Train the Universe Limited ("Train the Universe", "we", "us", or "our"), a company registered in Scotland and the proprietor of the X& digital services platform, is committed to the responsible collection, processing, and protection of personal data in compliance with applicable data protection laws, including the UK General Data Protection Regulation ("UK GDPR"), the EU GDPR where applicable, and other relevant privacy legislation.
This Privacy Policy forms an integral part of the Terms and Conditions of Use – X& Services and should be read in conjunction with those terms. By accessing or using our website, platform, mobile applications, or associated services (collectively, the "Services"), you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy. If you do not agree with the practices described herein, you should not use the Services.
1. SCOPE AND AMENDMENTS
We reserve the right to update this Privacy Policy at our sole discretion to reflect changes in legal, technical, or operational requirements. Material amendments will be notified via prominent in-service notices at least seven (7) days prior to taking effect. Continued use of the Services after such changes are posted constitutes acceptance of the revised Privacy Policy.
2. DATA CATEGORIES WE PROCESS
We collect and process two primary categories of data:
a. Non-Personal Information (NPI):
This includes data that does not directly or indirectly identify a natural person. Such data may include:
- Technical and usage information (e.g., browser type, device model, operating system, language preference, clickstream data).
- Aggregate statistical information used for performance monitoring and service optimisation.
- Digital advertising identifiers (e.g., Google Click ID) for analytics and conversion tracking purposes.
This information is collected passively and is not associated with an individual's identity. No cookies are used for this purpose unless otherwise disclosed.
b. Personal Information (PI):
This includes any data that, alone or in combination with other data, can identify or be used to identify an individual. PI may be collected:
- Through account registration or use of an X&+ account (e.g., IP address, usage patterns, authentication details).
- Via third-party landing pages linked through our Services (e.g., when redirected to a Partner form and voluntarily submitting contact details such as name, email, phone number).
- When directly contacting us, including via email or support channels.
- Through interaction with embedded or integrated third-party tools, such as CAPTCHA systems, which collect behavioral and technical data to verify human activity.
Where Non-Personal Information is combined with Personal Information, the combined data will be treated as Personal Information.
3. DATA COLLECTION METHODS
Personal and Non-Personal Information is collected through the following mechanisms:
- Direct interactions: Communications initiated by you via contact forms, email, or similar means.
- Automated technologies: Cookies, analytics scripts, tracking pixels, and session recording technologies embedded in the Services.
- Third-party integrations: Embedded service providers and partners (e.g., social platforms, analytics providers).
Please refer to our Cookie Policy for a comprehensive breakdown of tracking mechanisms employed.
4. USE OF PERSONAL INFORMATION
Personal Information may be used for the following purposes:
- To operate, maintain, and provide the Services;
- To customise and improve the user experience;
- To support advertising delivery and performance analytics;
- To detect, investigate and prevent fraud, abuse, or security incidents;
- To verify user identities and comply with legal obligations;
- To process and respond to user requests and customer service enquiries;
- To conduct internal research and aggregated analytics;
- To enforce our Terms of Use and defend legal claims;
- To support lawful requests from law enforcement or regulatory bodies.
5. LEGAL BASES FOR PROCESSING
We rely on one or more of the following legal bases to process your Personal Information:
- Consent – where required, and specifically obtained.
- Performance of a contract – when providing our Services to you.
- Compliance with legal obligations – where necessary under applicable laws.
- Legitimate interests – to improve and protect the Services, unless overridden by your rights and freedoms.
6. DATA SHARING AND INTERNATIONAL TRANSFERS
We do not sell or rent Personal Information. We may share data with:
- Affiliates and subsidiaries of Train the Universe Limited;
- Service providers and data processors under contractual obligations consistent with this Policy;
- Partners and third-party platforms where users opt-in or are redirected (e.g., landing pages), each subject to their own privacy terms;
- Cloud service providers and data hosting platforms located globally, subject to appropriate safeguards such as Standard Contractual Clauses.
You consent to such transfers by using the Services.
7. THIRD-PARTY SITES AND SERVICES
Our Services may link to third-party websites, platforms, and offers. These third parties operate independently and are not governed by this Privacy Policy. We are not responsible for the privacy practices, data use, or content of such external services.
We recommend reviewing the privacy policies of any third-party services before providing them with Personal Information.
8. DATA RETENTION
Personal Information is retained only as long as necessary:
- To fulfil the purposes outlined herein;
- To comply with legal obligations;
- To resolve disputes and enforce agreements.
You may request deletion or correction of your data by emailing us at lib@ttuxand.com, subject to applicable retention obligations.
9. DATA SUBJECT RIGHTS
a. Under UK and EU GDPR, you may:
- Request access to your Personal Information;
- Request rectification or erasure of your data;
- Restrict or object to processing;
- Withdraw consent at any time;
- Lodge complaints with the UK Information Commissioner's Office or equivalent EU body.
b. Other Jurisdictions:
Where applicable, you may have similar rights under the data protection laws of your jurisdiction. Please contact lib@ttuxand.com to exercise such rights.
10. SECURITY MEASURES
We implement industry-standard administrative, technical, and physical safeguards, including:
- Encrypted transmission using SSL;
- Segregated access controls and personnel training;
- Use of certified third-party platforms with compliance credentials.
Despite these efforts, no transmission method is infallible, and we do not guarantee absolute security.
11. CHILDREN'S PRIVACY
The Services are not directed to individuals under the age of 18. We do not knowingly collect Personal Information from minors. If we become aware that a minor has provided us with Personal Information, we will delete such information promptly. Parents or legal guardians with concerns may contact us directly.
12. USER CHOICES AND "DO NOT TRACK"
You may control your data through:
- Browser settings to block or remove cookies;
- Opting out of marketing communications;
- Submitting requests for access or deletion.
We do not currently respond to browser-based "Do Not Track" (DNT) signals.
13. CONTACT INFORMATION
To exercise your rights, report a privacy concern, or request additional information, please contact:
Data Protection Officer
Train the Universe Limited
Benview, Brora, Scotland, KW9 6QN
Email: lib@ttuxand.com
Effective Date: August 2025
Last Updated: August 2025