Privacy statement

Xtirion BV is responsible for the processing of personal data described in this statement.

• Address: Barbara Strozzilaan 201, 1083 HN Amsterdam - Noord-Holland, Netherlands
• Chamber of Commerce (KvK): 99149958
• Email: info@xtirion.com
• Phone: +31 6 52504646

For any question about this statement or your data, contact us at info@xtirion.com.

Contact form. When you use the contact form we receive the details you enter: your name, email address, company, the purpose of your request, how you found us and your message. Together with the form we receive the page you sent it from, the language of that page and how long it took to fill in the form (used to filter out spam).

Technical data. When you visit the website, the server that hosts it processes your IP address and basic technical information (such as browser type and the pages requested) to deliver the pages, keep the site secure and limit abuse. When you submit the contact form, your IP address is also used for the spam check described below.

Direct contact. If you contact us by email, phone or WhatsApp, we process the details and messages you share with us that way.

• To respond to your request and, if you ask for it, to prepare a proposal. This is necessary to take steps at your request before entering into an agreement, or is based on our legitimate interest in answering questions from (potential) clients.
• To protect the website and the contact form against spam and abuse, based on our legitimate interest in a secure and reliable website.
• To comply with legal obligations, for example tax record-keeping requirements when a request leads to an agreement.

We do not use your data for automated decision-making or profiling, and we do not sell your data.

We use the following service providers to run the website and handle contact requests. They only process your data on our behalf and in line with our instructions:

• Make (make.com), which receives contact-form submissions and forwards them to us, using its EU data region.
• Cloudflare Turnstile (Cloudflare, Inc.), which checks that the contact form is submitted by a person and not a bot. Cloudflare may process data in the United States; it is certified under the EU-US Data Privacy Framework.
• **TransIP**, which hosts the website.
• **Google Workspace**, where contact requests arrive in our mailbox.

If you contact us through WhatsApp, WhatsApp (Meta) processes those messages under its own privacy policy. We do not share your data with other third parties unless we are legally required to.

We keep contact requests for up to 12 months after our last contact, unless the request leads to an agreement; in that case we keep the relevant data for as long as needed to perform the agreement and to meet legal retention periods (for example 7 years for financial records). Server logs are kept only for a short period for security purposes.

This website does not use analytics, advertising or tracking cookies, and it does not load fonts or other resources from third-party tracking services: our fonts are hosted on our own server.

On the contact page, Cloudflare Turnstile may use technically necessary data (and, where needed, a functional cookie) solely to check that the form is not being submitted by a bot. Because we only use technically necessary means, we do not ask for cookie consent.

Under the General Data Protection Regulation (GDPR) you have the right to:

• access the personal data we hold about you;
• have incorrect data corrected;
• have your data deleted;
• restrict or object to the processing of your data;
• receive your data in a structured, commonly used format (data portability).

To exercise these rights, email us at info@xtirion.com. We will respond within one month. We may ask you to confirm your identity first.

If you believe we are not handling your data properly, please let us know. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

We take appropriate technical and organisational measures to protect your personal data against loss and unauthorised access. The website is only available over an encrypted (HTTPS) connection, and access to contact requests is limited to the people who need it.

We may update this privacy statement, for example when our services or the law change. The latest version is always available on this page. This version was last updated on 30 September 2026.