Privacy policy.

Last updated: 16 October 2026.

Who we are and when this notice applies

Kiexus Digital is operated by Luke Barry in Reigate, Surrey, United Kingdom. Contact hello@kiexusdigital.com or +44 7879 991124 about this privacy notice. This notice covers our own business enquiries, consultancy relationships, website visits and the personal information we decide to use for running Kiexus Digital.

When carrying out an AI audit for a client, that client will often decide the purpose and permitted use of its employees' or customers' personal data and act as controller. If we process that data only on the client's documented instructions, Kiexus Digital acts as its processor. The specific roles, permitted activities, tools and safeguards must be agreed in writing for the project. Other arrangements may apply where the actual decision-making differs.

Information we may receive

Depending on your relationship with us, this may include your name, job title, employer, business email or phone number, correspondence, invoices, business requirements, existing technology and information needed to plan and deliver agreed work.

For an AI opportunity audit, agreed activities may include stakeholder interviews, workflow diagrams, task descriptions, process timings, notes about business systems, and samples of business documents. Such materials can sometimes contain personal information about employees, customers or other people. We seek to use anonymous, aggregated or redacted examples wherever practical and ask clients not to provide unnecessary sensitive material.

We do not routinely require health information, identity documents or other special-category personal data for an initial AI opportunity audit. If such information is genuinely necessary, the client and Kiexus must agree the appropriate lawful basis, safeguards, access and scope before it is provided. Interviews are not automatically recorded; any recording must be separately agreed with appropriate information provided to participants.

The public website currently provides email and telephone contact links rather than a database-backed lead form. Opening one of those links does not itself transmit the contents of a message to us. We receive the information when you send the email or call.

Why we use personal information and our lawful bases

• Answer enquiries and prepare audit or website proposals: business contact details and correspondence, normally on the basis of legitimate interests in responding to business enquiries or steps towards a contract where applicable.
• Deliver agreed consultancy, training, web or digital services: contact and project information, for contractual performance where the data subject is a party to the contract and/or legitimate interests where we work with representatives of business clients.
• Process client-provided staff or customer information solely for an audit: under the client's documented instructions where we are a processor; the client determines and explains the appropriate lawful basis for its own processing.
• Operate the business, secure systems, maintain records and handle complaints: relevant correspondence, audit trails and billing information, under legitimate interests and legal obligations where applicable.
• Optional website analytics: usage and online identifiers only after consent to Google Analytics.

Your right to object: when our processing is based on legitimate interests, you may object in the circumstances provided by UK data-protection law. Contact us using the details above.

Client interviews, confidentiality and AI tools

Before reviewing confidential client information, the engagement should define which staff and systems we may access, whether personal data is necessary, what can be copied or retained, and whether any external AI system is authorised. We do not treat an audit request as permission to place client records or interview notes into publicly available AI tools. Any use of an AI or transcription provider with identifiable client data needs an agreed purpose, suitable contractual and security checks, and any required international transfer safeguards.

We provide an operational opportunity assessment, not automated employee performance scoring. Our website does not make solely automated decisions producing legal or similarly significant effects for individuals. If a future client project proposes such uses, its privacy risks and applicable safeguards must be assessed separately before deployment.

Sharing, service providers and international transfers

We may use hosting, email, communications, secure document, accounting and analytics providers to deliver our own services. Client-appointed or agreed technology and specialist consultants may be involved in a project under a suitable written arrangement. We do not sell personal information.

Where relevant personal data is accessed or stored outside the UK, we assess whether applicable UK transfer rules and safeguards are required before using the provider. A list of the material processors and AI tools for a particular client engagement should be identified in the written project scope or data-processing agreement, rather than assumed from this website notice.

How long information is kept

We keep information only for as long as needed for the stated purpose, taking into account contractual instructions and legal requirements. Unsuccessful business enquiries are normally reviewed for deletion within 12 months of the last meaningful correspondence. For audit working notes or files containing client personal data, retention, secure return or deletion must be agreed with the client; if not otherwise required or agreed, our operational target is to review and securely delete those working copies within 90 days after delivery and handover. Records needed for contracts, accounting, disputes or legal obligations may be kept longer as necessary.

These periods depend on following our documented handling and deletion procedures; the public website itself does not automatically delete emails or client project files. Clients can request a documented return or deletion step when their engagement ends.

Website analytics and cookies

Google Analytics measurement is optional. The GA4 tag is not loaded until you accept analytics. Analytics helps us understand page visits and interactions with business contact links. We do not intentionally send names, phone numbers, email addresses or interview material to GA4. You can change your choice through “Cookie settings” in the footer. See our Cookie Policy.

Your rights and staff privacy information

Depending on the circumstances, you may have the right to access, correct or erase your information, to restrict or object to processing, and to data portability. You can withdraw consent where processing relies on consent, without affecting prior lawful use. You may contact Kiexus directly about information for which we are controller.

If your information is held by an employer or business client and Kiexus processes it only on the client's instructions, please contact that organisation in the first instance. We assist the controller with rights requests as required by our agreement. Client organisations should ensure their workers and others receive suitable privacy information before an AI audit involves their personal data; this Kiexus website notice does not replace the client's own notice.

Security and concerns

Access to audit material should be limited to authorised people and systems, with appropriate protective measures chosen for the sensitivity of the information. Please do not send confidential or sensitive files to our general contact email without first agreeing a secure way to share them.

For a privacy question, complaint or rights request, email hello@kiexusdigital.com. You can also complain to the UK Information Commissioner’s Office (ICO): ico.org.uk.

Updates

We review this notice when our services, systems or information handling change. Any materially new use of personal data requires appropriate information to be provided before that use begins.