Last updated: 1 May 2026.
This policy explains how PRAXIA.CH Ltd handles personal data through this website and the services connected to it. It is written in plain English to meet the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). For data we hold during a paid engagement with an NHS organisation, see section 11.
1. Who we are
This site is operated by PRAXIA.CH Ltd, a company registered in England and Wales. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Company number: 17004954.
For the purposes of UK data protection law, PRAXIA.CH Ltd is the Data Controller for personal data collected through the marketing site at praxia.ch, any forms submitted on it, and any direct correspondence in reply.
To exercise any of your rights, or for any data protection question, write to ceo@praxia.ch.
2. What data we collect, and why
We collect only what we need to operate the site and answer enquiries.
| Data | Why we collect it |
|---|---|
| Your name and role | Submitted via the contact form. Identifies you so we can reply. |
| Your work email | Submitted via the contact form. Used to reply to your enquiry. |
| Your organisation | Helps us scope a useful response. |
| Your message | The body of your enquiry. |
| Server logs | IP address, timestamp, page requested, user agent. Recorded by our hosting provider. Used to keep the site available and investigate abuse. |
| Analytics events | Pages viewed, session length, approximate country, device class, referrer. Collected through Google Analytics 4 (measurement ID G-271WM17SQ1) in anonymous mode: IP addresses are not stored, data is not shared with other Google products, and logged-in users are excluded. You can opt out at any time via the Cookie settings link in the footer. |
| Account data | If you have a login on this site (staff or contributors only): username, email address, role, profile fields. |
We do not collect special category data (health, ethnicity, sexuality, beliefs, biometrics, criminal records, trade union membership) through this site. Do not send patient information, clinical detail, or anything that would identify a service user. If your enquiry needs that level of detail, write a brief outline first and we will arrange a secure channel.
3. Legal basis for processing
Under UK GDPR, every act of processing must have a lawful basis. Ours are:
| Activity | Lawful basis |
|---|---|
| Responding to a contact-form enquiry | Legitimate interest in answering correspondence, or pre-contract steps if you are scoping work. |
| Operating, securing, and maintaining the site | Legitimate interest in keeping the site available, fast, and free of abuse. |
| Running analytics | Consent, given through the Statistics category in our cookie banner. The analytics are configured to limit what is collected, with data sharing off and IP addresses masked. You can withdraw or change your consent at any time using the Cookie settings link in the footer. |
| Sending replies and project communications | Legitimate interest for prospective work, or contractual necessity once an engagement is signed. |
| Keeping records the law requires us to keep | Legal obligation, for example tax and accounting records. |
Where we rely on legitimate interest, you have the right to object. Where we rely on consent, you have the right to withdraw it.
4. How we store and protect your data
The site runs on WordPress. Data in transit between your browser and the site is encrypted with TLS. Access to the admin is limited to named accounts with strong authentication and is monitored by the security plugin we use (Defender Pro). The processors we rely on for the site itself are listed in section 5.
5. Who we share your data with
We do not sell your data. We do not rent it. We do not trade it. We share it only with the providers needed to run the site:
| Provider | Purpose | Region |
|---|---|---|
| Our website host | Hosting, uptime, server logs | UK / EU |
| WPMU DEV (Incsub LLC) | Defender Pro, Hummingbird, SmartCrawl Pro, Forminator, Smush. Security, performance, SEO, forms. | US, with EU/UK processing where supported |
| Google LLC | Google Analytics 4 via Site Kit; Google Fonts | US |
| Automattic Inc. | Gravatar avatars, where you have submitted one | US |
| Complianz | Recording and storing your cookie preferences (Complianz B.V.) | EU (Netherlands) |
| Our email provider | Transmitting messages submitted through the contact form | UK / EU |
We may disclose data outside this list where a court order, regulator, or other lawful authority requires it. We will tell you unless the law forbids us.
6. International transfers
Some of our processors are based outside the UK and the EEA, notably Google LLC, Automattic Inc., and Incsub LLC. Where data leaves the UK we rely on one of: a UK adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, depending on the destination.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Contact-form enquiries | Up to 24 months from the last exchange, so we can pick up the thread if a project resumes. Deleted on request sooner. |
| Server logs | Up to 30 days. |
| Analytics data | Default Google Analytics 4 retention (currently 14 months). |
| Account records (staff and contributors) | While the account is active, plus 12 months after closure. |
| Records required by law (tax, accounting, contracts) | For the period prescribed by law, typically six full tax years. |
You can ask us to delete your data sooner. See section 8.
8. Your rights under UK GDPR
You have the rights below. To use any of them, write to ceo@praxia.ch. We will respond within one calendar month.
| Right | What it means |
|---|---|
| Access | Get a copy of the data we hold about you. |
| Rectification | Have inaccurate or incomplete data corrected. |
| Erasure | Have your data deleted, unless we have a legal reason to keep it. |
| Restriction | Ask us to pause processing while a dispute is resolved. |
| Portability | Receive a copy of your data in a machine-readable format. |
| Objection | Object to processing where the basis is legitimate interest. |
| Withdraw consent | Withdraw consent at any time, where consent was the basis. The withdrawal does not affect processing already done lawfully. |
Article 22 (automated decisions). We do not make decisions about people by automated means alone. Any analysis we perform on enquiries supports human judgement; it does not replace it.
9. Cookies and similar technologies
We use two kinds of cookies. Strictly necessary cookies, set by WordPress when you log in or comment. And anonymous statistics cookies, set by Google Analytics 4 in a configuration where IP addresses are not stored, data is not shared with other Google products, and logged-in users are excluded.
The first time you visit, the cookie banner explains how cookies are used. The Cookie settings panel, also linked in the footer, lets you opt out of any non-essential category at any time. Withdrawing consent is as easy as giving it.
If you have a Gravatar associated with your email and you submit a comment, a one-way hash of your email is sent to Automattic to fetch your avatar. Their privacy notice is at https://automattic.com/privacy/.
10. Children’s privacy
This site is a professional service for board directors, executive teams, and governance professionals. It is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has submitted data, write to us and we will delete it.
11. Engagements with NHS organisations
The data described above relates to website use only. When PRAXIA.CH Ltd is engaged by an NHS organisation to provide an AI Readiness Diagnostic, an Executive Design Control review, or any other paid service, the data flows are different and the legal arrangements are signed separately.
For paid engagements, the NHS organisation is normally the Data Controller and PRAXIA.CH Ltd acts as a Data Processor under a written Data Processing Agreement and where applicable an NHS Data Sharing Agreement. We will not start processing client data until those agreements are in place. We do not transfer client engagement data into the systems described in section 5 unless the engagement contract specifically permits it.
12. Changes to this policy
If we change this policy in a material way we will update the date at the top and, where appropriate, notify you the next time you submit an enquiry or log in. The current version is always the one published here.
13. Contact and complaints
For any question or rights request, write to ceo@praxia.ch.
If you are not happy with how we have responded, you can complain to the UK Information Commissioner’s Office (ico.org.uk).
- Website: https://ico.org.uk
- Helpline: 0303 123 1113
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF