Privacy Notice
Effective: 14 September 2026
Last reviewed: 14 September 2026
This notice covers every ApexIQ Companion service. The Apex Edge Sales Engineering website and the ApexIQ WinCommand application have their own notices.
Where a period or a practice differs by Topic, this notice says so and the Service Description for that Topic governs.
1. Who is responsible
Apex Edge Sales Engineering Limited, company number 15821626, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
Registered with the Information Commissioner's Office, registration ZB796431.
Contact: privacy@apexedgesalesengineering.com.
We act as a controller for Companion services. We decide how the work is done, we apply our own professional judgement, and what we return is our work. That is a different role from the one we take in ApexIQ WinCommand, where the subscriber is the controller and we process on their instructions.
2. The website sets no cookies and runs no analytics
companion.apexedgesalesengineering.com sets no cookies of any kind, so no cookie banner is needed and no consent is asked for. There is no analytics, no tag manager, no pixel, no session recording, and no advertising or marketing technology on any page.
The site loads nothing from any other website. Fonts, images, and stylesheets are served from this domain alone, so no third party is told that you visited, or which page you read. Our hosting supplier processes the server logs described in section 3.
Where a Topic provides a tool which runs in your browser, its Service Description states what that tool holds and where. Nothing a browser tool holds reaches us unless you send it.
An intake form's payment buttons take you to Stripe's checkout page. That page is Stripe's website and not ours, and what it sets and records is governed by Stripe's own privacy notice.
3. What we receive, and from where
We receive personal data in 4 ways.
From you, when you make a request. Your name, work email address, organisation, and role, plus whatever you write in the brief.
Inside the material you send. Material of the kinds Companion works on usually names people: authors, approvers, named contacts, the customer's staff, and sometimes individuals at a third organisation. We do not ask for this and we do not need it, but it comes with the material.
Through correspondence and payment. Emails, acknowledgements, and the details needed to take a payment and record it. You pay on Stripe's checkout page, where Stripe collects your payment details, your name, your email address, and your billing address. Stripe passes us the payment record, which includes the request reference the intake form made, and never your full card number.
From visiting the website. Our hosting supplier records a short-lived request log for every page served, which includes the visitor's IP address, the page requested, the time, and the browser's user agent. That is a technical record needed to serve the site, keep it available, and defend it against abuse. We do not use it to identify a visitor, we do not combine it with anything else, and we run no analytics of any kind on top of it.
We do not buy personal data, and we do not collect it from public sources for this service.
4. Why we use it, and on what basis
| What | Why | Lawful basis |
|---|---|---|
| Your contact and organisation details | To accept a request, acknowledge it, ask questions, and return the deliverable | Performance of a contract, or steps taken at your request before entering one |
| The brief | To understand what you need the work to address | Performance of a contract |
| Personal data inside your material | It is present in what we were asked to work on. We do not use it for anything beyond performing the service | Our legitimate interests, and yours, in performing a professional service you have requested |
| Correspondence | To run the engagement and keep a record of what was agreed | Legitimate interests in managing our business |
| Payment and billing details | To take payment for a request, issue receipts and invoices, refund a declined request, and keep accounting records | Performance of a contract, and legal obligation |
| The deliverable and the engagement record | To evidence what we advised, and to defend a claim | Legitimate interests in establishing and defending legal claims |
Where we rely on legitimate interests we have considered the effect on the people concerned. The processing is limited, expected in a professional services context, short-lived for the content of your material, and does not involve profiling or automated decision-making.
We do not make decisions about individuals by automated means, and we do not profile individuals. Our assessments are about the material, not about the people named in it.
5. Special category data
We do not want it and no Companion service needs it.
The Acceptable Use document asks you not to send special category data, criminal offence data, payment card data, credentials, or health information. Where we find such data we will tell you, and we may delete the material immediately without completing the work.
6. How long we keep it
| What | How long |
|---|---|
| The material you send us | As stated in the Service Description for that Topic. For Quality Audits, deleted when the report is sent; for Readiness, deleted when the pack is sent; and removed from routine backups in the ordinary course |
| The work we produced | 7 years from delivery |
| The engagement record: who asked, what for, when, what was agreed | 7 years from delivery |
| Correspondence | 7 years from the end of the engagement |
| Accounting records | 7 years, as required by tax law |
| Website request logs | Held by our hosting supplier for a short period for availability and abuse prevention, and not copied into our own systems |
Where a Topic deletes your material on delivery, that is a designed property of the service rather than a concession. It means we hold your commercial documents for days rather than years, and it means most requests to erase their content are already satisfied before they are made. Quality Audits works this way, and its Service Description says so.
The 7 year periods reflect the time within which a claim relating to the work could still be brought, plus the statutory retention required for accounting records.
7. Who else sees it
We do not sell personal data, and we do not share it for anyone else's marketing.
| Recipient | Purpose | Where |
|---|---|---|
| Netlify, Inc. | Hosting for companion.apexedgesalesengineering.com. It serves every page and keeps the request logs described in section 3. It receives no material, no brief, and no deliverable | United States |
| Google Ireland Limited | Business email and associated storage, through which requests arrive and reports are returned | Ireland, with support access from outside the UK and EEA |
| Anthropic PBC | The Claude API, which drafts the assessment of your material before a reviewer checks and finalises it. Inputs and outputs are not used to train models, and are deleted within 30 days | United States |
| Stripe Payments UK, Ltd. | Takes payment for a request on its own checkout page, and issues the receipt. It receives the request reference and the email address the intake form passes it, and what you enter at checkout. It receives no brief, no material, and no deliverable. For fraud prevention and its own legal obligations it acts as a separate controller, under its own privacy notice | United Kingdom, with processing in the United States |
| Our accountants and professional advisers | Billing, audit, and legal advice, under a duty of confidence | United Kingdom |
| A regulator, court, or law enforcement body | Where we are legally required to disclose | As required |
The people who read your material are our own reviewers, working from a draft produced with AI assistance. Section 5 of the Confidentiality and Materials document (Who reads it, and how the work is produced) explains that process, and no deliverable is sent without a reviewer checking every finding. Your material is not sent to any other subscriber, published, or used as an example, a case study, or marketing material.
We do not use your material, your brief, or your deliverable to train any model, and neither does our AI supplier under its commercial terms.
Where this changes, this notice changes with it, and we will say so before the change takes effect.
8. Transfers outside the United Kingdom
Our email provider may process data outside the UK, including in the United States, for support and resilience. Our AI supplier processes in the United States, our payment provider processes there as well as in the UK, and our hosting supplier is established in the United States and serves the site from a global network. Where that happens we rely on the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or another lawful transfer mechanism, together with the supplier's technical safeguards.
You can ask us for details of the mechanism which applies.
9. How we protect it
Access is limited to the people who need it to perform the work. Accounts carry multi-factor authentication. Artefacts are not copied onto removable media and are not stored outside our managed systems.
The Confidentiality and Materials document sets out how your material is handled in practice, whatever channel it arrives by.
Report a security concern to security@apexedgesalesengineering.com.
10. Automated decision-making and profiling
We make no decision about you by automated means alone, and we carry out no profiling.
A Topic may use AI to produce a draft of its assessment. That draft concerns the material, not a person, and it is never what we send you. A reviewer checks every finding, corrects what is wrong, removes what does not hold, and takes responsibility for the deliverable. No deliverable reaches a subscriber without that review, which the Service Description for each Topic records.
Nothing we do therefore produces a legal effect, or a similarly significant effect, on an individual by automated processing alone, and Article 22 of the UK GDPR is not engaged.
11. Children
Companion is a service for businesses. It is not directed at children, and we do not knowingly seek or hold personal data about anyone under 18. Where we find we hold such data without a proper basis, we delete it.
12. Your rights
Where we hold personal data about you, you have the right to:
- ask for a copy of it;
- ask us to correct it if it is wrong;
- ask us to delete it;
- ask us to restrict how we use it;
- object to our use of it where we rely on legitimate interests;
- ask us to transfer it, where the right to portability applies; and
- complain to a supervisory authority.
To exercise any of these, write to privacy@apexedgesalesengineering.com. We respond within 1 month. We may ask you to confirm your identity first.
Two practical notes. Where a Topic deletes your material on delivery, as both Quality Audits and Readiness do, a request about its content made after delivery will usually find that nothing remains. And where an individual named inside material sent to us asks about their data, we may need to approach the organisation which sent it, because they are better placed to identify the person and the context.
13. Complaints
If you are unhappy with how we have handled your personal data, tell us first at privacy@apexedgesalesengineering.com and we will try to put it right.
You can also complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, telephone 0303 123 1113.
14. Changes
We may change this notice. The date at the top is the date it last changed. Where a change is significant we will tell subscribers with an open engagement before it takes effect.