Privacy Policy

1. Data we collect

We may collect information provided in forms, including name, email, phone, country, optional tax number, subject, message, preferred pack, referral code and consent choices.

When analytics cookies are accepted, we may also receive technical and usage information such as pages visited, device type, approximate location, referral source and interactions with the website.

2. Why we use personal data

• To answer contact, service, partnership and affiliate enquiries.
• To take steps requested before entering into a contract.
• To review applications, contact applicants and manage affiliate onboarding and activity.
• To operate, protect and improve the website.
• To measure website usage when analytics consent has been given.
• To comply with legal obligations and establish or defend legal claims.

3. Legal bases

Depending on the situation, processing is based on your request before a contract, performance of a contract, our legitimate interests in operating and protecting the website, compliance with legal obligations, or your consent. Consent can be withdrawn at any time without affecting earlier processing.

4. Service providers and transfers

We may use service providers for hosting, database storage, email delivery, form processing and analytics, including Vercel, Supabase, Resend and Google Analytics. These providers process data under their own applicable terms and safeguards. Where data is transferred outside the European Economic Area, appropriate transfer mechanisms must apply.

5. Retention and security

We retain applications and other personal data only for as long as needed for review, the pre-contractual or contractual relationship, legal obligations and possible claims. Backoffice access is restricted to authorised users. We use reasonable technical and organisational measures, but no internet service can guarantee absolute security.

6. Your rights

Subject to applicable law, you may request access, correction, erasure, restriction, portability or objection to processing, and you may withdraw consent. Contact us at info@xmill.org. You may also lodge a complaint with the Portuguese data protection authority, the CNPD.

7. Cookies

For information about essential storage and optional analytics, see our Cookie Policy.