Cookies and Privacy

Who we are

We, Exploding Potential Ltd (XPotential) (‘We’, ‘Us’), are committed to respecting and protecting your privacy. This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. For the purpose of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), the data controller is Exploding Potential (XPotential) of Great Limmers Farmhouse, Limmer Lane, High Wycombe, Buchinghamshire, HP12 4QR, United Kingdom. Our nominated representative for the purpose of the Act is Julie Hayward.

Information we may collect from you

We may collect and process the following data about you:

• Information that you submit via our website at www.xpotential.co.uk (our ‘site’). This includes information provided at the time of registering to use our site or subscribing to any services or facilities available via our site, including the provision of brochures, information sheets and any other relevant materials, and any information you submit in relation to any surveys carried out via our site.
• If you contact us, we may keep a record of that contact and any related correspondence (including emails).
• performing obligations in the course of or in connection with our provision of the goods and/or services requested by you.
• managing your relationship with us;
• responding to, handling, and processing queries, requests, applications, complaints, and feedback from you;
• processing payment or credit transactions;
• complying with any applicable laws, regulations, codes of practice, guidelines, or rules, or to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority;
• any other purposes for which you have provided the information;
• transmitting to any unaffiliated third parties including our third party service providers and agents, and relevant governmental and/or regulatory authorities, whether in Singapore or abroad, for the aforementioned purposes; and
• any other incidental business purposes related to or in connection with the above.

IP addresses and cookies

We do not specifically set or deploy any cookies via the code of our site. However, the servers which operate our site deploy cookies and our site uses Google Analytics, which also deploys cookies. Cookies are used only to obtain general information about the use of our site and visits to or sessions of use of the site. The cookies do not collect any information which can personally identify you. You may refuse to accept cookies by activating the setting on your browser which allows you to refuse the setting of cookies. However, if you select this setting you may be unable to access certain parts of our site or to use certain functionality.

Where we store your personal data

The data that we collect from you is generally processed and stored within the European Economic Area (“EEA”). However it may also be processed by staff operating outside the EEA who work for us. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy. All information you provide to us is stored on secure servers. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site, so any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

If you are located outside the EEA, your personal data may be stored on external servers within the EU or transferred internationally if it is necessary to share your personal data with our affiliates, business units and third-party service providers.

Employees of XPotential may be located in other countries and may access personal data stored in your country for their daily business operations. If employees process data outside of your country of residence, they will do so only with authorized internal IT equipment that adheres strictly to all defined protection and security requirements. All employees undergo necessary training to comply with data protection obligations and to ensure secure data handling.

We are committed to protecting your personal data when it is transferred internationally. In such cases, we will take reasonable steps to ensure that your personal data continues to receive a level of protection that is comparable to the standards required by applicable data protection laws. For example, we may enter into contractual agreements or impose binding corporate rules with recipients of your personal data to safeguard it in a manner that is compliant with relevant laws.

How long we store your personal data

We may retain your personal data for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws.
We will cease to retain your personal data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected, and is no longer necessary for legal or business purposes.

Uses made of the information

We use information held about you in the following ways:

• To ensure that content from our site is presented in the most effective manner for you and for your computer.
• To perform obligations in the course of or in connection with our provision of the goods and/or services requested by you.
• To provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes.
• To notify you about changes to our site or our business. We (and our group companies) may also use your data to provide you with information about our services which may be of interest to you and we may contact you about these by email, post or telephone.

Disclosure of your information

We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 Companies Act 2006. We may disclose your personal information to third parties:

• Where such disclosure is required for performing obligations in the course of or in connection with our provision of the goods and services requested by you.
• To the extent that we need to for the purposes of allowing third party contractors to assist with the operation of our site and/or to provide services relating to our site.
• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, including a contractual obligation, or to protect our rights, property, or safety and those of our employees, contractors, and others. This includes exchanging information with other organisations for the purposes of law enforcement and other regulatory compliance.
• We will never knowingly disclose your information to any other third parties for any purpose.

Your rights

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, individuals (“data subjects”) have specific rights regarding their personal data. We are committed to upholding these rights and ensuring transparency in how we process personal information.
As a data subject, you have the following rights:

1. Right to Access – You have the right to request a copy of the personal data we hold about you and details about how we process it.
2. Right to Rectification – You can request correction of any inaccurate or incomplete personal data.
3. Right to Erasure (Right to be Forgotten) – You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or if you withdraw consent (where applicable).
4. Right to Restrict Processing – You have the right to request that we limit the processing of your personal data in certain circumstances.
5. Right to Data Portability – You can request to receive your personal data in a structured, commonly used, and machine-readable format, and have the right to transmit that data to another data controller where technically feasible.
6. Right to Object – You may object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes.
7. Rights in Relation to Automated Decision-Making and Profiling – You have the right not to be subject to decisions based solely on automated processing, including profiling, where it produces legal effects or similarly significant consequences.

Processing Under the Purview of PDPA Singapore

Under the Personal Data Protection Act (PDPA) Singapore, individuals have specific rights regarding their personal data. We comply with the PDPA and ensure the responsible handling of personal data collected, used, and disclosed in Singapore.
Your Rights Under PDPA

1. Right to Access and Correction – You have the right to request access to your personal data and request corrections to any inaccuracies.
2. Right to Withdraw Consent – You may withdraw your consent for us to collect, use, or disclose your personal data at any time, subject to legal and contractual obligations.
3. Right to Data Portability – Where applicable, you may request for your data to be provided in a commonly used format.

How to Make a Request

To exercise any of your rights, please contact us at: theteam@xpotential.co.uk.
Please include the following details in your request:

• Your full name
• Contact details
• A clear description of the request

We will respond to your request within one month of receipt. In some cases, this period may be extended by up to two further months if the request is complex or numerous.

Job Applications

If you apply to XPotential, we process your personal data as a controller. Providing your personal data is necessary for an application to proceed. You are entitled to the data subject rights outlined in this document.

Lawfulness

We process your personal data to take steps prior to an employment at your request. Any additional processing beyond this application process is based on another, separately declared legal basis.

Application process

Our application process is mostly conducted by email and includes following steps:
(1) Letter of motivation
(2) Curriculum vitae
(3) Description of your qualification and education
(4) Attestation of your qualification and education
The extent of your application documents is determined by you. We will only collect data necessary to proceed with the application process.
If we invite you to an interview, we collect further personal data encompassing your personal interests and particulars of your professional aspirations and qualification.

Transfer of application data

We share your application data within our organisation with persons involved in the application process: human resources managers, subject matter experts and potential superiors.
Storage and record keeping
If you enter into an employment contract with us, we keep your application data until the conclusion of that contract’s retention periods.
If we do not close an employment contract, we keep your application data for twelve months. If you want to receive updates on open positions, you may grant us your separate, written consent to do so.

Changes to our privacy policy

Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail.

Contact

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to theteam@xpotential.co.uk