This policy explains what personal information we collect through kxco.ai, why we collect it, who we share it with, how long we keep it, and the rights you have under the UK GDPR and the Data Protection Act 2018.
KXCO is a software company operating as part of Knightsbridge Group, incorporated in the United Kingdom and the United States. We build and license trust and infrastructure software for licensed institutions, businesses and developers. We do not hold client assets, provide regulated financial services, or act as a custodian.
For the personal information handled through this website, the data controller is:
This policy covers the public KXCO website at kxco.ai and its informational subdomains. Some KXCO products and platforms — for example our signing, identity, wallet and network services — operate under their own terms and privacy notices, and where an institution deploys KXCO software to serve its own customers, that institution is the controller for its users' data, not KXCO. This policy does not cover third-party websites we link to.
When you use our contact or briefing form, or email us, we collect the details you choose to provide — typically your name, email address, company/organisation, and the content of your message. We only collect what you voluntarily submit; we do not require any information beyond what is needed to respond.
When you visit the site, our hosting and content-delivery layer records standard technical data for security and reliability: IP address, browser and device type, referring page, the pages you view, and timestamps. Our analytics tool records pseudonymous usage events and an approximate (city/region-level) location derived from your IP address.
We use Google Analytics (Google gtag) to understand how the site is used and to improve it. Google Analytics sets first- and third-party cookies and processes a pseudonymous identifier and approximate location. We do not use advertising, retargeting or cross-site tracking cookies, and we do not sell any data.
You can block or delete cookies in your browser settings, and you can opt out of Google Analytics using Google's browser opt-out add-on. Blocking analytics cookies does not affect your ability to use the site.
Under the UK GDPR we must have a lawful basis for each use of your personal information:
| What we do | Why | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Respond to your enquiry or briefing request | To answer you and, where relevant, discuss working together | Legitimate interests (6(1)(f)); steps prior to a contract (6(1)(b)) |
| Site analytics & improvement | To understand usage and improve the site | Legitimate interests (6(1)(f)) |
| Security, logging & abuse prevention | To keep the site available and secure | Legitimate interests (6(1)(f)) |
| Meeting legal & regulatory obligations | Where the law requires us to retain or disclose data | Legal obligation (6(1)(c)) |
We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects, and we do not sell, rent or trade personal data.
We share personal information only with service providers ("processors") who help us run the site, and only as needed to provide their service. These currently include:
| Provider | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, CDN, DNS & security | United States |
| Google LLC | Google Analytics | United States |
| DigitalOcean, LLC | Contact-record database & related KXCO infrastructure | United States |
We may also disclose information if required by law, court order or a regulator, or to protect our legal rights. If our business is reorganised, personal data may transfer as part of that process, subject to this policy.
Some of our providers are based in the United States, so your information may be transferred outside the UK/EEA. Where it is, we rely on appropriate safeguards recognised under UK data protection law — such as the UK's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the provider's own data-protection commitments.
Enquiry and contact-form submissions are kept for as long as needed to deal with your request, and are deleted within 12 months unless you enter into a commercial relationship with us (in which case relevant records are kept for the duration of that relationship and any period required by law). Technical logs and analytics data are retained for shorter periods in line with our providers' defaults.
All traffic to kxco.ai is encrypted in transit using modern TLS. We apply access controls and rely on reputable infrastructure providers with their own security programmes. No method of transmission or storage is completely secure, but we take reasonable technical and organisational measures to protect your information and to detect and respond to incidents.
If you are in the UK or EEA, you have the right to:
To exercise any of these rights, contact us at kxco.ai/contact. We will respond within one month. Exercising your rights is free, and we will not treat you differently for doing so.
You also have the right to complain to the UK's supervisory authority, the Information Commissioner's Office (ICO), though we would appreciate the chance to address your concern first:
This website is intended for businesses and professional users and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with data, contact us and we will delete it.
We may update this policy from time to time. The "last updated" date at the top reflects the latest revision. Material changes will be posted on this page; continued use of kxco.ai after an update constitutes acceptance of the revised policy.
For any privacy question, or to exercise your rights, reach us here:
This notice is provided for transparency and is not legal advice. If you rely on it for compliance, have it reviewed by a qualified data-protection adviser against your current processing and entity details.