Privacy policy
Controller. Dmitrii Novikov (Xisora), NIF Z0426074G, Avenida Jardines del Duque nº 26, local 7-A, 38670 Adeje, Santa Cruz de Tenerife, Spain. Data protection contact: support@xisora.com.
Data we process. Identification and contact data (name, company, position, email, phone), billing data, transaction data and technical browsing data. We do not process payment card data: Stripe handles it directly.
Purposes and legal basis.
| Purpose | Legal basis | Retention period |
|---|---|---|
| Answering enquiries received by form, email or phone | Consent and legitimate interest (Art. 6(1)(a) and (f) GDPR) | Until the enquiry is resolved, up to 1 year |
| Managing orders, contracts, payments and invoicing | Performance of a contract (Art. 6(1)(b) GDPR) | For the duration of the contract |
| Meeting tax and accounting obligations | Legal obligation (Art. 6(1)(c) GDPR) | 6 years (Art. 30 Spanish Commercial Code) and tax periods |
| Sending commercial communications and newsletters | Consent (Art. 6(1)(a) GDPR; Art. 21 LSSI-CE) | Until consent is withdrawn |
| Website security and fraud prevention | Legitimate interest (Art. 6(1)(f) GDPR) | As long as needed for that purpose |
Recipients. Your data is shared only with providers acting as processors, or where required by law:
- Web hosting: Namecheap, Inc.
- Email: Namecheap, Inc.
- Payments: Stripe Payments Europe, Ltd. (Ireland).
- Tax and accounting advisers.
- Public authorities (Canary Islands Tax Agency, Spanish Tax Agency) where legally required.
International transfers. Some providers, such as Stripe, may process data outside the European Economic Area. In that case GDPR safeguards apply: the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.
Your rights. You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, by writing to support@xisora.com and stating which right you are exercising. If you believe your request has not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Minors. This website is not intended for children under 14.
Security. We apply appropriate technical and organisational measures, including encrypted connections (HTTPS), to protect your data.