Privacy Policy

XONIK Technologies Pvt. Ltd. collects very little, keeps it for as long as it is useful to you, and does not sell or share it. This policy says exactly what is collected, why, and how to have it removed.

Who we are

XONIK is an AI strategy, digital transformation, business consulting and technology advisory firm. Throughout this policy, “XONIK”, “we”, “our” and “us” refer to XONIK.

• XONIK
• 3/3B, Saket Nagar
• Bhopal, Madhya Pradesh 462024
• India

Scope

This policy applies to personal information collected through our website and digital platforms, contact forms and enquiries, client and prospective client interactions, meetings and consultations, events and webinars, marketing communications, newsletter subscriptions, recruitment enquiries, and other interactions with XONIK.

It does not apply to third-party websites or services linked from our website.

Information you provide

You may voluntarily provide personal information when you contact us, request information, download resources, register for events, subscribe to newsletters, request a consultation, apply for a role, or communicate with our team. This may include:

• Name
• Organization
• Job title
• Email address
• Telephone number
• Country or region
• Business information
• Anything else you choose to include in your communications

We collect only the information reasonably necessary to respond to your request or deliver our services.

Information collected automatically

When you visit our website, limited technical information is collected to help us operate, secure and improve it: IP address, browser type and version, device and operating system, pages viewed, time spent, referring website, general geographic location, website interactions, and cookie preferences. Where possible this is aggregated or anonymised before being analysed.

How we use your information

• Responding to enquiries and requests.
• Delivering consulting and advisory services.
• Communicating about projects or business relationships.
• Registering you for events, webinars or workshops.
• Sending newsletters and insights where you asked for them.
• Improving website functionality and user experience.
• Analysing website performance and visitor engagement.
• Maintaining security and preventing fraud.
• Complying with legal, regulatory and contractual obligations.

We do not use personal information for purposes inconsistent with this policy.

The assistant on this site

There is an AI assistant on this site. It answers from the published pages and, if you ask it to, passes what you have described to a person. It is worth being specific about what that involves.

• What you type is sent to Anthropic, which produces the reply. It is not used to train their models.
• Questions the site could not answer are kept, without anything that identifies you, so we know what to write about next.
• If you ask for the conversation to be passed on, the name and address you give and the whole transcript are emailed to us and stored. Nothing is sent anywhere until you ask for it.
• Conversations are held in your browser for the length of the visit and are not kept afterwards unless you asked for the handover.
• Transcripts sent to us are kept for ninety days, then deleted.

The assistant is a machine and says so. What it tells you is not a quote, an offer, or a commitment — it does not give prices or delivery dates, and anything that matters comes from a person.

Cookies

Our website uses cookies to improve functionality, remember preferences, analyse performance and enhance the browsing experience. Some are essential; others are not. Where consent is required by law, non-essential cookies are set only after you give it. See our Cookie Policy for the detail.

Sharing personal information

XONIK does not sell, rent or trade personal information.

We share information with service providers who help us operate — website hosting, cloud infrastructure, analytics, customer relationship management, email, marketing automation and professional advisers. All are expected to maintain appropriate security and confidentiality standards. We may also disclose information where required by law, court order or regulator, or to protect our legal rights or the safety of others.

International transfers

As an international firm we work with clients, partners and providers in different countries. Where personal information crosses a border we take reasonable steps to ensure appropriate contractual, technical and organizational safeguards are in place, in line with applicable data protection law. Specifically: the server that runs this website and the Dispatch application is operated by Contabo GmbH in Germany, in the European Union, and email and notifications are carried by Google Workspace, operated by Google Ireland Limited.

Artificial intelligence

We may use AI to support research, knowledge management, operational efficiency and service delivery. We apply human oversight wherever AI-assisted tools are used, and we do not knowingly use personal information to train AI systems in a manner inconsistent with this policy or the law.

Data security

We implement technical, organizational and administrative safeguards designed to protect personal information from unauthorised access, disclosure, misuse, alteration or loss. These include access controls, encryption where appropriate, network security, secure hosting and periodic review. No system can guarantee absolute security, and we continue to review and improve our practices.

Data retention

We keep personal information only for as long as necessary to fulfil the purposes described here, comply with legal obligations, resolve disputes and enforce agreements. When it is no longer required it is securely deleted or anonymised.

Your rights

Depending on where you are, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion where appropriate.
• Restrict or object to certain processing.
• Withdraw consent where processing is based on it.
• Request portability of your information.
• Complain to your local data protection authority.

We respond to requests in accordance with applicable legal requirements. You do not need to cite a regulation to get a straight answer from us.

Our lawful basis for processing

Where the UK GDPR or EU GDPR applies, we rely on one of the following:

• Legitimate interests — responding to a business enquiry, running our business, keeping our systems secure. You can object to this at any time.
• Contract — where processing is necessary to deliver services under an engagement.
• Consent — for marketing emails and newsletters. You can withdraw it at any time, and withdrawing it is one click.
• Legal obligation — where we must keep records to comply with the law.

If you want to know which basis applies to a particular thing we hold, ask and we will tell you.

How long we keep it

Specific periods rather than “as long as necessary”, because that phrase means nothing:

• Enquiries — two years from the last contact, then deleted.
• Client engagement records — seven years from the end of the engagement, for legal and tax purposes.
• Assessment answers — three years, or until you ask us to delete them.
• Newsletter subscription — until you unsubscribe, then deleted within thirty days.
• Server logs — thirty days.
• Recruitment enquiries — one year, unless you ask us to keep them longer.
• LinkedIn access and refresh tokens held by Dispatch — for as long as the destination stays connected. Deleted the moment it is disconnected: the stored value is wiped, not marked inactive.
• Records of posts published through Dispatch — for as long as the customer’s account exists.
• Dispatch sign-in session records — fourteen days.

Responding to you

We respond to any request about your personal information within thirty days, and usually within a week. You do not need to cite a regulation, use a particular form of words, or explain why you are asking.

Marketing communications

If you subscribe to our newsletters or event communications we may contact you about our services, research and publications. You can unsubscribe at any time using the link in any email, or by contacting us. We honour those choices promptly.

Automated decision-making

XONIK does not rely solely on automated decision-making or profiling that produces legal or similarly significant effects on individuals without appropriate human oversight.

Third-party websites

Our website links to external sites for convenience. They operate independently under their own policies, and XONIK is not responsible for their content, privacy practices or security.

Children’s privacy

Our website and services are intended for businesses and professional audiences. We do not knowingly collect personal information from children, and will remove it if we become aware that we have.

Dispatch, and the LinkedIn data it uses

Dispatch is software published by XONIK Technologies Private Limited that schedules and publishes posts to LinkedIn on behalf of the person who connects their own LinkedIn account to it. This section describes the version XONIK hosts and operates. Customers who run Dispatch on their own servers under their own licence operate it themselves, on their own LinkedIn developer application, and XONIK has no access to anything in those installations.

The permissions we ask LinkedIn for. Three, and no others: openid and profile, to identify the person who authorised the connection, and w_member_social, to publish a post to that person’s own profile. We do not request any permission relating to company pages, comments, mentions, followers or analytics, and without those permissions we could not use such data if it were offered to us.

What we receive from LinkedIn and keep. When somebody connects their account through LinkedIn’s own sign-in page, we keep their LinkedIn member identifier and the name on their profile, which we show as the label of the destination they connected. We keep the access token LinkedIn issues, and the refresh token where one is issued, encrypted before they are written to the database. We never receive, see or store a LinkedIn password. For each post that is published we keep the identifier LinkedIn returns for it, so that the post can be linked to from our panels.

What we do not receive or keep. We do not collect email addresses, profile photographs, headlines, employment history or connection lists from LinkedIn. We do not read or store comments on posts, the names or pictures of people who comment, mentions, impressions, engagement counts or follower figures. We hold no data at all about LinkedIn members other than the person who connected their own account.

What we do with it. We publish the posts our customer has written and approved, at the times they chose, to the profile they connected. That is the only use. We do not build audience, contact or lead databases; we do not scrape LinkedIn or any other site; we do not sell or share LinkedIn data with anyone; we run no advertising and no behavioural analytics; and we do not use LinkedIn data to train any machine-learning model, our own or anybody else’s. Where our customers use an assisted-drafting feature, it runs on a model account the customer holds with a vendor of their own choosing, and no LinkedIn member data is sent to it.

How long we keep it. The access and refresh tokens are kept for as long as the destination stays connected and are deleted when it is disconnected. Records of published posts are kept for as long as the customer’s account exists. Sign-in session records are deleted after 14 days. When an account is erased, everything under it is deleted immediately and permanently, including image files on disk; a single audit entry survives recording that an erasure happened, with none of the content. Every table in Dispatch has a written retention rule, the deletion runs on a schedule rather than as a filter on a query, and the current rules are published inside the product on its security page.

Revoking it. A customer can disconnect a destination at any time from inside Dispatch, which destroys our copy of the token — the stored value is wiped rather than marked inactive — and no further post can be published to it. Independently of us, the member can revoke Dispatch’s access from LinkedIn’s own permitted-services settings, which withdraws the grant without going through us. Either is enough on its own.

Who else is involved. The server that runs the application and holds the database is operated by Contabo GmbH in Germany, in the European Union. Notifications and invitations are sent through Google Workspace, operated by Google Ireland Limited. LinkedIn itself necessarily receives the posts we publish on a member’s instruction. Nobody else receives LinkedIn data from us.

Who to contact. The controller is XONIK Technologies Private Limited, 3/3B, Saket Nagar, Bhopal, Madhya Pradesh 462024, India. Questions, access requests, corrections, erasure requests and complaints go to [email protected] and we answer within 30 days. Under India’s Digital Personal Data Protection Act 2023 our named grievance officer is Amit Govil, reachable at the same address. If you are in the United Kingdom or the European Union you may also complain to your own supervisory authority, and nothing here removes that right.

Changes to this policy

We may update this policy to reflect changes in our services, legal obligations or privacy practices. Updates are published on this page with a revised date.

Contact us

If you have questions about this policy, your personal information, or our privacy practices:

• XONIK
• 3/3B, Saket Nagar
• Bhopal, Madhya Pradesh 462024
• India
• Email: [email protected]
• We answer within 30 days.
• Grievance officer under India’s Digital Personal Data Protection Act 2023: Amit Govil, at the address above.