Legal register · Privacy
This Privacy Policy explains how Xds Experience Design Systems Inc. handles personal information in the course of running an experience design systems practice. The policy is written by the studio team at XDS Experience, the design and systems group that carries out usability audits, token library work, service blueprint workshops, accessibility reviews, journey map sessions and design system handovers for clients. It applies to everything we do with personal information, from the first enquiry to the final handover document and the archive that follows it.
We have tried to write this policy in plain language. Where a legal term is unavoidable, we explain it in the sentence that follows. The policy is organised into numbered chapters, mirroring the way the studio writes its own work, so that a reader can move directly to the section that answers a particular question. If anything here is unclear, please write to us and a person will answer.
Personal information means any information about an identifiable individual. It includes obvious items such as a name and an email address, and less obvious items such as a voice recording, a screenshot that contains a user account name, or a note taken during a research session. This policy describes the kinds of personal information we handle, the reasons we handle it, the people we share it with and the choices available to the individuals concerned.
This policy does not create rights beyond those already provided by applicable law. It does not override any specific agreement that a client has signed with us. Where a written service agreement sets out stricter rules for a particular project, that agreement governs the handling of the information covered by it, and this policy continues to apply to everything else.
The organisation responsible for the personal information described in this policy is Xds Experience Design Systems Inc. The studio is registered in Canada and works from a single office. The full postal address is:
The studio can be reached by email at support@xdsexperience.hair and by telephone at +14068737219 during the business hours published on the contact page. Correspondence about privacy should use the subject line Privacy Request so that it reaches the right person without delay. We aim to acknowledge every privacy enquiry within two business days.
For some projects we act as a service provider to a client organisation. In those cases the client determines why personal information is collected and how long it is kept, and we handle the information only on that client instruction. If your question concerns a project that a client commissioned, we may need to forward your request to that client, and we will tell you when we do so.
This policy covers personal information that we collect through the studio website, through email and telephone correspondence, through workshops and research sessions, and through the delivery of commissioned design system work. It also covers information contained in documents that clients share with us, such as support transcripts, analytics exports, recordings and screen captures, to the extent that those documents contain personal information.
The policy does not cover the practices of client organisations. When we work inside a client environment we follow that client data protection rules in addition to our own. If you are a customer of a client and you want to know how that organisation handles your information, the client privacy notice is the right place to look.
The policy also does not cover third party websites that we may link to from our pages. Those sites have their own notices and their own practices, and we cannot control them. We encourage readers to review the privacy notice of any site before providing personal information to it.
We try to collect as little personal information as the work requires. The categories below describe what we may collect in practice.
When you write to the studio or submit an enquiry through the contact form, we receive your name, email address, telephone number if you provide one, the name of your organisation and the contents of your message. We keep this information so that we can reply, remember the context of the conversation and follow up on any agreed next step.
During a project we may receive documents describing a product, a service or an organisation. These documents can include user account names, support ticket text, screenshots of interfaces and notes about internal processes. Where a document contains personal information, we treat the whole document as confidential and apply the safeguards described in this policy.
In usability audit sprints and journey map sessions we may create recordings, screenshots and written observations of participants interacting with an interface. We collect only what is needed to answer the research question, and we tell participants in advance what will be recorded and how the recording will be used.
Our web server receives standard technical information whenever a page is requested. This can include an internet protocol address, a browser type, a device category, a referring page and a timestamp. Technical information is used for security, troubleshooting and aggregate counting, and we do not use it to build profiles of individual visitors.
For commissioned work we keep the business contact details needed to issue an invoice and to maintain accounting records. Payment card details are handled by a payment provider and are not stored on studio systems.
Most of the personal information we hold arrives directly from the person concerned. You send it when you write an email, complete an enquiry form, join a workshop or take part in a research session. In these cases you decide what to share, and you can ask us at any time what we have received.
Some information arrives from a client organisation. A client may share a contact list for a workshop, a set of support transcripts for an audit, or a recording of a customer session. When this happens the client is responsible for having a proper basis to share the information with us, and our written agreement with the client sets out how long we may keep it.
A small amount of information is generated automatically by our web server and by the tools we use to protect the studio systems. This technical information is described in the sections on website visitors and on service providers.
We use personal information for a defined set of purposes. Each purpose below explains what we do and why.
We do not sell personal information. We do not rent contact lists. We do not use personal information from client projects to advertise our services without explicit written permission from the client, and even then we use only material that has been properly de-identified.
Where Canadian privacy law applies, we handle personal information with the knowledge and consent of the individual, except in the limited circumstances where the law allows collection without consent, such as an urgent safety situation or a legally required disclosure. Consent may be express or implied by the circumstances, and it can be withdrawn at any time, subject to legal and contractual restrictions.
Where the General Data Protection Regulation of the European Union applies, we rely on one or more of the following bases. We rely on contract where processing is necessary to deliver a service that the client has commissioned. We rely on legitimate interests where processing supports the safe and effective running of the studio, provided those interests are not overridden by the rights of the individual. We rely on consent for optional activities such as a newsletter subscription. We rely on legal obligation for records that must be retained under tax and company law.
Where another national or regional law applies, we follow the equivalent local rules. If you would like to know which basis we rely on for a particular activity, please ask and we will explain it in writing.
Research sessions are central to the studio method, and they deserve a clear explanation. Before a session begins we tell each participant what the session involves, what will be recorded, who will see the material and how long it will be retained. Participation is voluntary, and a participant may stop at any time without giving a reason.
Recordings are stored in a restricted project folder that is accessible only to the people working on that engagement. We use first names or participant codes in analysis notes rather than full identities wherever the research question allows. When a report is delivered to a client, identifying details are removed unless the participant has agreed to be quoted with attribution.
We do not use research recordings for any purpose other than the project for which they were made. If a client asks to reuse a recording for a different purpose, we will return to the participant for fresh consent. Recordings are deleted on the schedule set out in the retention chapter, and participants may ask for earlier deletion where the project does not require the material.
The studio website is a small informational site. It does not require an account, it does not run a shopping cart and it does not ask visitors to submit personal information beyond the contact form. When a page is requested, the web server records standard log entries that help us keep the site available and secure.
Log entries are kept for a short period and are used only for security review, fault diagnosis and aggregate counting of page requests. We do not attempt to identify individual visitors from log data, and we do not combine log data with information from other sources to build a profile. Where a log entry shows a security incident, we may retain the relevant entries for as long as needed to investigate and to meet legal obligations.
The contact form on the website prepares an email in your own mail application. It does not transmit your message to a studio server. The message travels through your email provider and ours, and the privacy practices of those providers apply alongside this policy.
We use a small number of service providers to run the studio. These providers may process personal information on our behalf, and each one is chosen for reliability and for a sound approach to security. Typical categories include web hosting, email delivery, document storage, accounting software and payment processing.
Every provider is bound by a written agreement that limits the use of personal information to the service we have asked for. Providers may not sell the information, use it for their own marketing or share it with other parties except as necessary to deliver the service or as required by law. We review the list of providers periodically and remove any service that is no longer needed.
Where a provider handles information in a country other than Canada, the transfer chapter below explains the safeguards we apply. If you would like to know the categories of providers used for a particular project, please ask and we will provide the relevant detail, subject to any confidentiality obligations owed to another party.
The studio is based in Canada, and some of our service providers operate in other countries. As a result, personal information may be stored or processed outside the country in which it was collected, including in the United States and in the European Union. The laws of those countries may differ from the laws where you live.
When we transfer personal information across a border, we take steps to ensure that a comparable level of protection travels with it. Depending on the circumstances we use contractual clauses approved for the purpose, we rely on an adequacy finding where one exists, or we keep the information within Canada where the project allows. We will always tell a client when a transfer outside Canada is planned and which safeguard will apply.
Where a client requires that information remain within a particular region, we will agree the arrangement in the written scope before any processing begins. If that requirement cannot be met with the tools available, we will say so rather than promise something we cannot deliver.
We keep personal information only for as long as it is needed for the purpose for which it was collected, plus any period required by law. The schedule below describes our usual practice. A written project agreement may set a different period for a specific engagement, in which case the agreement governs.
When a retention period ends, information is deleted or irreversibly de-identified. If information is contained in a backup archive, it is removed from the archive on the next scheduled cycle. We do not keep personal information indefinitely simply because it might be convenient.
We apply administrative, technical and physical safeguards that are appropriate to the sensitivity of the information. Access to project folders is restricted to named individuals. Accounts that can reach client material use strong passwords and a second authentication factor. Devices that hold client information are encrypted and kept under physical control.
Transmission of project material takes place over encrypted connections. Where a large file must be shared, we use a restricted link rather than an open attachment. Paper notes from workshops are photographed, stored in the project folder and then shredded. Visitors to the studio office are accompanied while in the working area.
No safeguard is perfect. If a privacy breach occurs, we follow a written incident response procedure that includes containing the incident, assessing the risk, notifying affected clients without undue delay and reporting to a regulator where the law requires it. We keep a record of any incident and of the steps taken so that the same failure is less likely to recur.
Subject to applicable law, you have the following rights in relation to the personal information we hold about you.
You may ask whether we hold personal information about you and request a copy of it, together with an explanation of how it has been used and shared.
You may ask us to correct information that is inaccurate or incomplete. Where a correction is disputed, you may ask that your view be recorded alongside the information.
You may ask us to delete information where it is no longer needed for the purpose for which it was collected, where you have withdrawn consent and there is no other basis for processing, or where the handling is unlawful. Some information must be retained for legal or contractual reasons, and we will explain any limit when we reply.
You may ask us to restrict the handling of information while a question about accuracy or lawfulness is resolved. You may object to handling that relies on legitimate interests, and we will stop unless we can show compelling grounds that override your rights.
Where the law provides a right to portability, you may ask for information you have supplied to be provided in a structured, commonly used and machine readable format.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of handling that took place before the withdrawal, and it does not affect handling that relies on another basis.
To exercise any of the rights described above, write to support@xdsexperience.hair with the subject line Privacy Request, or send a letter to Xds Experience Design Systems Inc., 163 3rd St A W, Owen Sound - N4K 3J6, Canada (CA). Please describe what you are asking for and include enough detail for us to locate the information, such as the date of a project or the email address you used to contact us.
We will verify your identity before releasing information, using a method that is proportionate to the sensitivity of the material. In most cases a reply to the email address we already hold is sufficient. We aim to acknowledge a request within two business days and to provide a substantive response within thirty days. If the request is complex, we will tell you that the period needs to be extended and explain why.
There is normally no charge for a first request. Where a request is manifestly unfounded or excessive, the law may allow us to charge a reasonable fee or to refuse the request, and we will explain the reasoning in writing. You will not be penalised for exercising a right.
The studio provides services to organisations rather than to consumers, and the website is not directed at children. We do not knowingly collect personal information from a child under the age of thirteen, or under the age of majority where a higher threshold applies in the relevant jurisdiction. If a research project would involve minors, we require the written consent of a parent or guardian and we apply stricter restrictions on recording and retention.
If you believe that a child has provided personal information to us without the consent of a parent or guardian, please write to support@xdsexperience.hair. We will investigate promptly and delete the information if it was collected without a proper basis. Parents and guardians can always ask what information, if any, we hold about a child in their care.
Where a client project involves a product used by children, we work with the client to ensure that the research and design work follows the applicable rules for children privacy. This may include limiting the data collected, shortening retention periods and removing identifying details from reports.
We send occasional studio updates to people who have asked to receive them. A subscription is never a condition of doing business with us, and an enquiry to the studio does not automatically add a person to a mailing list. Every update includes an unsubscribe link, and an unsubscribe request is honoured without delay.
We keep a small suppression record after an unsubscribe so that the request is respected and the person is not added again by accident. That record contains only the minimum needed for this purpose and is not used for any other kind of contact.
We do not buy contact lists and we do not send unsolicited marketing email to addresses gathered from other sources. If you have received a studio update and believe it was sent in error, please tell us and we will correct the record.
We do not make decisions about individuals by automated means that produce legal effects or similarly significant effects. Our design system tools may process interface data automatically in order to count occurrences of a component or to check a contrast ratio, but those tools do not evaluate a person and do not create a profile of an individual.
Where a client project introduces an automated feature into a product, that feature belongs to the client and is governed by the client privacy notice. During our work we will flag any automated decision making we encounter so that the client can assess it properly, but we do not operate such a feature on our own account.
If this changes, we will update this policy before the change takes effect and will describe the logic involved and the significance of the outcome in plain terms.
The studio website contains links to external pages, including the email and telephone links used on the contact page. Once a visitor follows an external link, the privacy notice of that destination applies. We are not responsible for the content or the practices of sites we do not control.
If you follow a link from a client report to a third party resource, the same principle applies. We include such links because they are useful, not because we endorse every practice of the destination. We encourage readers to check the privacy notice of any service before submitting personal information to it.
If you notice a link that leads to unexpected or inappropriate content, please report it to support@xdsexperience.hair so that we can review and correct it.
We review this policy at least once a year and whenever a material change occurs in our practice, our providers or the law. When a change is made, we update the revision date at the top of the page and publish the new version at the same address.
If a change materially affects how we handle personal information already collected, we will give notice by email to active clients and, where appropriate, place a prominent note on the website before the change takes effect. Continued use of the website after a change indicates acceptance of the updated policy, but it does not replace any consent that the law requires for a new purpose.
Previous versions are retained in the studio records so that a person can see what the policy said at the time information was collected. A copy of a previous version can be requested from support@xdsexperience.hair.
If you have a question, a concern or a complaint about privacy, please contact Xds Experience Design Systems Inc. at 163 3rd St A W, Owen Sound - N4K 3J6, Canada (CA), by email at support@xdsexperience.hair or by telephone at +14068737219. We take every concern seriously and will investigate it promptly.
We aim to resolve complaints within thirty days. If we cannot resolve a matter to your satisfaction, you may have the right to complain to the privacy regulator in your jurisdiction. In Canada this is the Office of the Privacy Commissioner of Canada. In the European Union it is the supervisory authority of the country where you live or work. We will provide the relevant contact details on request.
This policy is written in English and is provided in English only. The company name Xds Experience Design Systems Inc. and the studio address appear in full so that a reader can reach the right organisation without ambiguity. Thank you for reading the policy in full.