Privacy Policy
This policy explains what personal data SXB Global processes, why, who we share it with, and the rights you have over it.
Last updated: August 2026
1. Who controls your data
The data controller for the personal data described in this policy is SXB Ltd, which trades as SXB Global.
SXB Ltd
Company No: 16679668
2 Victoria Square, Victoria Street, St. Albans, AL1 3TF, United Kingdom
Email: info@sxb.global
As a UK-registered company we process personal data under the UK GDPR and the Data Protection Act 2018. Our supervisory authority is the Information Commissioner's Office (ICO).
2. What we collect
What you give us through the case form or by email
- Identity and contact details: name, company, email address, telephone number
- Case information: the debtor's country, the approximate value of the claim, and your description of how the debt arose and what has been attempted
- Case documents: invoices, contracts and purchase orders, proof of delivery or acceptance, and correspondence - where you choose to send them
What is generated when you visit the site
- IP address, browser and device information, pages viewed and time of visit
- Server access logs, kept for security and fault diagnosis
We do not collect special category data (such as health, biometric or political data) through this website, and we ask that you do not send it to us as part of a case file.
3. Information about debtors and other third parties
This section matters more in our work than in most, and is worth reading carefully.
When you send us a case, you will usually be sending personal data about people other than yourself - the name and contact details of an individual at the debtor company, their correspondence, or details of a guarantor. We process that information in order to assess and pursue the debt.
By sending us personal data about third parties, you confirm that you are legally entitled to do so. We ask that you share only what is genuinely necessary for the recovery of the debt.
Individuals whose data we receive from you rather than from themselves have a right to be informed under the UK GDPR. We will explain to them how we process their data, our lawful basis and their rights - except where doing so would render the recovery of the debt, or the establishment of legal rights, impossible or seriously impaired, in which case the exemptions the UK GDPR provides may apply.
Our lawful basis for processing debtor data is legitimate interests: the establishment, exercise and defence of legal claims, and the recovery of a commercial debt. We weigh that interest against the rights and freedoms of the individual on each case.
4. Why we process it, and our lawful basis
The UK GDPR requires a lawful basis for each processing activity. Ours are set out below.
| Purpose | Lawful basis |
|---|---|
| Assessing your case - reviewing recoverability and preparing a strategy and fee proposal | Steps prior to entering a contract (Art. 6(1)(b)), taken at your request |
| Providing the service - running the recovery, reporting to you, coordinating local counsel | Performance of a contract (Art. 6(1)(b)) |
| Responding to enquiries - email and telephone correspondence | Legitimate interests (Art. 6(1)(f)) - responding to a request |
| Processing debtor data - establishing and pursuing the claim | Legitimate interests (Art. 6(1)(f)) - establishment, exercise or defence of legal claims |
| Site security and diagnostics - server logs | Legitimate interests (Art. 6(1)(f)) - security of our systems |
| Meeting legal obligations - accounting, tax, anti-money-laundering and court orders | Legal obligation (Art. 6(1)(c)) |
| Sending commercial updates - where you ask for them | Consent (Art. 6(1)(a)) - withdrawable at any time |
Where we rely on legitimate interests we carry out a balancing assessment against your rights and freedoms. You can ask us for details of that assessment.
5. Who we share it with
We never sell personal data and we do not pass it to third parties for their own marketing. It is shared only in the following circumstances, and only to the extent necessary.
Local counsel and legal professionals
This is central to our service. Where recovery requires legal steps in the debtor's jurisdiction, we coordinate the instruction of appropriately authorised local counsel in that country, and the file is shared with them - your contact details, the case information, the debtor information and the supporting documents.
We transfer a file to local counsel only after informing you first. Those professionals are bound by their own professional confidentiality obligations, and by the confidentiality and data protection terms of their engagement with us. They act as controllers in their own right in relation to the legal services they provide.
Our service providers
- Hosting and infrastructure providers - for the website and stored data
- Email and communication services - for correspondence with you
- Case and client management systems - for running your file
These providers act as processors on our behalf, processing data only on our instructions and within contractually defined limits.
Authorities
Where required by law - courts, regulators or law enforcement - or where necessary to establish, exercise or defend legal claims.
6. Transfers outside the UK
Our service is international by nature. Wherever your debtor is based, the file will be shared with professionals in that country - which means personal data leaves the United Kingdom.
The UK GDPR requires safeguards for such transfers. We rely on at least one of the following:
- UK adequacy regulations - for countries the UK government has recognised as providing adequate protection, including the European Economic Area
- The International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum, for transfers to countries without adequacy
- Necessity for the establishment, exercise or defence of legal claims (Art. 49 UK GDPR) - an exception that may apply on particular files
You can ask us which country your file has been transferred to and which mechanism was used.
7. How long we keep it
| Data | Retention period |
|---|---|
| Case enquiries that do not become instructions | 24 months from last contact |
| Records and correspondence on instructed cases | 6 years from closure, reflecting contractual limitation periods |
| Accounting and tax records | As required by law (minimum 6 years) |
| Server access logs | Up to 12 months |
| Consent records for commercial updates | Until consent is withdrawn |
At the end of the period data is securely deleted or anonymised.
8. Your rights
Under the UK GDPR you have the right to:
- Access - obtain a copy of the personal data we hold about you
- Rectification - have inaccurate or incomplete data corrected
- Erasure - have data deleted in defined circumstances
- Restriction - limit how we process your data in defined circumstances
- Portability - receive data you provided in a structured, machine-readable format
- Object - to processing based on legitimate interests, and to direct marketing
- Withdraw consent - where processing is based on consent; withdrawal does not affect the lawfulness of processing before it
To exercise any of these, write to info@sxb.global. We respond within one month as a rule; where a request is complex that period may be extended by a further two months, and we will tell you if so. Exercising your rights is free of charge.
We may ask for information to verify your identity - this is to prevent your data being disclosed to someone else.
9. Security
We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration and unauthorised access. These include encryption in transit (TLS), access controls, and restricting access to those who need it for their work.
Where a personal data breach occurs and it presents a risk to your rights, we will notify the ICO and, where required, you, in the manner and within the timeframes the law provides.
10. Cookies
How cookies and similar technologies are used on this site is set out in our Cookie Policy.
11. Changes to this policy
We may update this policy from time to time. The current version is always published on this page and the "last updated" date above is revised. Where a change is material and we have an ongoing relationship with you, we will tell you separately.
12. Contact and complaints
For any question, request or concern about how we handle personal data: info@sxb.global
We would ask you to come to us first - we will do what we can to resolve the matter. If you remain dissatisfied, you have the right to complain to the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Web: ico.org.uk/make-a-complaint