Last updated — 14 July 2026

Privacy Notice

Who is responsible for data processing on this website?

The controller responsible for the data processing purposes described in this notice is OÜ XDATA GROUP, a private limited company, with company number 16472540, and its registered office address at Harju maakond, Tallinn, Lasnamäe linnaosa, Lõõtsa tn 8, 11415 (“we”, “us” or “controller”).

In case of questions regarding personal data processing, you may contact us at: legal@xdatagroup.io

What categories of personal data do we process and what is the source of the personal data?

When you interact with our website, we may process the following main personal data (“Main Data”):

• Name;
• Business e-mail address/phone number;
• Company name and website, whom you represent or work for;
• Your message.

We collect Main Data if you provide it to us. This may include, for example, the data that you enter in a contact form.

If you visit our website, we may process the following technical data, which may include your personal data (“Log Data”):

• IP address;
• Access provider;
• Referring and exit URL;
• Date and time of the access;
• Browser type and version;
• Operating system;
• Error logs;
• Approximate geolocation derived from the IP address, such as country or city;
• Device type.

Log Data is automatically collected by our IT systems when you visit the website.

For what purposes and on what legal basis do we process your personal data?

To whom we may transfer your personal data to?

We may share your personal data with the following data recipients:

• Public sector authorities, supervisory and law enforcement authorities to fulfil our statutory obligation, a court order, to establish, exercise or defend our legal rights or in other cases where this is necessary to prevent and deter lawful acts. The legal basis is performance of our legal obligations (GDPR art 6(1)(c)) or our legitimate interest in facilitating effective establishment, exercise or defence of legal claims (GDPR art 6(1)(f)).
• Professional advisors to ensure our proper economic activity, to seek legal advice and to establish, exercise and defend our legal claims. The legal basis is our legitimate interest in ensuring our proper economic activities, seeking legal advice and managing legal claims, including facilitating effective establishment, exercise, or defence or legal claims (GDPR art 6(1)(f)).
• Service providers, including IT service provider, to fulfil the processing purposes described above. The legal basis is our legitimate interest in providing demos and website (GDPR art 6(1)(f)).

We may transfer your personal data outside the European Economic Area. If we do so, we use safeguards to ensure that a level of protection of personal data comparable to that applicable in the European Union is applied to your personal data. Upon your request we will make available further information on the safeguards applied.

How long do we retain your personal data?

We retain your personal data as long as necessary to fulfil the processing purposes or until the legal obligation stipulates that we do so. To determine the retention period, we consider the processing purposes, amount, nature, and sensitivity of the personal data and the potential risk of harm from unauthorised use or disclosure. Whilst retaining the personal data, we take into account the need to resolve or protect against ongoing or threatened disputes and our obligation to fulfil requirements arising from the applicable laws.

What rights do you have regarding your personal data?

You have the right to contact us at legal@xdatagroup.io any time to exercise the following data subject rights, taking into account the limitations set forth in the GDPR:

• Right to request access to and copy of the personal data we process about you;
• Right to request rectification of your personal data, if you believe that we are processing inaccurate or incomplete personal data about you;
• Right to request erasure of your personal data, for example if we no longer need the personal data for the purpose for which they were collected or otherwise processed or we have processed your personal data unlawfully;
• Right to request restriction of your personal data processing, for example if you contest the accuracy of the personal data, for a period that enables us to verify the accuracy of the personal data or the processing of personal data is unlawful, but you do not request the erasure of personal data, but rather the restriction of its use;
• Right to object to the processing of your personal data, for example if we process personal data based on our legitimate interest;
• Right to data portability, if the processing of your personal data is carried out by automated means and the processing of your personal data is based on consent or a contract;
• Right to withdraw your consent at any time in cases where the processing is based on your consent. The withdrawal of the consent does not affect the lawfulness of the processing of personal data prior to the withdrawal of the consent;
• Right to contact the supervisory authority, if you are not satisfied with our response to your request or believe we are not processing your personal data in accordance with the applicable law, you can submit your claim to the supervisory authority.

Please note that you should provide us with enough information for us to respond to your request. Furthermore, we have the right to charge a reasonable fee or refuse to act on the request if your requests are manifestly unfounded or excessive, in particular because of their repetitive character.

When we provide links to third-party websites, please be aware that this notice does not extend to the data processing activities of those third parties. The content and links on these external sites are beyond our control, and we cannot be held responsible for the practices of websites that link to or from our website. To understand how third parties process your personal data, please refer to the respective privacy notices of the other websites you visit.

We may amend this privacy notice from time to time to reflect changes in our data processing operations. In such a case, the most recent version of the notice will be made available on this webpage. We encourage you to revisit this page regularly, particularly before submitting any new personal data.