Privacy Policy

1. Who is responsible

XiaoYuan Networks Limited, registered in England and Wales under company number 17152856, is the controller of personal information processed for the purposes described in this policy. This means we decide why and how that information is used.

This policy covers this public website, peering and NOC enquiries submitted here, and related correspondence. It does not describe all processing under a separate connectivity or infrastructure service agreement; additional notices may apply to those services.

2. Information we collect

• Enquiry details: your name, email address, optional autonomous system number (ASN), message, enquiry type and related correspondence. A message may include business contact details, prefixes, timestamps or technical reports you choose to provide.
• Technical information: requests to the website and form service expose information such as your IP address, browser or user-agent details, requested URL, referring page, time of access and delivery or error information to the relevant hosting, security and form providers.
• Preferences: your browser’s light or dark preference and a manually selected theme stored on your device.

We obtain information directly from you and automatically through requests to the website and its form service. If you act for another organisation, we may receive relevant business contact details from your colleagues during follow-up.

The website has no user registration, payment collection or file-upload feature. Please avoid passwords, private keys, identity documents, payment details and unnecessary sensitive personal information. Redact information about other people from technical reports where possible.

3. Why we use information

We use enquiry details to understand and answer your request, assess potential connectivity or peering arrangements, troubleshoot reported issues and maintain relevant correspondence. We use technical information to deliver the website, diagnose errors, prevent spam and protect systems. Theme information is used to display your preferred appearance.

We may also need relevant records to comply with a legal duty, investigate misuse, handle complaints or establish, exercise or defend legal claims. We do not sell personal information, build advertising profiles or automatically add enquirers to a marketing mailing list.

4. Our lawful bases

• Legitimate interests: handling business enquiries, communicating with representatives of operators and partners, protecting the website, preventing abuse and resolving disputes. Our interests are conducting our business and maintaining a useful, secure website, balanced against your rights and expectations.
• Steps towards a contract: where you personally ask us to take steps necessary before entering into a contract with you. This basis does not automatically apply just because you represent a company.
• Legal obligation: where a specific legal duty requires us to retain or disclose information.

We do not treat sending an enquiry or accepting the Terms of Use as blanket consent to unrelated processing. Where a future optional activity requires consent, we will request it separately and explain how to withdraw it.

5. What you need to provide

The contact form requires a name, a valid email address and a message so that we can understand and answer an enquiry. An ASN is optional. You do not have a statutory obligation to use the form or provide these details, but we may be unable to respond or investigate without enough information.

You can instead email contact@xiaoyuan.co.uk. Email enquiries are handled for the same purposes, although they do not pass through the website’s Web3Forms submission endpoint.

6. Who receives information

Information is available to people working for us who need it to handle an enquiry, administer the website or meet a legal responsibility. Relevant service providers include website hosting and delivery providers, email providers and Web3Forms, operated by Web3Creative.

When you send a form, your browser sends its contents to Web3Forms, which processes and delivers the enquiry to us. Its Privacy Policy describes storage, infrastructure and spam filtering, including processing of submitter IP and email addresses by spam-prevention services. Its Data Processing Agreement describes its processor responsibilities and subprocessors.

We may disclose relevant information to professional advisers, regulators, courts or law enforcement where necessary and lawful, or in connection with a business transfer subject to appropriate protections. We do not make your enquiries publicly available.

7. International processing

Service providers may process information outside the United Kingdom. Web3Creative operates from India and uses infrastructure in multiple regions. Its published Data Processing Agreement provides for standard contractual clauses and the UK Addendum where applicable to restricted transfers.

Where a transfer is restricted by UK data protection law, an applicable adequacy decision or appropriate safeguards are required unless a lawful exception applies. Contact us for information about the destinations and safeguards relevant to your information, or to request a copy of applicable safeguards with confidential material removed where necessary.

8. How long information is kept

We retain enquiry correspondence while needed to answer the request and for relevant follow-up. We assess continued retention by considering whether the enquiry remains active, whether it leads to a service relationship, the need to resolve a complaint or dispute, applicable legal obligations and the sensitivity of the information. Information no longer needed for these purposes should be deleted or anonymised.

Security and delivery records are retained only for as long as needed to operate and protect the relevant service, investigate an issue or satisfy a legal requirement. Provider-managed logs and backups may have their own retention cycles. This website does not maintain a separate application database of submitted enquiries, but delivered email and copies held by processors can remain.

Web3Forms’ published policy states a maximum submission retention of three years, with shorter periods or earlier deletion in some circumstances. This is separate from the retention of emails delivered to us. You may contact us to ask about retention or request deletion; a legal requirement or an ongoing dispute may justify keeping particular records.

9. Cookies and local storage

The website’s application code does not set analytics or advertising cookies and does not include analytics, advertising pixels or session-recording scripts.

By default, the site reads your browser’s colour-scheme preference. If you manually choose light or dark mode, the value is saved in local storage under boardui:theme on your device so it can be restored on later visits. This preference is not sent as a contact-form field. Selecting “Auto” removes the saved choice and returns to the browser preference. Clearing site data also removes it.

Local storage has no automatic expiry here: the preference remains until you reset it, clear it or your browser removes it. You can block or clear storage through your browser; theme choices may then stop being remembered. Hosting, delivery or security providers may use necessary mechanisms to operate and protect their services. If we introduce optional tracking, we will update this policy and provide any choices required by law before enabling it.

10. Security and confidentiality

The form sends information to Web3Forms over HTTPS. The form also uses a hidden spam-detection field and prevents repeated clicks while a submission is in progress. These measures reduce some risks but cannot guarantee delivery, confidentiality or protection from every attack.

No internet transmission or storage system is completely secure. Send only the information needed for your enquiry. If you believe personal information has been exposed through this website, contact us promptly with relevant details and avoid sending the exposed credentials themselves.

11. Your data protection rights

Depending on the circumstances and applicable law, you may ask to access your personal information, correct inaccurate information, erase information, restrict its use, or receive certain information in a portable format. You may object to processing based on legitimate interests, and have an unconditional right to object to direct marketing. If processing relies on consent, you may withdraw it without affecting earlier lawful processing.

To exercise a right, email or write to us using the details below. Explain the information or processing concerned. We may need proportionate information to confirm your identity or clarify a request. Requests are normally free and answered without undue delay, usually within one month, subject to lawful extensions, pauses and exceptions. If we cannot fulfil a request, we will explain why and how you can challenge the decision.

We do not use information collected through this website to make solely automated decisions that produce legal or similarly significant effects about you.

12. Contact and complaints

For privacy questions, rights requests or complaints, contact us and describe your concern. You do not need to use the website form.

You may also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, or another supervisory authority where applicable. You do not have to contact us before exercising your right to complain to a regulator.

13. Children and external websites

This website is intended for operators, business contacts and people enquiring about network services, rather than children. We do not seek children’s personal information. If you believe a child has supplied information that should not be held, contact us so we can assess and address it.

External websites, including PeeringDB and Companies House, have their own privacy practices. Following a link makes a request to that external service. Their use of your information is governed by their own notices.

14. Changes to this policy

We will update this policy when our processing, providers or legal obligations change. The date at the top identifies the current version. Where a change materially affects how we use information already collected, we will provide additional notice where appropriate or required and obtain consent where the law requires it.

Our Terms of Use explain the conditions for using the website. This policy explains our information practices; it does not require you to waive privacy rights.