Privacy Policy

Last updated: 10 July 2026

This Privacy Policy explains how Total Package Services Ltd ("we", "us", "our") collects and uses personal data when you use CxPlan.

Data controller
Total Package Services Ltd
36 The Hawthorns, Aylesford, Kent, United Kingdom, ME20 7LJ

Total Package Services Ltd acts as the data controller for personal data collected through CxPlan.

What we collect - Account information — name, email, company, role per project. - Project data — equipment, activities, ATP stages, areas, systems, and any files you upload. - Payment metadata — order and subscription information handled by our Merchant of Record, Paddle.com Market Ltd ("Paddle"). We do not receive or store full card numbers. - Technical data — IP address, browser type, device identifiers, basic usage analytics. - Support communications — messages you send us through the contact form or by email.

Why we use it (lawful bases under UK GDPR) - Contract — to create your account, provide the service, and process your subscription. - Legitimate interests — to keep the service secure, prevent fraud, improve features, and respond to support requests. - Legal obligation — for tax, accounting and compliance records. - Consent — where you have opted in (e.g. marketing emails or non-essential cookies).

How long we keep it Account and project data is kept while your account is active and for up to 12 months after closure. Invoices and tax records are kept for 6 years to meet HMRC requirements. Support messages are kept for up to 2 years.

Sharing We use a small number of trusted processors and partners to operate the service: - Cloud hosting and database — to store your account and project data. - Email delivery — to send transactional and notification emails. - Paddle.com Market Ltd — our Merchant of Record. Paddle handles the sale of subscriptions, payment processing, subscription management, invoicing, tax collection and remittance, and refunds. Paddle acts as an independent controller for the payment data it collects. See Paddle's Buyer Terms and Privacy Notice. - Professional advisers — legal and accounting advisers where necessary. - Authorities — where we are required to disclose data by law.

We do not sell personal data.

International transfers Some of our processors are located outside the UK/EEA. Where data is transferred internationally, we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses or adequacy decisions.

Security We use appropriate technical and organisational measures — including encryption in transit, access controls, and least-privilege data access — to protect personal data.

Cookies We use essential cookies to keep you signed in and remember preferences, and limited analytics cookies to measure how the site is used. See our Cookie Policy for details.

Your rights Under UK GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, to withdraw consent where processing is based on consent, and to lodge a complaint with the UK Information Commissioner's Office (ICO). We will respond to requests within one month.

Contact For any privacy request, use our Contact page.