1. Who controls your data
Xbalt OÜ is the data controller for personal data processed through xbalt.com and in connection with initial business enquiries. You can contact us at info@xbalt.com.
2. Data we may collect
We may collect information you provide directly, including your name, work email, company, project interests, message content, and subsequent correspondence. Our hosting and security providers may also process limited technical data such as IP address, browser type, device information, timestamps, requested pages, and security logs.
3. Why we use personal data
- To respond to enquiries and communicate about potential or active work;
- To prepare proposals, enter into agreements, and deliver requested services;
- To operate, secure, troubleshoot, and improve our website;
- To meet legal, accounting, and regulatory obligations;
- To establish, exercise, or defend legal claims.
4. Legal bases
Depending on the context, we process data because it is necessary to take steps at your request before entering a contract, to perform a contract, to meet a legal obligation, based on our legitimate interests in operating and protecting our business, or with your consent where consent is required.
5. Sharing and service providers
We do not sell personal data. We may share limited data with trusted providers supporting hosting, infrastructure, communication, analytics, professional advice, and business administration. They may only process data for defined purposes and subject to appropriate safeguards. We may also disclose information when required by law or to protect legal rights.
6. International transfers
Where data is processed outside the European Economic Area, we use an appropriate transfer mechanism where required, such as an adequacy decision, standard contractual clauses, or another lawful safeguard.
7. Retention
Enquiry data is generally retained only for as long as reasonably necessary to respond, manage the potential business relationship, and meet legal requirements. Contract, accounting, and transaction records may be retained for statutory periods. Technical security logs are retained for a limited operational period.
8. Your rights
Subject to the General Data Protection Regulation and applicable law, you may have the right to access, correct, erase, restrict, or object to processing; receive portable data; withdraw consent; and lodge a complaint with the Estonian Data Protection Inspectorate or your local supervisory authority. Rights are not absolute and may depend on the circumstances.
9. Security
We apply reasonable technical and organisational measures designed to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Children
This website and our services are intended for business users and are not directed to children. We do not knowingly collect personal data from children through this website.
11. Changes
We may update this policy to reflect changes in our practices, services, or legal obligations. The date above shows when it was last revised.
12. Contact
For privacy questions or rights requests, email info@xbalt.com. We may need to verify your identity before acting on a request.