Privacy & Cookie Policy

Who we are

This website is operated by EXTHUS LTD (“eXthus”, “we”, “us”), company number 17253986, Registered in England and Wales, registered office 167-169 Great Portland Street, London, W1W 5PF. We are the data controller for personal data collected through this site.

For anything in this policy, including requests about your data, email hey@exthus.com.

What we collect

• Enquiry details — the name, email address, and optionally phone number, company name, topic and message you submit through our contact form.
• Technical data — your IP address and browser user agent, recorded with each enquiry and in standard server logs.
• Cookie preference — whether you accepted or declined non-essential cookies.

We do not ask for special category data, and we do not buy or sell personal data. We do not knowingly collect data from children.

Why we use it, and our legal basis

• Responding to your enquiry — necessary to take steps at your request before entering a contract, and our legitimate interest in answering people who contact us.
• Delivering services — performance of our contract where you become a client.
• Security and abuse prevention — our legitimate interest in protecting the site. IP addresses are used to rate-limit form submissions and block spam.
• Analytics and third-party content — only with your consent, given through the cookie banner and withdrawable at any time.

Cookies and similar technologies

We do not set any non-essential cookie, and we do not load any non-essential third-party script, until you choose Accept all. Choosing Essential only leaves those scripts inert — they are never downloaded or executed.

Essential cookies do not require consent under the Privacy and Electronic Communications Regulations, because the site cannot function securely without them.

With your consent

• Analytics — we currently run no analytics or advertising scripts on this site. If we add measurement tooling, it will load only after you accept, and this policy will be updated before it goes live.
• Third-party content — reviewer profile photos in our Google Reviews panel are served by Google. They load only after you accept; otherwise we show initials instead.

Always loaded

Typefaces are served by Google Fonts, which is required to render the site as designed. Google may receive your IP address as part of that request. No cookies are set by this.

You can change or withdraw your choice at any time: reopen cookie settings. You can also clear cookies through your browser settings.

Who we share it with

We share personal data only with providers that help us run the business, and only as far as they need it: our hosting and email infrastructure, and our accounting and professional advisers. They act on our instructions and are bound by confidentiality. We will also disclose data where we are legally required to.

Where it is stored

Enquiry data is stored on our managed infrastructure. Where any provider processes data outside the UK or EEA, that transfer is covered by appropriate safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses.

How long we keep it

Enquiries that do not become projects are kept for up to 24 months from your last contact, then deleted. Client records are kept for the duration of the relationship and for six years afterwards where we need them for tax and legal purposes. Server logs are rotated regularly.

Your rights

Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting anything done beforehand.

Email hey@exthus.com and we will respond within one month. If you are not satisfied with our response you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes to this policy

We update this page when our practices change. The date at the top always reflects the current version. If we introduce anything that materially changes how we use your data, we will ask for consent again.