1. Who we are
Galixa Technologies Limited is a UK-incorporated AI cybersecurity company developing privacy-preserving behavioural intelligence for digital trust. For personal data collected directly through this website and the demo-request form, Galixa acts as the data controller.
Privacy enquiries can be sent to privacy@galixa.ai. Create and monitor this mailbox before public launch.
2. Personal data we collect
When you request a demo, we may collect the information you choose to provide, including:
- name and work email address;
- company, role and company website;
- sector, approximate session volume and area of interest;
- information you include in the free-text enquiry field; and
- the fact that you acknowledged this Privacy Notice.
For website security and abuse prevention, our hosting environment may process technical information such as IP address, request timestamps and server logs. The demo form included with this website does not store the raw IP address in the lead CSV; it uses a temporary pseudonymous hash for rate limiting.
3. How we use personal data
We use demo-request information to respond to your enquiry, understand your organisation's use case, arrange product or technical discussions, scope a potential beta or Proof-of-Value pilot, maintain records of business conversations, and protect the website from spam or abuse.
We do not use the demo-request form in this build to create a purchase, subscription or automated buying decision.
4. UK and EU legal bases
Where UK GDPR or EU GDPR applies, the lawful basis will depend on the activity. For a business demo request, Galixa will generally rely on its legitimate interests in responding to B2B enquiries and developing commercial relationships, and where relevant on steps requested before entering into a contract.
If Galixa later introduces optional marketing communications, those communications should use a separate mechanism and an appropriate legal basis. The required checkbox on the demo form is an acknowledgement that you have read this notice; it is not presented as consent to unrelated marketing.
5. Retention
The website form package is configured to keep lead-log CSV files for up to 180 days and to remove temporary rate-limit files after approximately 24 hours. Galixa should apply a matching retention practice to copies held in email or CRM systems, unless an ongoing relationship, legal obligation, dispute or security need justifies a different period.
Retention settings should be reviewed before launch and whenever the sales or customer-management process changes.
7. International transfers
Hosting, email or other service providers may operate in more than one country. Where UK or EU personal data is transferred internationally, Galixa should identify the transfer route and implement an appropriate safeguard where the law requires one. The exact mechanism depends on the providers and hosting region selected for production.
8. UK and EU privacy rights
Depending on the law and circumstances, individuals may have rights to request access to their personal data, correction, deletion, restriction, portability or objection to certain processing, and to withdraw consent where consent is the lawful basis. You may also have the right to complain to a data protection authority.
UK users can find information from the Information Commissioner's Office at ico.org.uk. EU users can find general GDPR information from the European Commission at commission.europa.eu.
9. U.S. state privacy rights
The United States does not have one single general privacy regime equivalent to the GDPR. Depending on your state and whether a particular law applies to Galixa, rights may include access or knowledge, correction, deletion, portability, and the ability to opt out of certain sales, sharing, targeted advertising or profiling.
California's CCPA, as amended, provides California residents with rights including know/access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and equal treatment. Other states, including Colorado and Texas, have their own comprehensive privacy requirements and consumer rights.
This website build does not sell demo-request personal data or use it for cross-context behavioural advertising. If Galixa later introduces advertising or data-sharing technologies, the privacy notice and opt-out mechanisms must be reassessed for applicable U.S. state requirements.
California privacy information is available from the California Privacy Protection Agency at cppa.ca.gov.
11. Galea product privacy and compliance positioning
Galea is being designed around local-first behavioural classification, with server-side components retained for secure validation, monitoring and risk controls. This architecture aims to reduce unnecessary external processing of behavioural interaction data; it should not be described as “zero data”.
Galixa does not represent that Galea is automatically compliant with EU GDPR, UK GDPR, the CCPA or every other privacy law simply because of its architecture. Customer deployments may require data-flow mapping, lawful-basis analysis, DPIAs or similar assessments, processor terms, security review, retention controls and transfer safeguards.
Where a customer uses Galea's output as part of solely automated decision-making or profiling that has legal or similarly significant effects, the customer should separately assess the rules and safeguards that apply in the relevant jurisdiction. This is particularly important because requirements around automated decision-making are evolving in the UK and in U.S. states such as California.
12. Contact and privacy requests
For privacy questions or requests concerning information submitted through this website, contact privacy@galixa.ai.
Before launch, Galixa should add its registered office or other legally required company/contact information to this notice and confirm the appropriate privacy contact workflow.