Privacy Policy

Effective: 12 October 2026

OVERXXI LTD (company number 17514130), registered in England and Wales, with its registered office at 2B Thorpe Crescent, Walthamstow, E17 5BY, United Kingdom, provides OVERXXI Gate Pro, a connected web and Android workspace for gate, access and automation businesses. This policy explains how information is handled when you use our public website, authenticated workspace, mobile application and related support.

Information we process

• Account and organization information, such as names, business contact details, roles, authentication records and tenant membership.
• Project and operational information, including customer/site records, surveys, measurements, notes, configurations, quotations and catalogue data entered by authorized users.
• Photos and files selected or captured by authorized users for surveys, field-change reports, catalogue work, quotation output or optional AI-assisted review.
• Technical and security information needed to operate and protect the service, such as request metadata, device/app version, audit events, error information and security logs.
• Support communications and feedback you choose to send us.

How we use information

We use information to provide and secure the service; authenticate users; keep customer workspaces separated; process surveys, configurations and quotations; provide requested support; prevent abuse; maintain backups; and improve reliability. We do not sell personal information and the app does not display third-party advertising.

Controller, processor and customer responsibilities

OVERXXI LTD is the controller for information used to operate its website, administer accounts, manage subscriptions, provide support, protect the service and meet legal obligations. When a business customer enters personal information about its own customers, workers or contacts into an organisation workspace, that business generally determines why the information is used and acts as controller, while OVERXXI LTD acts as processor under the applicable subscription agreement and Data Processing Agreement. The exact allocation depends on the facts and applicable law.

Organisation administrators decide which authorised workers can access a workspace and are responsible for ensuring that uploaded information is lawful, relevant and accurate. Users should follow employer instructions and avoid entering unrelated personal information. OVERXXI may process limited account, billing, security and support information as an independent controller even when it processes project content on the customer’s documented instructions.

Purposes and lawful bases

We process account identifiers, organisation membership and requested project operations because they are necessary to perform a contract or take requested steps before a contract. We process billing records to perform the subscription agreement and comply with accounting and tax duties. We use security logs, fraud indicators, service diagnostics and limited product metrics for our legitimate interests in operating a reliable and secure service, provided those interests are not overridden by individual rights.

Where the law requires consent, including optional public-site analytics and certain device permissions, we request it separately and allow withdrawal. We process information needed to comply with legal obligations, respond to lawful authority requests and establish or defend legal claims. We do not rely on consent when another lawful basis is more appropriate merely to make withdrawal difficult.

Camera, photos and files

The Android app requests camera or photo access only when you choose a feature that needs it. Selected content may be uploaded to the relevant organization workspace. You can cancel selection and manage device permissions in Android settings. Do not upload content unless your organization is authorized to process it.

AI-assisted features

When an authorized user requests an AI-assisted survey or photo review, the relevant submitted content may be sent to our contracted AI service provider for that request. AI output is advisory and does not replace human technical, safety or compliance decisions. Review Intelligence provider publishing and automatic publication are not enabled.

Service providers and disclosures

We use service providers for infrastructure, storage, security, email delivery, AI processing and application distribution. Information is shared only as needed to provide those functions, comply with law, protect users and the service, or complete a business transaction subject to appropriate safeguards. Optional Google mailbox connection uses Google authorization and the permissions shown during consent.

Provider categories may include hosting and database operators, payment processors, transactional email services, monitoring and security suppliers, Google services selected by the user, application distribution platforms and contracted AI providers used only for a requested feature. A current subprocessor list will identify material processors before paid customer processing begins. Payment card data entered into Stripe is handled by Stripe under its own payment-security responsibilities; OVERXXI does not require customers to send full card details by email.

Business-to-business marketing

OVERXXI may contact a limited company, limited liability partnership or other verified corporate organisation about OVERXXI Gate Pro when the message is relevant to its gate, access-control or automation activities. A contact record may include the organisation name, corporate status, company number, generic business email address, a named professional contact and role, the public source from which the details were obtained, the date collected, campaign history and marketing preference. Sources may include the organisation’s own website, Companies House, a professional directory, an event, a referral, a direct enquiry or an affirmative subscription.

Where a named business contact or personally identifying work address is used, the lawful basis is normally our legitimate interest in proportionate and relevant communication with incorporated businesses, after applying a necessity and balancing assessment. Each message identifies OVERXXI LTD, explains why the recipient was selected, links to this policy and provides a simple method to object. We do not rely on legitimate interests to override the electronic-marketing rules that protect individuals, sole traders, certain partnerships and other individual subscribers. We do not send unsolicited electronic marketing to those recipients unless valid consent or a properly documented soft opt-in applies.

You may object to direct marketing at any time by replying “Unsubscribe” or emailing privacy@overxxi.com with the subject “Unsubscribe”. The objection is applied to active campaigns and the address is placed on a restricted suppression list. We retain the minimum information needed to prevent the address from being imported or contacted again; the suppression record is not used to restart marketing. Initial outreach does not use hidden tracking pixels or read receipts. Prospect records are reviewed periodically and removed when they are no longer accurate, relevant or necessary.

Retention and security

We retain information for the period needed to provide the service, meet contractual and legal obligations, resolve disputes, maintain security and operate documented backups. Retention can vary by data type and customer relationship. We use tenant-scoped access, role-based controls, encrypted transport, restricted credentials, audit records and protected backups. No method of storage or transmission is completely risk-free.

Account and subscription records may be retained for the active relationship and a reasonable period afterwards for financial, contractual and legal claims. Operational workspace content is retained according to the customer agreement, deletion request and backup cycle. Security logs are retained according to documented incident-response needs. Support correspondence is kept long enough to resolve and evidence the request. Records required by tax, accounting or company law may be retained for the statutory period even after an account closes.

When deletion is due, information is removed from active systems or rendered inaccessible according to the applicable workflow. Backup copies may remain until scheduled rotation and are protected from ordinary use. If restoration is required for disaster recovery, deletion controls are reapplied. We may preserve narrowly scoped information where necessary to prevent fraud, record an objection or comply with a legal hold.

Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict or receive a copy of personal information, or object to certain processing. Organization-managed data may need to be requested through your employer or workspace administrator. Contact us to make a privacy request; we may need to verify your identity and authority.

See our data deletion request instructions for the steps, scope and expected timing.

You may withdraw consent without affecting processing that occurred before withdrawal. You may object to direct marketing at any time and we will retain only the minimum suppression information needed to respect that choice. Where processing is based on legitimate interests, you may object based on your circumstances. Rights are not absolute; if an exception applies, we will explain the relevant reason unless the law prevents us from doing so.

Cookies and public-site analytics

The public website uses essential browser storage to remember language and privacy preferences. Google Analytics is optional and is not loaded until the visitor accepts it through the cookie controls. Rejecting analytics does not restrict access to public content. The permanent Cookie settings control allows a visitor to change the choice later. Technical server logs used for security and reliability are separate from optional browser analytics.

Our Cookie and Local Storage Policy identifies the storage keys, purposes, provider, expected duration and withdrawal process. Browser blockers may prevent optional analytics even after acceptance, and we do not attempt to circumvent those controls.

Children

OVERXXI Gate Pro is a business service and is not directed to children.

International processing

Service providers may process information in countries other than your own. Where required, we use appropriate contractual or legal safeguards for international transfers.

Depending on the destination and relationship, safeguards may include an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, contractual security requirements and a documented transfer risk assessment. We review the nature of the information, destination, provider controls and available remedies. Customers should contact privacy@overxxi.com if they require relevant transfer information for their own compliance assessment.

Automated processing and AI assistance

OVERXXI Gate Pro may generate suggested explanations, summaries or review observations when an authorised user requests an AI-assisted feature. These outputs are advisory. The platform is designed to keep pricing, tax, catalogue facts, compatibility rules and final technical decisions under deterministic controls and human responsibility. Review Intelligence automatic publication remains disabled.

We do not use public-site analytics or requested AI assistance to make solely automated decisions producing legal or similarly significant effects about an individual. A competent person must review technical and safety decisions. If future functionality materially changes this position, we will update the relevant notice and controls before relying on it.

Complaints and supervisory authority

Please contact privacy@overxxi.com first if you believe information has been handled incorrectly. Include enough detail to locate the relevant account or event, but do not email passwords, secret keys or full payment card information. We will acknowledge and investigate the concern, involve the relevant customer controller where appropriate and explain the outcome subject to security and third-party rights.

You also have the right to complain to the UK Information Commissioner’s Office. Its current contact and complaint information is available at ico.org.uk/make-a-complaint/. If you are located elsewhere, a local supervisory authority may also be available. Contacting OVERXXI first does not remove the right to approach a regulator.

Changes to this policy

We may update this policy when the service or applicable requirements change. We will publish the revised date on this page and provide additional notice where required.

Contact

For privacy questions or requests, email privacy@overxxi.com.