Winxtra GDPR Compliance Statement
Last updated: 01 August 2026
Winxtra is a trading name of Win Labs Group Limited.
We are committed to protecting personal data and operating our services in accordance with applicable data protection law, including the UK GDPR and Data Protection Act 2018, and the EU GDPR where it applies to our activities.
Winxtra provides win/loss analysis, churn analysis, buyer research and related research and insight services. This statement explains the principles and safeguards we apply when processing personal data.
1. Our role in processing personal data
Winxtra may act as either a data controller or a data processor, depending on the service and processing activity.
Where a client determines the purposes for which personal data is processed and Winxtra processes that data on the client's documented instructions, Winxtra generally acts as a data processor.
Winxtra may act as a data controller where we determine the purposes and means of processing, including for activities such as:
operating our website and Services;
managing client and business relationships;
maintaining security and service records;
conducting certain B2B research activities;
managing research participation and communications; and
complying with legal and regulatory obligations.
The applicable Service Agreement or Data Processing Agreement may further define these responsibilities for individual client engagements.
2. Data protection principles
We aim to process personal data in accordance with the following principles:
Lawfulness, fairness and transparency — we identify an appropriate lawful basis and explain how personal data is used.
Purpose limitation — personal data is collected for specified and legitimate purposes.
Data minimisation — we seek to process only the information reasonably necessary for the relevant service.
Accuracy — we take reasonable steps to maintain accurate information where accuracy is relevant.
Storage limitation — identifiable personal data is not retained for longer than reasonably necessary.
Integrity and confidentiality — appropriate technical and organisational measures are used to protect personal data.
Accountability — we maintain appropriate policies, contracts and controls governing our processing activities.
3. Lawful bases for processing
The lawful basis used depends on the specific processing activity.
Winxtra may rely on:
Legitimate interests
We may process personal data where necessary for legitimate business purposes and where those interests are not overridden by the rights and interests of the individual.
This may include:
conducting B2B win/loss and buyer research;
identifying and contacting relevant professional research participants;
managing business relationships;
maintaining security;
improving our Services; and
operating and developing our business.
Where appropriate, we assess the necessity and privacy impact of processing based on legitimate interests.
Contract
We may process personal data where necessary to perform a contract with an individual or to take steps at their request before entering into a contract.
Where our contract is with a client organisation rather than the individual concerned, we do not assume that contractual necessity automatically applies to all personal data associated with that engagement.
Consent
We may rely on consent where appropriate, including for certain recordings, optional activities or technologies.
Where we rely on consent, it may be withdrawn at any time.
Legal obligation
We may process personal data where necessary to comply with legal, regulatory, tax, accounting or other obligations applying to Winxtra.
Processing on behalf of clients
Where Winxtra acts as a processor, the client is generally responsible for establishing the lawful basis for the underlying processing.
Winxtra processes that information only in accordance with documented instructions and applicable contractual requirements.
4. Personal data we process
Depending on the engagement, we may process information including:
names;
job titles and professional roles;
employer or company affiliation;
business email addresses and contact details;
CRM opportunity information;
deal value, stage, status and outcome;
relevant CRM notes;
interview responses;
opinions and business experiences;
survey responses;
interview recordings and transcripts;
platform account and authentication information;
API or MCP access information;
technical and security logs; and
publicly available professional information used to support B2B research.
We seek to limit processing to information reasonably required for the agreed purpose.
5. Special-category data
Winxtra does not ordinarily seek or require special-category personal data.
Because research interviews allow participants to speak freely, an individual may occasionally disclose information that falls within a special category of personal data.
Where this occurs, we assess whether there is an appropriate legal basis and condition for retaining or processing that information. Information that is unnecessary for the research may be excluded or removed.
Clients should not intentionally provide special-category or highly sensitive personal data to Winxtra unless it is necessary for the agreed service and appropriate arrangements have been agreed in advance.
6. Data hosting and international transfers
Winxtra takes data location and international transfers into account when selecting infrastructure and service providers.
Our primary systems for storing identifiable client and research data are intended to use UK or EEA-based hosting where practical and appropriate to the service.
Some approved technology providers, subprocessors or support services may process or make personal data accessible outside the UK or EEA.
Where this constitutes a restricted international transfer, we use an appropriate transfer mechanism as required by applicable data protection law. Depending on the destination and circumstances, this may include:
UK adequacy regulations;
the UK International Data Transfer Agreement;
the UK Addendum to EU Standard Contractual Clauses;
EU Standard Contractual Clauses where the EU GDPR applies; or
another legally recognised safeguard or exemption.
We assess international data transfers and associated safeguards where required.
7. Security measures
Winxtra maintains technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss and destruction.
Depending on the system and processing risk, these measures include:
encryption of data in transit;
encryption of stored data where appropriate;
role-based and restricted access controls;
least-privilege access;
multi-factor authentication for relevant systems and privileged access where supported;
secure authentication and API access controls;
logging and security monitoring;
confidentiality obligations for personnel and contractors;
controlled access to client information;
security-conscious selection of infrastructure and technology providers; and
procedures for responding to data-security incidents.
Our security arrangements are reviewed as our technology and Services evolve.
8. Interviews, recordings and transcripts
Where research interviews are recorded, participants are informed that recording is taking place.
Recordings are used primarily for transcription and quality assurance and are deleted after transcription and any necessary quality checks have been completed.
Transcripts and research information are retained only for as long as required for the relevant client engagement, contractual requirements and legitimate operational needs.
Access is restricted to authorised personnel and approved service providers who require the information to perform their role.
9. Artificial intelligence and automated processing
Winxtra may use artificial intelligence, language models, machine-learning systems and other automated tools to support activities including:
transcription;
categorisation and tagging;
summarisation;
thematic analysis;
research analysis;
quality assurance; and
preparation of analytical outputs.
These technologies support our research process rather than replacing responsibility for the service provided to clients.
We do not intentionally permit identifiable client CRM data, interview data or research material to be used to train general-purpose third-party AI models.
Where client or research information is reused by Winxtra for benchmarking or model improvement, we first seek to anonymise it so that individuals are no longer identifiable.
10. Anonymisation, benchmarking and model improvement
Winxtra may create anonymised information from data processed through our Services.
Genuinely anonymised information may be used for purposes including:
aggregate benchmarking;
identifying market and research trends;
improving analytical methodologies;
evaluating research quality;
improving Winxtra models and classification systems; and
developing new analytical capabilities.
Removing a name or email address alone does not necessarily make information anonymous.
We take account of the risk that an individual could be identified directly or indirectly before treating information as anonymised.
Where information remains identifiable, we continue to treat it as personal data.
11. Subprocessors
Winxtra uses selected technology and service providers to support the delivery and operation of our Services.
These may include providers of:
cloud infrastructure;
transcription;
artificial intelligence and analytical services;
authentication and security;
communications;
CRM and operational systems;
survey and research technology; and
technical monitoring and support.
Where a provider processes personal data on our behalf, we require appropriate contractual and data-protection arrangements.
Where required for a client engagement, our use of subprocessors is governed by the relevant Data Processing Agreement.
Information about relevant subprocessors is available by contacting privacy@winxtra.co.uk.
12. Data retention and deletion
We apply retention periods according to the nature and purpose of the information.
Our general approach is that:
interview recordings are deleted after transcription and necessary quality checks;
identifiable client project data is retained only while required to provide the agreed Services;
following client offboarding, identifiable client project data will ordinarily be deleted or returned within 30 days, unless another period has been agreed or retention is legally required;
security, contractual, accounting and operational records may be retained for longer where reasonably necessary; and
genuinely anonymised information may be retained for benchmarking, research and model-improvement purposes.
13. Data subject rights
Individuals may have rights under applicable data protection law including the right to:
access their personal data;
correct inaccurate or incomplete information;
request erasure;
request restriction of processing;
object to certain processing;
request data portability in applicable circumstances; and
withdraw consent where processing is based on consent.
These rights are not absolute and depend on the circumstances and lawful basis involved.
Where Winxtra acts solely as a processor, we may refer a request to the relevant client as data controller.
Requests can be submitted to:
We will respond without undue delay and within the period required by applicable data protection law.
Individuals also have the right to raise a complaint with the Information Commissioner's Office (ICO).
14. Data protection by design
We consider privacy and data protection when designing and changing our systems, processes and Services.
This includes considering:
the amount of personal data required;
access permissions;
data location;
retention;
security;
subprocessors;
international transfers;
anonymisation;
use of artificial intelligence; and
the potential impact on individuals.
Where processing is likely to create a high risk to individuals, we will assess whether a Data Protection Impact Assessment is required.
15. Further information
This statement should be read alongside our:
Privacy Policy;
Terms of Use; and
applicable Service Agreements and Data Processing Agreements.
For questions about privacy, data protection or our processing practices, contact:
Data Protection
privacy@winxtra.co.uk
Winxtra is a trading name of:
Win Labs Group Limited
Registered in England and Wales
Company number: 17126005
Registered office: 167–169 Great Portland Street, London, United Kingdom, W1W 5PF