Privacy & Cookie Policy

1. Who We Are

Exos Systems Limited ("Exos", "we", "us", "our") is a telecom BSS consulting and software delivery company registered in Guernsey, Channel Islands. We provide BSS delivery, integration, billing modernisation, and AI-native advisory services to communications service providers worldwide.

Data Controller: Exos Systems Limited
Contact: info@exos-systems.com

Processor: Blue Note Logic Inc builds, hosts and maintains this website and its client portal on our behalf, acting as a data processor under a written data-processing agreement. It does not use your data for its own purposes.

2. What Data We Collect

We collect personal data only when you voluntarily provide it. This includes:

• Contact form submissions: name, email address, company name, phone number (optional), and your message
• Technical details of a contact form submission: the user agent your browser reports (its name and version), and a pseudonymised digest of your network (IP) address, a keyed hash unique to this website that we use only to limit repeated submissions and to investigate abuse. The address itself is not stored.
• Email correspondence: when you contact us directly via email
• Business enquiries: details provided during consultation requests, demo bookings, or partnership discussions

If you are invited to our client portal, we also process:

• Portal account details: your name, email address, company and role, so you can sign in and see the resources shared with your organisation. Portal accounts are invitation-only; we do not open public sign-up.
• Sign-in security records: the times of sign-in attempts and the network address you connect from, kept only to protect the account from guessing and abuse.
• What you send through the portal: an access request, an enquiry, or a message, so our team can respond.

We do not use tracking pixels, advertising cookies or third-party analytics on this website. If you click Accept on our cookie banner, we also measure visits with analytics software that we host ourselves; section 5 explains what it records.

3. How We Use Your Data

We use the personal data you provide to:

• Respond to your enquiries and provide requested information
• Arrange consultations, demonstrations, or meetings
• Deliver our professional services under contract
• Send relevant communications about our services (only with your consent)
• Run the client portal and keep it secure (for portal account holders)

We do not sell, rent, or share your personal data with third parties for marketing purposes.

If a portal page offers a search box, the words you type are sent over a secure connection to a search service operated by Blue Note Logic on our behalf, which returns matching passages from our own published material. The search is a keyword lookup: your query is not sent to any third-party AI provider, and no answer is generated by an external model. We keep a short operational record of searches to run and protect the service.

4. Legal Basis for Processing

Under the Data Protection (Bailiwick of Guernsey) Law, 2017 and the EU General Data Protection Regulation (GDPR), we process your data on the following legal bases:

• Consent: when you submit a contact form or opt in to communications, and for analytics when you click Accept on our cookie banner
• Legitimate interest: to respond to business enquiries and improve our services
• Contractual necessity: to deliver services you have engaged us to provide

5. Cookies & Local Storage

This website uses minimal browser storage:

Name	Type	Purpose	Duration
site-theme	localStorage	Remembers your light/dark display preference	Until cleared
site-cookie-consent	localStorage	Records your cookie consent choice	Until cleared
portalsess	Session cookie	Keeps you signed in to the client portal; set only when you use a portal sign-in page	Browser session
PHPSESSID	Session cookie	Admin authentication only (not set for public visitors)	Browser session

Analytics, only if you click Accept

If you click Accept on our cookie banner, we measure visits with OpenPanel, open-source analytics software that we host ourselves. It sets no cookies and stores nothing in your browser. For each page view it records the page, the site that referred you, links you follow to other websites, your browser, operating system and type of device, and an approximate location (country, region and city) worked out from your IP address. The analytics data does not include your IP address itself; visits are grouped under a pseudonymous identifier. It is deleted automatically after 13 months.

If you click Decline, or make no choice, nothing is loaded or recorded. You can change your mind at any time with Cookie settings at the foot of every page.

We do not use:

• Google Analytics or any other third-party analytics service
• Advertising or remarketing cookies
• Third-party social media tracking pixels

6. Data Sharing

We may share your data with:

• Hosting providers: our website is hosted on secure servers; providers act as data processors under contract
• Blue Note Logic Inc: builds, hosts and maintains this website and its client portal as our data processor, under a data-processing agreement, and does not use your data for its own purposes
• Professional advisors: legal or financial advisors where necessary
• Legal requirements: where required by law or to protect our legal rights

We do not transfer personal data outside the European Economic Area (EEA) or the Bailiwick of Guernsey without appropriate safeguards.

7. Data Retention

We retain personal data only for as long as necessary:

• Contact form submissions: 24 months from submission, unless an ongoing business relationship is established
• Client project data: for the duration of the engagement plus 6 years (as required for contractual and tax purposes)
• Portal accounts: for as long as your organisation has portal access, then removed
• Unverified sign-ups and unaccepted invitations: removed after 30 days
• Network addresses in the portal's security log: removed after 90 days; the underlying records are kept only as long as needed to run the service
• Marketing consent records: until consent is withdrawn

8. Your Rights

Under applicable data protection law, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict processing of your data
• Object to processing based on legitimate interest
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time (without affecting prior lawful processing)

To exercise any of these rights, contact us at info@exos-systems.com. We will respond within 30 days.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• ISO/IEC 27001:2022 certified delivery controls
• HTTPS encryption on all web traffic
• Access controls and authentication for all systems
• Regular security reviews

10. Supervisory Authority

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with:

Office of the Data Protection Authority (ODPA)
St Martin's House, Le Bordage, St Peter Port, Guernsey, GY1 1BR
Website: www.odpa.gg
Email: enquiries@odpa.gg

For individuals in the EU, you may also contact your local data protection authority.

11. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically.

12. Contact Us

For any questions about this policy or your personal data:

Exos Systems Limited
Email: info@exos-systems.com
Website: Contact page