Privacy Policy

General

This Privacy Policy details how your personal data is dealt with by Xoople S.L. and its affiliates (collectively “Xoople”, “we”, “us” or “our”) in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection legislation (“Data Protection Laws”). This Privacy Policy applies to all individuals that are visitors to our website, our suppliers, job applicants, or any other person (“you” or “your”) who provide us with personal data through various “Channels” (being the various services or means we make available to you to interact with us such as websites, platforms, applications, forms, mailboxes, telephone numbers, addresses, or social media profiles).

Data controller contact

The Data controller in charge of processing is:

Name: Xoople S.L.

Address: Calle San German 13-1-lz Madrid, 28020, Spain

Spanish Tax ID: B-88282090

Email: legal@xoople.com

Telephone +34 913 441 744

What data do we process and what is the purpose and the applicable legal basis?

When you interact with the Channels we receive or collect and store certain types of information from you including the following:

To manage the relationship established with us: For our services provided through applications or online platforms we process the data provided by you in order to manage access credentials, provide assistance, answer queries, distribute our products and services, and manage the quality of same. In these instances, we collect your data to enable us to implement the pre-contractual or contractual relationship that will allow us to provide you with our products and services efficiently. We will also process your data whenever you subscribe to any of our social media accounts, newsletters, marketing materials or you ask us to send you commercial communications and the data you provide us with through the cookies collected when browsing online. Your informed and specific consent shall form the legal basis for such processing.

To manage staff selection: We process candidate data submitted to us in order to perform selection processes for roles at Xoople. The legal basis for processing is the implementation of pre-contractual measures, and your informed and specific consent.

To manage contact details within the scope of contractual or commercial relationships: We process contact details of potential customers, legal representatives of legal entities and organisations, whether public or private, analysts and investors or other concerned parties who provide us with their details, this in order to send them information of interest, to manage the commercial relationship that binds us. The basis for the legitimacy of such purposes is maintaining the pre-contractual, contractual and/or commercial relationship that binds us.

To comply with our legal obligations: We process personal data as required to discharge our commercial, fiscal, accounting or administrative legal obligations. The legal basis authorizing us to carry out such processing is compliance with legal obligations.

Data obtained from our services or products: We may process data obtained from your use of our contracted products or services in order to adapt and improve our products or services or more generally our business activities including through basic analysis which will be specified in the data protection clauses of the specific contract for a particular product or service. The legitimate basis for the processing is our legitimate interest in analysing or predicting in a very basic way aspects of our products and services in order to improve the administration and provision of those products and services. The right to object to such processing may be exercised in accordance with the provisions of the section on the rights of data subjects contained in this Privacy Policy.

Security and surveillance of facilities: Our facilities may be equipped with cameras and video surveillance systems that attempt to safeguard such facilities. The legitimate basis for such processing is our legitimate interest in ensuring the security of our facilities.

Visitor and third-party management: To control the access of visitors, collaborators or other third parties to facilities, it is possible that, at some of our facilities, identification data may be collected.

The legitimate basis is in this case consent, as well as our legitimate interest in ensuring the security of goods and people at its facilities.

To manage corporate policies: Xoople can adopt corporate policies to comply with legal requirements and industry best practices. In order for these policies to fulfill their purpose, it may be necessary to process personal data. In this case, the legal basis is compliance with legal obligations or Xoople legitimate interest.

Direct marketing: In general, unless prior consent has been obtained, we do not use your personal data for direct marketing purposes. You may at any time unsubscribe from direct marketing campaigns and object to the future processing of your personal data for such purposes by sending us an e-mail to the address of the data controller or by using the relevant “unsubscribe” option included in e-mails.

Automated Decisions: Xoople does not carry out automated decision-making, including profiling, except in those cases in which you are expressly informed of this and your express consent is requested.

How long do we keep data?

Typically data will be kept for the shorter of: (1) for as long as is necessary for the purpose for which the data was collected; (2) for the applicable limitation periods, if liabilities might be incurred as the result of the processing; (3) for data collected with your consent, only as long as such consent is not withdrawn; and (4) the explicit retention period we set for particular data processing operations. In any case, the data will remain blocked and kept in a restricted way for a maximum of 5 years to meet any liabilities arising from the processing.

In specific instances on a special basis, such as data collected for the purpose of responding to requests or enquiries will be kept for the time necessary to be able to attend to the same, but never for longer than twelve months.

Data recipients

Xoople undertakes not to transfer or disclose your personal data except in those cases described in this Privacy Policy or, where applicable, as might be indicated at the time of collection of the data. For example:

We may exchange personal information with service providers, who are third parties and are in some cases contracted to perform services on our behalf. In these cases, the corresponding data processor agreements are signed whenever necessary, as established by the data protection legislation.
We may disclose your personal information (1) if we are permitted or required to do so by law or by a process of law (such as a court order or subpoena); (2) to law enforcement agencies or other public officials to comply with a lawful and legitimate request; (3) whenever we consider this necessary to prevent physical harm or financial loss; (4) to establish, exercise or defend our legal rights; (5) in connection with an investigation of suspected or actual fraud or illegal activity; or (6) with your express and informed consent.
We reserve the right to transfer to a third party any information we hold about you in the event of any actual or potential transfer or sale of all or part of our business or assets (including in the event of any merger, acquisition, joint venture, restructuring, assignment, dissolution or liquidation) or other structural or business operation. In this case, such third parties will be required to ensure levels of protection comparable to those provided by Xoople with respect to the information to be shared.
Xoople is a global and interconnected company, hence we may exchange personal information within companies of the corporate group in the context of the centralisation of certain activities carried out by them as a corporate group. For certainty, any such internal transfer, assignment or processing of personal data will be carried out under the data protection laws in force and through the adoption and application of adequate guarantees designed to ensure the protection of your privacy and fundamental rights and freedoms. In the event of such a transfer, this will be indicated for the specific processing operation and will require your consent.

Likewise, we inform you that some of our service providers, third parties or Xoople companies may be located in territories outside the European Economic Area that do not provide a level of data protection comparable to that of the European Union. In such cases we transfer your data with appropriate safeguards, maintaining at all times the security of such data; these may include the execution of Standard Contractual Clauses approved by the European Commission. You may require further information on the adequate safeguards adopted by Xoople or a copy of the relevant agreements, where applicable, at privacy@xoople.com.

Your rights

Under Data Protection Laws you have certain rights including the following:

Right of Information: You have the right to be informed and to obtain confirmation on whether we are processing your personal data.
Right of Access, Rectification and Erasure: You have the right to request access to your personal data (unless your request is unfounded or unreasonable), as well as to request the rectification of inaccurate or incomplete personal data (where appropriate) and, in certain cases, to request its deletion when, among other reasons, the personal data is no longer necessary for the purposes for which it was collected.
Right to restrict the processing of your personal data: In certain circumstances, you may request that we restrict the processing of your data, in which case we will only continue to process your personal data where an applicable exemption applies.
Right to object: You may object to the use of personal data that we are processing in accordance with the legitimate interests of the data controller set out in this Privacy Policy.
Right to data portability: If it is technically feasible, you may request that we transmit your personal data from our systems to a third party’s system in a safe and secure way provided that the personal data has been used and/or processed with your consent or under the existence of an agreement.

You can exercise all of your rights, including rights of access, rectification, erasure and portability of data and objection to and restriction of the processing by sending an e-mail to privacy@xoople.com, indicating the reason for your request and the right you wish to exercise and by attaching a copy of your ID or equivalent document.

In any case, you have the right to withdraw your consent, at any time, where we have relied on it. If you withdraw your consent, we may not be able to provide you with certain beneﬁts or services. It will not affect our lawful basis for processing by consent before your withdrawal. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) (or such other competent local data data protection authority applicable to you) if you feel your data has or is being used in a way that you believe does not comply with Data Protection Laws.

We may amend this Privacy Policy from time to time. We may also notify you of material changes to this Privacy Policy, before the effective date of the changes, by sending an email or otherwise. We will collect your consent, where required, or offer you the possibility to object to any new changes to the data processing activities before any new version of the Privacy Policy becomes applicable.

Last update 24 January 2024