Privacy Policy

Last updated: September 2026

CXO & Co (“we”, “our”, or “us”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you visit www.cxoand.co (the “Website”).

This policy is designed to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

CXO & Co is responsible for your personal data.

Controller:
CXO & Co
17c Cliff Road
Newquay
Cornwall
TR7 2NE
United Kingdom

If you have questions about this Privacy Policy or how we handle your data, you can contact us at:

Email: lee@cxoand.co

2. The Data We Collect

We may collect and process the following categories of personal data:

Information you provide directly

When you fill out forms, register for events (including through Luma), book meetings, or contact us:

• Name
• Email address
• Phone number
• Company name
• Job title
• Any information you include in messages or enquiries

Automatically collected data

When you visit our website we may collect:

• IP address
• Browser type and version
• Device information
• Pages visited
• Time spent on pages
• Referral source

Marketing and communication data

• Preferences for receiving marketing communications
• Interaction with emails or marketing materials
• Records of consent to receive SMS messages and any opt-out request

3. How We Use Your Data

We use your personal data for the following purposes:

To provide our services

• Respond to enquiries
• Schedule meetings or consultations
• Deliver services requested

To operate and improve our website

• Analyse website performance
• Improve user experience
• Ensure website security

For marketing and business development

• Send newsletters or updates
• Provide information about services we believe may be relevant to your business

You may opt out of marketing communications at any time.

Event registration and SMS reminders

When you register for an event hosted or co-hosted by CXO & Co on a registration page that clearly identifies CXO & Co, including a page hosted by Luma, we may receive the registration information you provide, including your name, email address, phone number, company and job title, event details, and communication preferences. Any SMS consent is given directly to CXO & Co.

Mobile information, including mobile phone numbers, SMS opt-in data and consent, will not be shared with third parties or affiliates for marketing or promotional purposes.

If you provide your phone number and give clear, separate consent directly to CXO & Co to receive text messages, we may use it to send messages relating to the event, including registration confirmations, attendance reminders, venue or schedule updates, and other information reasonably necessary to manage your attendance. We rely on your consent for these SMS communications and keep a record of when and how that consent was obtained.

SMS privacy: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile information includes mobile phone numbers, SMS opt-in data, and consent. SMS opt-in data and consent will not be shared with any third parties. CXO & Co uses this information only for its own CXO & Co Event Communications program.

You can withdraw your consent at any time by replying STOP to an SMS or emailing lee@cxoand.co. Withdrawing consent will not affect the lawfulness of messages sent before withdrawal. We will stop SMS messages promptly and may retain minimal suppression information so that we can respect your opt-out.

Consent to SMS is not a condition of event registration. We will not use your SMS consent for unrelated marketing unless you have separately agreed to receive it.

4. Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases:

Legitimate Interest

For B2B communication, responding to enquiries, improving services, and marketing relevant services.

Consent

Where required (for example, event-related SMS communications, certain marketing communications, or cookies). You may withdraw consent at any time.

Contractual Necessity

When processing is necessary to fulfil a service requested by you.

5. How We Share Your Data

We do not sell personal data.

We may share non-mobile personal information with trusted service providers who help operate our business, including:

• CRM platforms
• Email service providers
• Event registration platforms, including Luma
• Website analytics providers
• Meeting scheduling tools
• Hosting providers

These providers are required to handle your data securely and only process it on our instructions.

Mobile information: The categories above exclude mobile phone numbers, SMS opt-in data, and SMS consent. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. SMS opt-in data and consent will not be shared with any third parties.

6. International Data Transfers

Some service providers we use may store or process data outside the UK.

Where this occurs, we ensure appropriate safeguards are in place, such as:

• UK adequacy regulations
• Standard Contractual Clauses
• Equivalent data protection measures

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy.

Typical retention periods may include:

• Enquiry data: up to 24 months
• Client records: for the duration of the business relationship and for legal/accounting requirements thereafter
• Event registration and SMS records: only for as long as needed to administer the event, address queries, demonstrate consent, comply with legal obligations, and establish, exercise, or defend legal claims; minimal suppression information may be retained to honour opt-outs

8. Your Data Protection Rights

Under UK GDPR, you have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing of your data
• Request restriction of processing
• Request transfer of your data to another organisation (data portability)

To exercise any of these rights, please contact us at lee@cxoand.co.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

9. Cookies

Our website may use cookies and similar technologies to improve functionality and analyse website traffic.

Cookies may include:

• Essential cookies for site operation
• Analytics cookies to understand how visitors use the website
• Marketing cookies where applicable

You can control cookie settings through your browser preferences.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data from loss, misuse, unauthorised access, disclosure, or alteration.

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page with the updated date.

If you have questions about this Privacy Policy, please contact lee@cxoand.co.