Privacy policy
Last updated 28 September 2026
1. Who we are
Global Cross-Border Intelligence (GXBiQ) is a trading name of Citipost Limited, a company registered in England and Wales with company number 03451070. Our registered office is 51 Hailey Road, Erith, Kent DA18 4AA. We are part of the Citipost Group.
Citipost Limited is the controller of the personal data described in this policy. That means we decide how and why it is used, and we are responsible for it under UK data protection law.
Contact us about anything in this policy at privacy@gxbiq.com, or by post to our registered office marked for the attention of the Privacy Team.
What this policy covers
It covers people who visit gxbiq.com, send us an enquiry, or deal with us as a business contact, including contacts at our customers, prospects, suppliers and partners.
It does not cover the names and addresses on items we carry for our customers. When we handle that data we act on our customer's instructions as their processor, under the terms of our contract with them. If you received an item through us, the sender's privacy notice applies and they are the right people to contact first.
2. What we collect
What you give us
- Enquiry details from our contact form: your name, company, work email address, phone number, what you send, and anything you write in your message.
- Correspondence when you email us, phone us or meet us, including your job title and the details of what we discuss.
- Business relationship details if you become a customer or supplier contact, such as your role, contact details and account history.
What we collect automatically
- Form context: the page you sent an enquiry from, so we know what you were reading.
- Server logs: like almost every website, our hosting provider records technical details of each visit, including your IP address, browser type, the page requested and the time. We use these to keep the site running and secure, not to identify or profile visitors.
- Usage statistics: Google Analytics records how the site is used, including the pages you view, how long you stay, how you arrived, your device and browser type, and your approximate location at city level. It does not store your IP address. See Cookies.
We do not ask for any special category data, such as health information, and we ask you not to include it in a message.
3. Cookies
The only cookies on this website are set by Google Analytics. We use them for one purpose: to understand how visitors use the site so we can improve it.
| Cookie | What it does |
|---|---|
| _ga | Distinguishes one visitor from another so visits can be counted. Expires after 2 years. |
| _ga_ followed by an ID | Keeps track of your current visit. Expires after 2 years. |
We do not use them for advertising. Google's advertising features and data sharing are switched off, and we do not use them to identify you. Because they are used only to produce statistics that help us improve the site, UK law allows us to set them without asking first, as long as you can switch them off.
To switch analytics off, use the Cookie settings link at the bottom of any page. You can also block cookies in your browser settings, or install Google's opt-out browser add-on. The site works the same either way.
We do not use advertising or tracking cookies. If that changes, we will update this policy first and ask for your consent.
4. How we use it and why
UK data protection law says we need a lawful basis for each use of your data. These are ours.
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry and prepare a quote or proposal | Taking steps at your request before entering into a contract, or our legitimate interest in responding to business enquiries |
| Provide our services and manage our relationship with your organisation | Performance of our contract with your organisation, and our legitimate interest in running that relationship well |
| Send you information about our services, news and events | Our legitimate interest in direct marketing to business contacts. See Marketing. |
| Measure how the website is used, to improve it | Our legitimate interest in understanding which parts of the site are useful and fixing the ones that are not |
| Run, secure and improve this website and our systems | Our legitimate interest in keeping our website and systems working and secure |
| Keep records, meet tax and regulatory duties, and respond to lawful requests | Legal obligation |
| Establish, exercise or defend legal claims | Our legitimate interest in protecting our business |
| Reorganise, sell or merge all or part of our business | Our legitimate interest in managing and developing our business |
Where we rely on legitimate interests, we have weighed them against your rights and concluded that the use is one you would reasonably expect from a business you have contacted or work with. You can ask us for details of that assessment, and you can object at any time. See Your rights.
We do not make decisions about you based solely on automated processing.
5. Marketing
If you send us an enquiry or give us your business contact details, we may send you emails about our services, industry updates and events that we think are relevant to your role.
We send this to business email addresses on the basis of our legitimate interests, which UK law permits for corporate contacts. If you are a sole trader or in a partnership, we will only send you marketing emails if you have agreed to receive them or you are an existing customer who has bought similar services from us.
You can stop marketing at any time, free of charge:
- use the unsubscribe link in any marketing email, or
- email privacy@gxbiq.com.
When you opt out we keep your email address on a suppression list, so we can make sure we do not contact you again. Opting out of marketing does not affect replies to your enquiries or messages about services you already use.
6. Who we share it with
We do not sell your personal data. We share it only where we need to:
- Citipost Group companies, where they help us provide or support our services, or where your enquiry is better handled by one of them.
- Service providers who act on our instructions, including website hosting, website analytics, form handling, email and office software, email marketing and customer relationship management. They may only use your data to provide their service to us.
- Carriers and partners, where needed to quote for or deliver a service you have asked for.
- Professional advisers, such as lawyers, accountants, auditors and insurers.
- Authorities, including regulators, HMRC, the police and courts, where the law requires it or to protect our rights.
- A buyer or successor, if all or part of our business is sold, merged or reorganised. They would use your data in the same way as this policy describes.
7. Transfers outside the UK
Some of our service providers store or process data outside the UK, including in the United States. When that happens we make sure the transfer is protected in one of the ways UK law allows: the destination is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for certified US companies), or the transfer is covered by the ICO's International Data Transfer Agreement or Addendum. You can ask us for more detail on a specific transfer.
8. How long we keep it
| Data | How long |
|---|---|
| Enquiries that do not become business | 24 months from our last contact with you |
| Marketing contacts | Until you opt out. If you have not engaged with us for 24 months we will either ask whether you still want to hear from us or remove you |
| Opt-out records | For as long as we send marketing, so we never contact you again by mistake |
| Customer and supplier contacts, contracts and correspondence | For the relationship, then 6 years after it ends, to meet tax and accounting rules and in case of legal claims |
| Website usage statistics | 14 months, then deleted automatically by Google Analytics |
| Server logs | For the short period set by our hosting provider |
We may keep data longer where the law requires it or where it is needed for an actual or expected legal claim. After that it is deleted or anonymised.
9. Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections, access controls and service providers who meet recognised security standards. No system is completely secure, but if a breach affects your rights we will tell you and the ICO where the law requires it.
10. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you and get a copy
- have inaccurate data corrected
- have your data erased in certain circumstances
- restrict how we use your data in certain circumstances
- object to our use of your data where we rely on legitimate interests. You can always object to direct marketing, and we will stop
- receive data you gave us in a portable format, where we use it under a contract or your consent
- withdraw consent at any time, where we rely on it
To use any of these rights, email privacy@gxbiq.com. It is free in most cases. We may need to confirm your identity before we act, and we will reply within one month. If a request is complex or you make several, we can extend that by up to two further months and will tell you why. When you ask for a copy of your data we will carry out a reasonable and proportionate search for it.
Some rights have limits. For example, we may need to keep data to meet a legal obligation, and we can refuse or charge for requests that are manifestly unfounded or excessive. If we cannot do what you ask, we will explain why.
11. Complaints
If you are unhappy with how we have handled your personal data, please tell us first at privacy@gxbiq.com. We will acknowledge your complaint within 30 days and let you know the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113.
12. Changes to this policy
We may update this policy from time to time, for example when we change how the website works or the law changes. The date at the top shows when it was last updated. If we make a change that significantly affects how we use data you have already given us, we will tell you directly.