Legal
Privacy policy
Draft for review. This document is a starting draft and has not yet been reviewed by legal counsel. It should be reviewed by a Jersey-qualified solicitor before publication. Remove this notice once reviewed.
Last updated: July 2026
Who we are
GXPOL ("we", "us") is incorporated in Jersey, Channel Islands. We are the data controller for personal data described in this policy. For any privacy question, contact privacy@gxpol.com.
What we collect
Information you give us
Your name, work email, organisation and the content of your enquiry when you contact us or request access. If you send holdings or a benchmark for an exposure report, we process that information to produce the report.
Account information
For clients: the access key issued to you, and logs of API usage associated with it (endpoint, time, volume) for security, billing and service reliability.
Site analytics
If you consent, privacy-first, cookieless analytics recording which pages are read. No cross-site tracking, no advertising identifiers, no profiling. If you decline, nothing is collected.
What we do not do
We do not sell personal data. We do not share it with advertisers. We do not use it to build marketing profiles. We do not use client portfolio information for any purpose other than producing the analysis requested.
Lawful basis
We process enquiry and client data on the basis of legitimate interests (responding to you, providing the service you asked for) and, where a contract exists, performance of that contract. Analytics is processed on the basis of your consent, which you may withdraw at any time.
Retention
Enquiry correspondence is retained for as long as needed to deal with your enquiry and for a reasonable period thereafter. Client records are retained for the duration of the relationship and for the period required by applicable law and regulation. Holdings data submitted for an exposure report is deleted on request and is not retained beyond the production of the report unless you ask us to keep it.
Your rights
Depending on your location, you may have the right to access, correct, erase, restrict or object to our processing of your personal data, and to data portability. To exercise any of these, email privacy@gxpol.com. You also have the right to complain to the Jersey Office of the Information Commissioner, or to your local supervisory authority.
Transfers and processors
We use third-party infrastructure providers to host and deliver the service, which may process data outside Jersey. Where they do, appropriate safeguards are in place. A current list of processors is available on request.
Changes
We will update this policy when our practices change and will change the date above. Material changes will be notified to clients directly.