Legal

Privacy Policy

How we collect, use, and protect your personal data. Last updated: March 2026.

Data Controller: IMBRAND LTD trading as Lexl. Registered in England and Wales. ICO Registration: C1893446. Contact: hello@lexl.co.uk

1. What data we collect

We collect personal data in the following ways:

  • Contact forms and email: Name, email address, and any information you include in your message.
  • Checklist and tools: Email address when you request a review or sign up for resources.
  • Booking: Name, email, and any details provided when booking a session via Calendly.
  • Payment: Payment is processed by Stripe. We do not store card details. We receive confirmation of payment and the associated email address.
  • WhatsApp: If you contact us via WhatsApp, your phone number and message content are processed.

2. Legal basis for processing

  • Contract: Processing your enquiry and delivering services you have engaged us to provide.
  • Legitimate interests: Responding to enquiries, following up after sessions, and sending relevant compliance updates. You can opt out at any time.
  • Legal obligation: Where we are required to process data to comply with applicable law.

3. How we use your data

  • To respond to your enquiry and assess your compliance situation
  • To deliver services you have engaged Lexl to provide
  • To send follow-up communications after a session or enquiry
  • To send compliance updates and resources relevant to your situation (you can unsubscribe at any time)
  • To maintain records of our engagement as required for legal and professional purposes

4. Third-party processors

We use the following third-party services to operate Lexl. Each is subject to their own privacy policy and, where required, we have Data Processing Agreements in place:

  • Netlify — website hosting (USA, adequacy decision applies)
  • Brevo (Sendinblue) — email communications (EU)
  • Calendly — session booking (USA, adequacy decision applies)
  • Stripe — payment processing (USA/EU)
  • Meta (WhatsApp Business API) — direct messaging
  • n8n — workflow automation (EU cloud)
  • Notion — internal case management

5. Data retention

We retain client data for 6 years after the end of an engagement, in line with the UK Limitation Act 1980. Enquiry data where no engagement follows is deleted after 12 months. You can request deletion at any time — see section 6.

6. Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data (subject to legal retention obligations)
  • Object to processing based on legitimate interests
  • Request restriction of processing
  • Data portability where processing is automated and based on consent or contract
  • Lodge a complaint with the ICO at ico.org.uk

To exercise any of these rights, email hello@lexl.co.uk. We will respond within 30 days.

7. Cookies

This website does not use tracking cookies. We use no analytics that collect personal data. Google Fonts is loaded from Google's CDN — their privacy policy applies to that connection.

8. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to active clients by email. The current version is always at lexl.co.uk/privacy/.

9. Contact

IMBRAND LTD trading as Lexl
Durham County, England
Email: hello@lexl.co.uk
WhatsApp: +44 7427 019737
ICO Registration: C1893446