Privacy Policy

This Privacy Policy applies to the processing of personal data by X Built ('we', 'us', or 'our'). We are committed to processing all personal data in full compliance with the EU General Data Protection Regulation (GDPR / Algemene Verordening Gegevensbescherming - AVG) and applicable Dutch data protection laws.

Data Controller details:

• Trade Name: X Built

• Registered Legal Name: [TODO: must match the KvK entry exactly]

• Legal Form: [TODO: confirm as registered with KvK, e.g. eenmanszaak / VOF / B.V.]

• Chamber of Commerce (KvK): 97487813

• VAT Identification (BTW): NL005273234B60

• Address: Dr. Bouwdijkstraat 23, 2381 CA Zoeterwoude, the Netherlands

• Phone: +31 6 15349851

• General Email: info@xbuiltstudio.com

• Direct Contact Email: contact@xbuiltstudio.com

We collect personal data that you provide to us directly or that is generated automatically when you interact with our website and services:

• Project Brief & Intake Data: Full name, business email address, company or business name, current website URL, project scope preferences, timeline requirements, and project brief descriptions submitted through our intake forms.

• Direct Communications: Inquiries and correspondence sent via email or telephone.

• Automated Workflow & Bot Interactions: Details, parameters, or test inquiries submitted through demonstration workflows, customer support automations, or interactive calculators.

• Technical & Analytics Data: IP address (anonymized/pseudonymized where applicable), browser type and version, device category, referring URL, pages visited, and interaction timestamps collected for diagnostic and performance purposes.

• Payment Data: Billing address and payment transaction identifiers processed securely by our payment processor, Stripe. We do not store or process raw credit card numbers or sensitive financial authentication credentials.

Under Article 6(1) of the GDPR/AVG, we process your personal data under the following legal bases:

• Performance of a Contract / Pre-contractual Steps (Art. 6(1)(b) GDPR): To evaluate project briefs, prepare fixed-scope proposals, communicate regarding project specifications, execute development sprints, deliver code repositories, and provide post-launch support.

• Legitimate Business Interests (Art. 6(1)(f) GDPR): To operate, secure, and improve our digital infrastructure, protect our systems against fraud, maintain client relationship histories, and manage daily business operations.

• Legal Compliance (Art. 6(1)(c) GDPR): To comply with mandatory Dutch fiscal, accounting, and commercial reporting laws (e.g. administrative retention obligations of the Belastingdienst).

• Consent (Art. 6(1)(a) GDPR): For optional cookies or direct marketing communications, where explicitly requested. Consent may be withdrawn at any time.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with statutory legal requirements:

• General Inquiries & Project Briefs (without contractual agreement): Retained for up to 12 months following the last communication, after which data is safely deleted or anonymized.

• Client Project Records, Contracts & Invoices: Retained for a mandatory period of 7 years in compliance with Dutch tax and commercial administrative retention requirements (Rijksbelastingdienst).

• Technical & Analytics Logs: Retained in pseudonymized or aggregated format for up to 90 days for security monitoring and platform performance auditing.

We engage reputable third-party processors to deliver our web systems and manage studio operations. All processors are bound by strict Data Processing Agreements (DPAs) ensuring GDPR-compliant confidentiality and security:

• Vercel Inc. (USA / EU): Cloud edge hosting, serverless execution, and privacy-preserving web analytics.

• Stripe Payments Europe, Ltd. (Ireland / USA): Secure payment processing, checkout sessions, and PCI-DSS Level 1 compliance.

• Analytics: Vercel Web Analytics (cookieless and privacy-centric performance telemetry).

• Email & Communications Provider: [TODO: confirm list, e.g. Google Workspace / Microsoft 365 / Resend].

• Database & Form Infrastructure: [TODO: confirm list, e.g. Supabase / Vercel KV / custom PostgreSQL].

When data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are implemented in accordance with Chapter V of the GDPR. This includes relying on European Commission adequacy decisions (such as the EU-US Data Privacy Framework) and executing standard contractual clauses (SCCs) with supplementary technical security measures.

As a data subject, you hold comprehensive rights regarding your personal information under the GDPR:

• Right of Access (Art. 15 GDPR): Obtain confirmation of whether your data is processed and request a copy.

• Right to Rectification (Art. 16 GDPR): Correct inaccurate or incomplete data.

• Right to Erasure / 'Right to Be Forgotten' (Art. 17 GDPR): Request deletion of personal data when no longer legally required.

• Right to Restriction of Processing (Art. 18 GDPR): Limit the processing of your data under specific conditions.

• Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, commonly used, machine-readable format.

• Right to Object (Art. 21 GDPR): Object to data processing based on legitimate interests.

• Right to Withdraw Consent (Art. 7(3) GDPR): Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please email us directly at info@xbuiltstudio.com. We respond to all formal requests within 30 calendar days.

If you believe our processing of your personal data infringes applicable data protection laws, you have the statutory right to lodge a complaint with the competent supervisory authority in the Netherlands:

Autoriteit Persoonsgegevens (AP)

Postbus 93374, 2509 AJ Den Haag

Telephone: (+31) - (0)70 - 888 85 00

Website: https://autoriteitpersoonsgegevens.nl

For any questions, requests, or privacy concerns regarding this policy, contact our studio at:

X Built · Attention: Data Privacy

Dr. Bouwdijkstraat 23, 2381 CA Zoeterwoude, the Netherlands

Email: info@xbuiltstudio.com