Privacy policy

1. Who we are and how to contact us

Britixo Software Solutions UK Ltd. (Britixo, we, us or our) is registered in England and Wales under company number 17170769. Our registered office and mailing address is Unit 5-6 Titford Lane, Rowley Regis, B65 0PY, United Kingdom.

For privacy questions, individual rights requests or a data-protection complaint, contact our privacy team through the privacy contact form, telephone 0330 190 1979, or write to the address above. You can also email: .

You do not need a paid account to make a privacy request. Tell us which service or interaction your request concerns. Please do not send passwords, verification codes, full card numbers or unnecessary identity documents; we will explain a secure verification route if needed.

2. What this policy covers

This policy explains how we handle personal information relating to website visitors, prospective and existing customers, individual consumers, business contacts, authorised account users, suppliers, and people whose information is processed through our services. It covers britixo.com and connected Britixo account, enquiry, billing and support services, including services delivered through our connected britixo.co.uk and proplix.co.uk platforms.

Our services include consultancy; bespoke software, websites and mobile applications; SaaS, CRM, practice-management and other business modules; APIs, integrations and automation; AI features; managed IT and remote support; cybersecurity; hosting, servers, cloud, email, domains and recovery; VoIP, PBX and communications; and payment and subscription administration. The information involved depends on the service and features you actually use. Describing a category here does not mean we collect it from every person.

More specific notices explain particular products or collection points. Read the Britixo VoIP Android privacy policy for app permissions and device behaviour, the VoIP account-deletion page, and our cookie policy. Those notices supplement this one; statutory rights always remain available. Recruitment or employment processing requires its own relevant information and is not described in detail here.

This is a privacy notice, not consent to every use of your information. Reading it, contacting us or accepting our service terms does not by itself authorise marketing, optional tracking or a new use requiring separate consent.

3. Our role and your organisation's role

We act as a controller when we decide why and how to use information for our own business: for example enquiries, our customer relationship, account administration, billing, service security and legal compliance.

Where a customer decides the purpose of information stored in its CRM, hosted application, telephone system, support environment or other service, that customer is normally the controller and Britixo acts as its processor under the agreed instructions and data-processing terms. A customer may itself be a processor, making Britixo a subprocessor. Providing infrastructure or an API does not automatically make every party's role the same.

Your employer, workspace owner or other organisation may manage your access and decide which business records, communications and reports its authorised administrators can see. Ask it for its own privacy notice. We handle requests about data we control and help route or assist with requests concerning customer-controlled data; we do not treat an administrator's instructions as removing an individual's legal rights.

Payment providers, banks, telecoms networks and other suppliers can act as processors for some activities and independent controllers for their own regulatory, security or service purposes. Our responsibility for our own processing remains with Britixo.

4. Information we collect and receive

• Identity and contact information: names, business roles, organisation, contact addresses, email addresses, telephone numbers and communication preferences.
• Account and access information: customer and workspace identifiers, teammates, roles, permissions, authentication and verification events, session identifiers, authorised device details and changes to account access.
• Commercial and payment information: enquiries, quotes, orders, contracts, billing addresses, tax details where relevant, invoices, payment status, amounts, currency, transaction references, refunds, subscription records and dispute correspondence. Section 8 explains payment methods in more detail.
• Service content: information you or an authorised customer provide through files, databases, CRM records, projects, messages, forms, support tickets, integrations and other configured features.
• Communications information: callers and recipients, numbers and extensions, routing and call-event records, message delivery information, and audio, voicemail, recordings or transcripts where the relevant service actually processes them.
• Technical and security information: IP addresses, access times, requested pages, browser and device details, operating-system or app versions, configuration, error and diagnostic records, resource usage and security events.
• Preferences and interaction information: consent choices, unsubscribe or objection records, website interactions when the relevant optional tools are enabled, and feedback or correspondence you provide.

Information can identify you directly, or become personal information when linked to an account or another identifier. Information that is genuinely anonymised is different; removing a name alone does not necessarily make a record anonymous.

5. Where information comes from

We receive information directly when you browse, enquire, register, use a service, make a payment, communicate with us or provide support material. Technical information is generated by the devices and services used for those interactions.

We also receive relevant information from your organisation and its authorised administrators; people who invite you to a workspace or communicate with you; customer systems you connect; payment and banking services reporting transactions; communications networks; and providers handling delivery, hosting, security or support. Customer imports can contain information about their staff, clients or other contacts who have not contacted Britixo themselves.

Where needed to verify a business or understand an enquiry, we may consult public business sources, such as the organisation's website or Companies House. We will explain the source relevant to your information on request, subject to lawful restrictions. Where we obtain information indirectly and are responsible for giving you a notice, we provide it within the applicable legal timeframe, normally within one month or earlier when first contacting you or disclosing it.

6. Why we use information and our lawful bases

Under UK data-protection law, each purpose needs a lawful basis. Contract applies where processing is necessary for a contract with you personally, or steps you ask us to take before entering one. For an employee or representative of a business customer, we normally rely on the relevant legitimate interests, rather than treating that person's employer's contract as their own.

For legitimate interests, we assess whether the use is necessary and proportionate and balance it against your rights, reasonable expectations and likely impact. We do not rely on a business interest as a substitute for consent where the law requires consent. You can ask us to explain the basis for a particular use.

For data processed solely on a customer's instructions, the customer identifies its lawful basis and any additional conditions. Our processing contract and duties as a processor govern how we assist it.

7. Enquiries, identity verification and customer accounts

Our contact service verifies an email address and sends the completed enquiry to our connected service platform when you submit it. Account access may use verification messages, authorised sessions and other security controls. We process the information needed to deliver those messages, check access and associate the interaction with the correct account.

If an offered verification route uses email or WhatsApp, its delivery provider processes the recipient and message information needed for that step. A WhatsApp link opens an external service; messages you send there are also handled under its provider's privacy terms. An enquiry or verification message does not subscribe you to unrelated marketing.

A service-page form can carry a draft to the contact page using this tab's session storage. The contact page accepts that draft only within 30 minutes and removes it when read; an unread draft can remain until replaced, cleared or the tab session ends. Passing a draft does not automatically verify or submit the enquiry. Other forms may explain their own save-and-resume behaviour at the point of use.

Service and security messages, including account access, invoices, outage information and responses you request, are separate from promotional messages. An authorised workspace administrator may see information needed to manage the organisation's account and users.

8. Stripe, UK bank transfers, Google Pay and Apple Pay

Our payment arrangements include Stripe, UK bank transfers, Google Pay and Apple Pay, where offered for the particular purchase. The methods shown at checkout or on your invoice determine what is available.

Stripe payments

Stripe processes payment information and transaction details to authorise and settle payments and help manage fraud, refunds and disputes. We receive the billing and transaction information needed to administer your purchase, such as status, amount, references and, where provided, limited payment-method details or reusable payment references. Stripe can act on our instructions and for its own security or legal purposes; see Stripe's privacy policy. A processor or bank may require additional authentication.

Apple Pay and Google Pay

If you select a wallet, Apple or Google, the payment network, your card issuer and the payment processor handle the information required for that method. Wallet authorisation can use payment tokens rather than disclosing the underlying card number to the merchant. It does not make a purchase anonymous: relevant billing, contact and transaction information can still be shared. See Apple Pay security and privacy and Google's Payments Privacy Notice.

UK bank transfers

For a bank transfer, the banks and payment networks process the transfer. We receive information shown with the payment, such as the payer name, amount, date, reference and any account details supplied by the banking service. We use it to match the payment to your invoice and handle reconciliation or a refund. Use the invoice reference and avoid including unnecessary personal information in the payment reference.

Subscriptions, refunds and payment disputes

Where recurring payments are separately agreed, we use the relevant authority, payment reference and billing schedule to administer them. This policy does not create a recurring-payment authority. Refunds, chargebacks and disputes can require us to share relevant order, delivery, transaction and correspondence evidence with the processor, banks or card scheme. We limit that evidence to what is needed.

Deleting an account does not automatically erase statutory financial records, cancel a service contract or revoke an existing payment authority. You can request each action and we will explain its effect. Enter sensitive payment information only through the designated payment flow; do not send card security codes, online-banking credentials or full card details in support messages.

9. Software, SaaS, CRM, modules and integrations

Business applications can contain customer and supplier contacts, staff records, appointments, projects, sales, invoices, documents and workflow history. We process the content, access permissions, activity and configuration necessary to deliver the features the customer selects. An integration can transfer selected records between Britixo and the connected service and create synchronisation, delivery or error records.

The customer controls which integrations are authorised, who can use them and what business information is supplied. The connected provider's own terms and privacy information also apply where it acts independently. Disabling an integration stops future authorised connections as configured; it does not automatically remove records already lawfully stored by the other service.

For consultancy and development, relevant specifications, sample data, testing evidence and communications can be processed to deliver the project. Use synthetic or anonymised test information where possible. Production personal data should be provided only through an agreed route, with the necessary authority, access restrictions and processing instructions.

10. Managed IT, remote support, cybersecurity and recovery

Depending on the agreed service, we process device and asset inventories, user and account identifiers, system configuration, patch or security status, network and access logs, alerts, incident evidence and support records. Remote assistance may expose files, application content or a screen to an authorised technician while investigating the issue. Any recording or additional monitoring requires the applicable service arrangements and information to affected users; this notice is not permission for unrestricted surveillance.

Customers should inform their staff and other affected users about workplace monitoring and remote-support arrangements and provide only relevant support material. We use access appropriate to the agreed task and process customer system information under the applicable service instructions, except where we have a separate legal duty or controller purpose.

Hosting, cloud, email and recovery services can process customer files, mail content, databases, access records and backup copies. Domain services can require registrant, administrative and technical contact details to be sent to the registrar or registry, which may have its own legal or publication requirements. The chosen service and domain rules determine the particular information and recipients.

11. VoIP, PBX, telephone numbers and messaging

Calling services process account and extension identifiers, caller and destination numbers, routing information, timestamps, duration, connection outcomes and usage or billing records. Audio is transmitted to enable a call. Number orders or transfers can require contact details, service addresses and evidence of authority; any address needed for emergency-service routing must be accurate. This does not mean that a mobile app continuously collects precise device location.

Telephone networks, number suppliers, interconnection providers and call participants receive information needed to connect and administer communications. A customer contracts with Britixo for the Britixo service; use of upstream supplier APIs does not remove our own data-protection responsibilities.

Voicemail, call recording, transcription and other content features process additional information only where the relevant feature is provided and used. The organisation enabling a feature must establish the lawful basis, notices, access and retention arrangements for its use. Do not assume every call is recorded. The current Britixo VoIP Android notice explains that version's calling behaviour and lack of an in-app recording control; other participants or telephone systems may have separate recording arrangements.

Email, SMS and WhatsApp integrations can process sender and recipient details, message content, templates, attachments, delivery outcomes and responses. Communications platforms and network operators may process information internationally and under their own rules. The sender remains responsible for lawful contact lists and messages, including necessary marketing permissions.

For Android app permissions, company-directory access, local call history and diagnostics, read the specific VoIP privacy policy. For deletion, use the account-deletion route or contact the privacy team above. General website analytics is separate from the app's data practices.

12. AI features and automated processing

Where an AI feature is enabled, it may process the prompts, documents, selected business records or other inputs supplied to it, together with generated outputs, relevant usage information and diagnostic records. The particular feature determines whether information is sent to an external model or other provider. Its service information and the customer's configuration should identify that provider and the relevant processing arrangements.

Do not enter sensitive or confidential information into an AI feature unless its use is authorised and the necessary safeguards are agreed. An AI feature does not make every record in a workspace available for every purpose. This policy does not grant permission to use customer content to train general-purpose models; any such use needs an applicable lawful basis, clear information and compliance with the customer's processing instructions.

Automation also supports ordinary functions such as authentication checks, workflow routing, payment processing and fraud prevention. A security or payment check can delay or block an action. Contact us if you believe an automated outcome affecting your Britixo service is wrong so that we can investigate and arrange appropriate human review. A bank or payment provider may also control its own decision and review process.

Where processing involves a solely automated decision with a legal or similarly significant effect, the applicable law requires additional information and safeguards. These include meaningful information about the decision and its consequences and routes to make representations, contest it and obtain human intervention where required. This general notice does not replace those service-specific disclosures or protections.

13. Sensitive information and children

Some customer systems, such as practice-management or HR tools, can contain health information, other special-category data, or information about criminal allegations or convictions. These need additional legal conditions and safeguards, not merely an ordinary business interest. Where the customer controls the records, it must establish those conditions and instruct us appropriately. We do not ask for such information in a general sales enquiry.

Our general website and business-account services are not directed at children. Some customer-controlled services or communications may contain information about children; that information requires safeguards appropriate to its context and risks. If you believe a child has provided information to us inappropriately, contact our privacy team. We do not treat a child's use of a website as valid consent to all processing.

14. Cookies, visitor insights, live chat and measurement

Essential account, verification and security storage supports services you request. Optional visitor insights can process page views, clicks, browser and device information, and visitor or session identifiers through our connected service platform at britixo.co.uk or proplix.co.uk. Live chat also processes messages and the session information needed to connect you to support.

Use Privacy choices to select essential cookies only or allow the optional features offered on that page. Supported Global Privacy Control and Do Not Track signals keep broader visitor tracking off. Where live chat is explicitly requested on a protected page or with such a signal, it can operate in a restricted chat mode. The signed-in portal uses its own limited account-presence arrangements; it does not load the general website interaction collector into private account pages.

Google Analytics page-view reporting is configured to require a valid analytics choice and is excluded from protected account, contact and search routes and pages with query parameters. The current website can request Google's tag library when a page loads, before optional reporting is enabled; that request can expose technical connection information, such as an IP address and browser details, to Google. Refusing optional reporting does not prevent ordinary server logs or every technical request needed to load a page. See Google's privacy policy.

Choosing essential cookies only prevents loading the optional visitor module and removes its listed browser identifiers. Withdrawing a choice after the module has loaded reloads the page to stop it. Browser preferences and analytics choices are distinct from marketing permissions, and withdrawing a choice does not retrospectively erase records already lawfully received.

Our cookie information explains storage and temporary enquiry drafts. The controls presented on the page identify the available choices. A preference is specific to the browser and website origin; clearing site data or using another device can require a new choice.

15. Marketing and your right to object

We may send relevant information about our services where we have the appropriate permission or another lawful route. For unsolicited email, SMS or similar marketing to individual subscribers, including sole traders and some partnerships, we obtain consent unless a lawful existing-customer exception applies. That exception requires contact details obtained directly during a sale or negotiations, marketing of our own similar services, and an easy opt-out when details are collected and in each message.

Different electronic-marketing rules apply to corporate subscribers, but named business contacts still have data-protection rights. We identify ourselves and provide an effective opt-out. We comply with applicable telephone-marketing restrictions rather than treating a published telephone number as permission.

We may keep a limited suppression record to respect your objection and avoid contacting you again. An unsubscribe request does not stop necessary account, security, billing or service communications.

16. Who receives information

Information is made available only as needed for the relevant purpose. Depending on your service, recipients include:

• Authorised Britixo personnel and contractors delivering administration, engineering, support and security.
• Hosting, datacentre, cloud, storage, backup and infrastructure providers supporting the relevant systems.
• Email, messaging, identity-verification, communications and telephone-network providers delivering the features you use.
• Stripe, Apple, Google, relevant banks, payment networks and card issuers involved in your chosen payment method, including refunds or disputes.
• Software, integration and AI providers for the features the customer authorises, and authorised administrators or users of that customer's workspace.
• Analytics providers where the relevant website processing is enabled, as described above.
• Professional advisers, insurers, auditors, debt-recovery providers or courts where necessary for a relevant matter, and authorities where disclosure is legally required or otherwise lawful and justified.
• A prospective or actual business transferee and its advisers where necessary for a genuine transaction, subject to appropriate confidentiality, necessity and continuing privacy protections.

Britixo does not sell personal information. Where a provider acts on our behalf, appropriate processing terms and instructions apply. An independent controller is responsible for its own purposes and legal obligations. You can ask which recipients and arrangements are relevant to your service; a category in this notice does not mean all listed recipients receive all your information.

17. UK hosting and international processing

Britixo's core platforms and databases are hosted in a UK-based datacentre. This does not mean every connected data flow remains in the UK. Payment, wallet, email, communications, analytics, cloud, integration or AI providers, their support teams, and people you communicate with may process information in other countries, including the United States. The supplier and enabled feature determine the countries involved.

For a transfer subject to UK transfer restrictions, we must establish a lawful route: for example applicable UK adequacy regulations, or appropriate contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, with the required assessment and any additional protections. A narrow statutory exception may apply only where its conditions are met. EU transfer requirements also apply where relevant to the processing.

You can request the countries, transfer basis and a copy or explanation of the safeguards relevant to your service from our privacy team. We may redact confidential information while providing meaningful information about the protection. Provider privacy notices explain their own international operations; UK hosting alone is not a guarantee about every provider. Your use of this website is not blanket consent to unrestricted overseas transfers.

18. How long we keep information

We retain personal information for the purpose for which it is needed, subject to applicable legal requirements. There is no single period suitable for every service or record. The criteria below explain how the relevant period is determined; a product notice, customer agreement or response to your request may provide a more specific period.

When information is no longer needed, we delete or genuinely anonymise it, or restrict it pending expiry of a justified retention period. Where a backup must be restored, applicable deletion or restriction instructions must be respected. A legal hold is limited to relevant information and does not justify keeping every account record indefinitely.

For the period or criterion affecting a particular record, tell us the service and information concerned. The VoIP app notice separately explains its local recent-call list and what signing out or uninstalling removes.

19. Security and confidentiality

We use technical and organisational measures appropriate to the nature of the information and the risks of the service, including controls over authorised access and the handling of service information. Specific measures depend on the product and agreed scope; this notice does not claim a certification, universal end-to-end encryption or a guarantee that an incident cannot occur.

Keep access credentials and verification codes private, use the available account-security controls, and limit information shared in support material. Report suspected unauthorised access promptly through support or the privacy contact route. We assess personal-data incidents and make the notifications to authorities and affected people required by applicable law.

20. Information you need to provide

Some information is needed to answer a request, verify access, enter or perform a contract, connect a communication, take a payment or meet a specific legal obligation. Without it, we may be unable to provide the affected action or service. We explain mandatory fields or requirements in the relevant flow rather than treating every optional field as compulsory.

You can refuse optional marketing and visitor-tracking consent without losing access to the core website or making a privacy request. Refusing a device permission may prevent the feature that needs it, such as transmitting your voice without microphone access; the app's notice explains those effects.

21. Your information rights

Depending on the processing and the applicable law, you can:

• Ask for access to your personal information and information about its use.
• Correct inaccurate information and complete relevant incomplete information.
• Request erasure where the legal conditions apply.
• Request restriction of processing in the relevant circumstances.
• Request portability of information you provided where processing is automated and based on consent or contract.
• Object as described in section 15, including the absolute right to stop direct marketing.
• Withdraw consent for consent-based processing at any time, without affecting earlier lawful processing.
• Exercise applicable safeguards for significant automated decisions, including challenge and human intervention.

These rights have legal conditions and exceptions. For example, a deletion request does not require destruction of records we must retain by law or need for a relevant legal claim. We explain any restriction or refusal and your complaint rights.

22. Making a request or deleting an account

Contact us using section 1. No particular legal wording is required. We may request proportionate information to confirm identity, authority to act for someone else, or the records concerned. We will not ask for more than is reasonably necessary, and a routine request should not require sending sensitive documents through an ordinary contact form.

We respond without undue delay, normally within one calendar month. Where the law permits additional time for a complex or multiple request, or a necessary identity or clarification step affects the deadline, we explain the reason and timing. An extension can be up to two further months where the statutory conditions apply. Requests are normally free; we only charge or refuse where the law permits and explain why.

Uninstalling an app, signing out or stopping use does not itself delete a server account. For Britixo VoIP, follow the dedicated deletion instructions; you can request deletion without reinstalling the app. For other services, identify the account and whether you want particular information removed or the account closed. We explain any linked access, administrator, service or billing consequences and any information lawfully retained.

Where your organisation controls relevant records, we will identify that role and assist appropriately. We do not erase another person's account or an entire organisation's records simply because an individual requests deletion.

23. Privacy complaints and the regulator

If you are concerned about our use of information, send a data-protection complaint through the privacy contact form or any contact route in section 1. Explain what happened, the relevant service and the outcome you seek. We can help you make the complaint in an accessible way.

We acknowledge a data-protection complaint within 30 days, investigate it and respond without undue delay, keeping you informed as appropriate. This complaint process does not replace the separate deadlines for an individual rights request.

You have the right to complain to the Information Commissioner's Office (ICO), the UK data-protection regulator. You do not lose that right by contacting us first. If another jurisdiction's data-protection law applies, you may also have rights to contact the relevant supervisory authority or seek a judicial remedy.

24. Updates and related information

We review this policy when our services, providers, information practices or legal requirements change. The version and date above identify this notice. Where a change requires additional information or consent, publishing an updated page alone is not a substitute for providing that information or obtaining consent. We do not treat continued browsing as agreement to an incompatible new use.

For a copy in another accessible format or information about a specific service, contact our privacy team. Read our Terms & Conditions, cookie policy, accessibility statement, VoIP app privacy policy and VoIP account-deletion information alongside the notices in the service you use.