Privacy Policy – Winxtra
Last updated: 01 August 2026
1. Who we are
Winxtra is a trading name of Win Labs Group Limited, a company registered in England and Wales.
We provide win/loss analysis, churn analysis, buyer research and related research and insight services through interviews, reports, consulting services, client portals, APIs, MCP interfaces and other digital services.
For the purposes of applicable data protection law, Win Labs Group Limited may act as either a data controller or a data processor, depending on the circumstances.
Where we determine why and how personal data is processed, for example in relation to our website, business administration or certain research activities, we act as a data controller.
Where we process personal data solely on behalf of a client and in accordance with that client's instructions, we generally act as a data processor. Those processing arrangements may also be governed by a Data Processing Agreement or other contractual terms with the client.
2. What this Privacy Policy covers
This Privacy Policy explains how we collect, use, store, share and protect personal data relating to:
visitors to the Winxtra website;
users of Winxtra portals, APIs and MCP services;
our clients and prospective clients;
employees and representatives of client organisations;
individuals invited to participate in interviews or research;
interview participants;
internal client stakeholders participating in surveys;
business contacts; and
other individuals whose personal data is provided to us in connection with our Services.
This Policy should be read alongside any applicable Service Agreement, Data Processing Agreement, interview privacy information or other notice provided in connection with a particular engagement.
3. Personal data we collect
The personal data we process depends on how you interact with Winxtra and the service being provided.
Client and opportunity data
Clients may provide us with information relating to sales opportunities, customers, prospects and business contacts, including:
name;
employer or organisation;
job title and business role;
business contact details;
opportunity status;
deal value;
close date;
product or service involved;
sales stage;
account or opportunity information;
relevant CRM notes; and
other information required to conduct win/loss, churn or buyer research.
We ask clients to provide only information reasonably required for the agreed service.
Interview and research data
When you participate in Winxtra research, we may process:
your name and business contact details;
your organisation and role;
interview responses;
opinions, experiences and perceptions;
audio recordings where the interview is recorded;
interview transcripts;
survey responses; and
information derived from or summarising the interview.
We will make participants aware when an interview is being recorded.
Internal stakeholder information
Where a client asks us to collect internal perspectives, we may process information including:
name;
role;
organisation;
survey responses;
comments;
perceptions of an opportunity or customer relationship; and
other relevant business information.
Website and service usage information
When you use our website or digital Services, we may collect technical information such as:
IP address;
browser and device information;
authentication and account information;
access logs;
security events;
pages or features accessed;
API or MCP requests;
timestamps; and
cookie or similar technology identifiers where applicable.
Information from public and third-party sources
For legitimate B2B research and business purposes, we may obtain professional information from publicly available or commercially available sources, including:
company websites;
professional profiles;
business directories;
public corporate information;
publicly available contact information; and
information supplied by our clients.
We may use this information to identify or validate appropriate research participants and business contacts.
4. Special-category personal data
Winxtra does not ordinarily seek or require special-category personal data such as information concerning health, ethnicity, religion, political opinions, trade-union membership, genetic or biometric information or sexual orientation.
However, because interviews involve individuals discussing their experiences in their own words, a participant may occasionally disclose information of this nature voluntarily.
Where this occurs, we will only retain or process that information where there is an appropriate lawful basis and condition for doing so. Where it is not relevant or necessary to the research, we may remove or exclude it from our analysis.
We ask clients not to provide special-category or other highly sensitive personal data unless it is genuinely necessary and has been agreed with Winxtra in advance.
5. How we use personal data
We may process personal data to:
deliver contracted services to clients;
identify and contact suitable research participants;
arrange and conduct interviews;
record and transcribe interviews where appropriate;
analyse interview and survey responses;
compare external buyer perceptions with internal stakeholder perceptions;
create client reports and research outputs;
operate client portals and other digital Services;
authenticate users and manage access;
provide API and MCP functionality;
maintain the security, reliability and performance of our Services;
communicate with clients and business contacts;
respond to enquiries;
administer contracts, invoicing and business relationships;
comply with legal and regulatory obligations;
establish, exercise or defend legal claims; and
improve our services and methodologies.
6. Our lawful bases for processing
The lawful basis we rely on depends on the activity and our role in the processing.
Contract
We may process personal data where this is necessary to perform a contract with an individual or to take steps at their request before entering into a contract.
A contract between Winxtra and a client organisation does not automatically provide the lawful basis for processing personal data relating to every individual associated with that client.
Legitimate interests
We may rely on legitimate interests where processing is necessary for legitimate business purposes and those interests are not overridden by an individual's rights and interests.
These purposes may include:
conducting B2B research;
contacting relevant business professionals about research relating to their organisation or experience;
improving our Services;
protecting the security of our systems;
managing business relationships; and
developing and operating our business.
Where appropriate, we assess the necessity and potential privacy impact of processing carried out on this basis.
Consent
We may rely on consent where appropriate, including for certain recordings, communications, cookies or optional processing activities.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
Legal obligations
We may process personal data where necessary to comply with legal, regulatory, accounting or other obligations that apply to us.
Processing on behalf of clients
Where Winxtra acts as a processor, the client is generally responsible for determining the lawful basis for the underlying processing.
Winxtra processes that information in accordance with the client's documented instructions and the applicable Data Processing Agreement or Service Agreement.
7. Interview recordings and transcripts
Where an interview is recorded, the recording is used primarily to create an accurate transcript and support quality assurance.
Interview recordings are deleted after transcription and any necessary transcription quality checks have been completed.
Transcripts and relevant research information may be retained for the period necessary to deliver the client's service and in accordance with the applicable Service Agreement and retention requirements.
Access to recordings and transcripts is restricted to authorised personnel and approved service providers who require access to perform their role.
8. AI and automated processing
Winxtra may use artificial intelligence, language models, machine-learning systems and other automated tools to assist with activities such as:
transcription;
categorisation and tagging;
summarisation;
research analysis;
identifying themes or patterns;
quality assurance; and
generating draft analytical outputs.
We use these systems as tools to support our research and analysis processes.
We do not use identifiable client, interview or CRM data to train general-purpose AI models for third parties.
Where information is reused for Winxtra benchmarking or model improvement, we first seek to anonymise it so that individuals are no longer identifiable.
Material client deliverables may also be subject to human review as appropriate to the service being provided.
9. Anonymised data, benchmarking and model improvement
Winxtra may create anonymised information from data processed through the Services.
We may retain and use genuinely anonymised information for purposes including:
benchmarking;
identifying aggregate trends;
improving our analytical methodologies;
improving Winxtra models and classification systems;
evaluating the quality of our research processes;
developing new analytical capabilities; and
generating aggregate market insights.
Before information is used for these purposes, we take steps designed to remove or sufficiently reduce identifiers and the risk that an individual can reasonably be identified from the information.
We do not treat data as anonymous merely because obvious identifiers such as a person's name or email address have been removed.
Where information remains capable of identifying an individual, directly or indirectly, we continue to treat it as personal data and apply appropriate data-protection requirements.
Genuinely anonymised information may be retained for longer periods because it is no longer personal data.
10. Client confidentiality
Personal data is separate from our wider contractual confidentiality obligations.
Client information, research findings, commercial information and interview material are handled in accordance with our contractual confidentiality obligations and are made available only to authorised parties.
We do not sell client research data or personal data.
11. Who we share personal data with
We may share personal data with carefully selected service providers where necessary to operate or deliver our Services.
These may include providers of:
cloud infrastructure and data hosting;
transcription technology;
artificial intelligence and analytical technology;
communications and email services;
authentication and security services;
customer relationship management systems;
survey and research systems;
monitoring and technical support services; and
professional services such as legal, accounting or insurance advisers.
Where these organisations process personal data on our behalf, we require appropriate contractual and security protections.
We may also disclose information where required by law, regulation, court order or another lawful authority.
We do not sell personal data to data brokers, advertisers or other third parties.
12. Data location and international transfers
Winxtra is based in the United Kingdom and seeks to keep identifiable client and research data within the UK or European Economic Area where practical and consistent with the relevant client agreement.
Our primary data-storage arrangements are configured accordingly.
Some technology providers or their support operations may involve processing or access from other jurisdictions.
Where a transfer of personal data outside the UK is subject to UK data-protection transfer restrictions, we use an appropriate lawful mechanism and safeguards as required by applicable law.
Further information about safeguards relevant to a particular processing activity can be requested from privacy@winxtra.co.uk.
13. Security
We use appropriate technical and organisational measures designed to protect personal data against:
unauthorised access;
accidental loss;
misuse;
alteration;
unauthorised disclosure; and
destruction.
Measures may include access controls, authentication, encryption, restricted administrative access, infrastructure security, logging and contractual confidentiality requirements.
Access to client and interview information is limited to authorised personnel and approved service providers who require it for legitimate business purposes.
No internet-based service can be guaranteed to be completely secure, but we take security proportionate to the nature of the information and risks involved seriously.
14. Data retention
We retain identifiable personal data only for as long as reasonably necessary for the purpose for which it was collected, including contractual, legal, security and regulatory requirements.
In particular:
interview recordings are deleted after transcription and necessary quality checks;
client project data is retained while required to provide the agreed Services;
following termination or completion of a client engagement, identifiable client data will ordinarily be deleted or returned within 30 days, unless a different period is agreed with the client or retention is required by law;
business administration, accounting and contractual records may be retained for longer where necessary to comply with legal obligations or protect legal rights; and
security and technical logs may be retained for a reasonable period for security, audit and service-integrity purposes.
Where data has been genuinely anonymised, it may be retained for benchmarking, analytical and model-improvement purposes without the same retention period applying to the original personal data.
15. Your rights
Depending on the circumstances and applicable lawful basis, you may have the right to:
request access to personal data we hold about you;
request correction of inaccurate or incomplete information;
request deletion of your personal data;
request restriction of processing;
object to certain processing;
request transfer of your personal data in certain circumstances; and
withdraw consent where we rely on consent.
You have the right to object to processing based on legitimate interests.
These rights are not absolute and may not apply in every circumstance.
Where Winxtra processes your personal data solely as a processor for one of our clients, we may need to refer your request to that client as the relevant data controller.
To exercise your rights, contact:
We may need to verify your identity before completing a request.
16. Research invitations
If we contact you to participate in research, participation is voluntary.
You may decline an invitation or ask us not to contact you again in relation to that research.
Declining to participate will not affect any commercial relationship you may have with the client that commissioned the research.
Where practicable, Winxtra aims to separate individual research responses from direct attribution when producing aggregated or thematic analysis. However, the precise reporting arrangements may vary according to the research engagement and information provided to participants.
17. Cookies and similar technologies
Our website and digital Services may use cookies and similar technologies for purposes including:
essential website functionality;
authentication;
security;
remembering preferences;
performance monitoring; and
understanding how our Services are used.
Some technologies are necessary for the website or Services to function and may be used without consent where permitted by law.
Where consent is legally required for non-essential cookies or similar technologies, we will request it before those technologies are used.
Where the law permits another exemption or mechanism, we will provide the information and controls required by applicable law.
We do not use cookies to track individuals' browsing activity across unrelated third-party websites for advertising purposes.
18. Marketing and business communications
We may contact existing and prospective business customers using professional contact information where permitted by law.
Where required, we will provide a clear means to opt out of marketing communications.
Research invitations are generally sent for research purposes rather than consumer advertising, but recipients may ask not to receive further invitations from us.
19. Children's data
Winxtra's Services are intended for business users and professional research participants.
We do not knowingly target or provide our Services to children.
20. Complaints
If you have a concern about how we use your personal data, please contact us first at:
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.
21. Changes to this Privacy Policy
We may update this Privacy Policy as our Services, technology or legal obligations change.
The current version will be published on our website with the date it was last updated.
Where appropriate, we may provide additional notice of material changes.
22. Contact and company information
Data Protection
privacy@winxtra.co.uk
Winxtra is a trading name of:
Win Labs Group Limited
Registered in England and Wales
Company number: 17126005
Registered office: 167–169 Great Portland Street, London, United Kingdom, W1W 5PF