This policy explains how Exerge Limited ("Exerge", "we", "us") collects and uses personal information when you visit exerge.com, contact us, work with us or apply for a job with us, and the rights you have over that information.
Who we are
Exerge Limited is the controller of the personal information described in this policy. We are a company registered in England and Wales, company number 17380817, and our registered office is 18 Chine Gardens, Nottingham, NG2 7TT, United Kingdom.
For any question about this policy or your information, email hello@exerge.com or write to us at our registered office.
This policy does not cover personal information we handle for our clients when we build, host or support software for them. In that work we act on our client's instructions, under a written contract, and the client's own privacy notice applies.
The information we collect
Information you give us
- Enquiries. When you contact us by email, phone, social media or a form on this website: your name, email address, phone number, company, job title and what you tell us about your project.
- Clients and suppliers. Contact and billing details, and the records of the work we do together.
- Job applications. Your CV, cover letter, contact details, work history and anything else you choose to send, and our notes from interviews.
Please do not send us sensitive information, such as details of your health, unless we ask for it for a specific reason.
Information collected when you use the website
- Technical data. The website is delivered by Cloudflare. To serve pages and protect the site from attacks, Cloudflare processes your IP address, browser and device type, the pages you request and similar technical data.
- Your country. The site asks Cloudflare which country you are visiting from, so visitors in the UK see our UK details first. The answer is kept in your browser for the visit only and is not sent to us.
- Visit counts. Cloudflare Web Analytics records the page you visit, the site that sent you, and your country and type of device. It uses no cookies, stores nothing on your device and does not identify you.
- Analytics and advertising data, only if you agree. The pages you visit, how you reached the site (for example a search or an ad), how you move, click and scroll on a page (with anything you type hidden), your device and your approximate location, collected with cookies by Google Analytics, Hotjar and, once we run ads, Google Ads.
How we use it, and why we are allowed to
| What we do | Information used | Lawful basis |
|---|---|---|
| Reply to your enquiry and prepare a proposal | Enquiry details | Legitimate interests (answering people who contact us), and steps you ask us to take before a contract |
| Deliver, manage and invoice our services | Client and supplier details | Contract, and legal obligation (tax and accounting records) |
| Consider you for a job | Application details | Legitimate interests (recruiting), and steps before a contract of employment |
| Keep the website secure and working | Technical data | Legitimate interests |
| Count visits and see which pages people use | Visit counts | Legitimate interests (knowing whether the website works) |
| Understand how the website is used and measure our advertising | Analytics and advertising data | Consent |
| Send news about our services to business contacts | Name and business email address | Legitimate interests; you can opt out at any time. Where the law requires consent, we ask for it first |
| Meet legal obligations, and establish or defend legal claims | Any of the above, as needed | Legal obligation, and legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see "Your rights" below). We do not sell personal information, and we do not make decisions about you by automated means alone.
Cookies
We use three kinds of cookies. Necessary cookies are always on, because the site needs them to work and to stay secure. Analytics and marketing cookies are off until you accept them. You can change your choice at any time with Cookie settings at the bottom of every page; turning a kind off also deletes its cookies.
| Kind | What it does | Provider and cookies | Kept for |
|---|---|---|---|
| Necessary | Remembers your cookie choice | Exerge: exerge_consent | 6 months |
| Necessary | Tells people from bots, to protect the site and its forms | Cloudflare, including Turnstile on the contact form: __cf_bm and similar | Up to 30 minutes |
| Analytics | Which pages are visited and how people find us | Google Analytics: _ga, _ga_* | Up to 2 years |
| Analytics | How visitors move, click and scroll on a page, with anything typed hidden | Hotjar: _hjSessionUser_*, _hjSession_* | Up to 1 year |
| Marketing | Whether a visit came from one of our ads, once we run ads | Google Ads: _gcl_au and similar | Up to 90 days |
The country check described above is kept in your browser until you close the tab and is not a cookie. Cloudflare Web Analytics, which counts visits, stores nothing on your device.
Who we share it with
- Service providers who run parts of our business on our instructions, such as Cloudflare (website delivery, security and visit counts), Zoho (email and business software), Google and Hotjar (analytics and advertising, only if you accept those cookies), and our accountants and professional advisers.
- Our team in Pakistan, who work on enquiries and client projects.
- Authorities, regulators and courts, when the law requires it.
- A buyer or investor, if all or part of our business is sold or restructured, under a duty of confidentiality.
Every service provider is bound by contract to protect your information and use it only to provide its service to us.
Transfers outside the UK
Some of the people and providers above are outside the UK, including our team in Pakistan and providers that process data in the United States and elsewhere. When personal information leaves the UK, we protect it as UK law requires: with UK adequacy regulations, including the UK–US data bridge where a provider is certified under it, or with the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Email us for details of the safeguard that applies.
How long we keep it
- Enquiries that do not lead to work: up to 2 years after our last contact.
- Client and supplier records, including invoices: 6 years after the end of the financial year they relate to, as tax law requires.
- Job applications: 6 months after the role is filled, or 12 months if you agree to us keeping your details for future roles. If you join us, your application becomes part of your staff record.
- Marketing: until you opt out. We keep a record of the opt-out so that we do not contact you again.
- Analytics data: up to 14 months.
- Website security logs: for the short period Cloudflare keeps them.
How we protect it
Only the people who need your information can access it, and we use technical and organisational measures, such as encryption in transit (this website is served only over HTTPS), access controls and established service providers, to keep it safe. If a breach is likely to put your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.
Your rights
Under UK data protection law you have the right to:
- access the personal information we hold about you and receive a copy;
- correct information that is wrong or incomplete;
- erase your information in certain circumstances;
- restrict how we use your information in certain circumstances;
- object to our use of your information based on legitimate interests, and to direct marketing at any time;
- data portability: receive information you gave us in a machine-readable format, or have it sent to another organisation;
- withdraw consent at any time, where we rely on it. This does not affect what we did before you withdrew it.
To use any of these rights, email hello@exerge.com. There is no charge in most cases. We will reply within one month, and may need to confirm your identity first.
Complaints
If you are unhappy with how we have handled your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the European Economic Area, you can also complain to the data protection authority in your country.
Children
Our website and services are for businesses. We do not knowingly collect personal information from children.
Other websites
The website links to other sites, such as our clients' websites and our social media profiles. Their own privacy policies apply when you visit them.
Changes to this policy
We update this policy when the way we handle personal information changes. The date at the top shows when it last changed.