, where we no longer have a business need to retain them.

  • Job applicant data is kept only for as long as necessary to assess your application, and for a reasonable period afterwards, and is reviewed periodically, unless you ask us to keep your details on file for future opportunities.

  • Invoicing and accounting records are kept for at least 6 years, in line with UK HMRC requirements for financial records.

9. Keeping your data secure

We take the security of personal data seriously, and maintain technical and organisational measures designed to protect the confidentiality, integrity, and availability of the information we hold, including access controls, staff training, and defined procedures for responding to and learning from security incidents.

While we take reasonable steps to protect your data, no system can be guaranteed completely secure, and we ask that you also take care when sharing personal data with us, for example by email.

10. Automated decision-making

We do not use automated decision-making or profiling that produces legal effects, or similarly significant effects, concerning you.

11. Children

Our websites and services are directed at businesses and professionals, and are not intended for children. We do not knowingly collect personal data from children.

12. Your rights

Under UK data protection law, you have the right to:

  • Access the personal data we hold about you

  • Request correction of inaccurate or incomplete data

  • Request erasure of your data in certain circumstances

  • Request that we restrict our processing of your data in certain circumstances

  • Object to processing based on legitimate interests, including direct marketing

  • Request a copy of your data in a portable format, where technically feasible

  • Withdraw consent at any time, where we rely on consent, for example for cookies

To exercise any of these rights, please contact our Data Protection Lead using the details in Section 2. We will respond within one month, as required by law.

13. Complaints

If you're unhappy with how we've handled your personal data, we'd welcome the chance to put things right, please contact us in the first instance. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

Website: ico.org.uk

Telephone: 0303 123 1113

14. Changes to this policy

We review this policy at least once a year, and will update it sooner if needed to reflect changes in our practices or legal requirements. The date at the top of this policy shows when it was last updated.