Privacy Policy and Personal Data Processing Policy

Xlocat OÜ. Effective as of 22.03.2025. Registry code 16848494.

1. General provisions

1.1. Xlocat OÜ (hereinafter also “Xlocat”) takes personal data protection and user privacy very seriously. In order to ensure the safe use of the website http://xlocat.com and the Xlocat application (hereinafter the “App”), Xlocat keeps all of its employees up to date with the Xlocat Privacy Policy and the Personal Data Processing Policy.

1.2. The Xlocat Privacy Policy and the Personal Data Processing Policy are an inseparable part of the Xlocat Terms of Use and are applied to the extent that they do not conflict with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).

1.3. The Xlocat Privacy Policy and Personal Data Processing Policy (hereinafter also “Policy”) explain the meaning of personal data, which personal data of the user of the website http://xlocat.com and the App Xlocat processes and on what basis, what are the user’s rights with regard to this and what kind of measures Xlocat has taken to protect the user’s personal data.

1.4. Xlocat is the data controller.

1.5. In order to obtain user statistics on the website http://xlocat.com and in the App, Xlocat uses the AppsFlyer service, which complies with the AppsFlyer Privacy Policy, and the Mailgun service, which complies with the Mailgun Privacy Policy.

1.6. In order to accept payments, Xlocat uses the Stripe payment system, which complies with the Stripe’s Privacy Policy.

1.7. The App is divided into a public part and a part with restricted access. Only users with valid authorisation are allowed to access the part of the App with restricted access. Users are identified using different identification methods, which may require the transmission of the user credentials to a third party authentication service provider. After logging into the password-protected App, Xlocat collects information about the user, their IP address and activities.

1.8. Xlocat also collects the contact details of the persons who contact Xlocat.

1.9. Xlocat is not responsible for the principles of processing the data entered by the user through the links referred to in point 1.6 of the Policy and for the protection of their confidentiality.

1.10. Xlocat processes the user’s personal data fairly, in the manner and to the extent permitted by the legislation of the European Union and Estonia.

1.11. Xlocat and its employees exercise all due diligence and security measures required by law when processing the user’s personal data to ensure that the user’s personal data are processed only for the purposes for which they are intended and to protect against accidental or unauthorised processing, disclosure or destruction of the user’s personal data.

1.12. Personal data are processed only for the purposes for which they are collected.

1.13. Xlocat grants access to the user’s personal data only to a limited number of its employees, who are obliged to keep the user’s personal data confidential during their employment with Xlocat and after the termination of their employment, on the basis of confidentiality agreements entered into with them. Xlocat does not allow unauthorised third parties to access the user’s personal data and the Xlocat database containing these data.

2. Amendment and application of the Xlocat Privacy Policy and Personal Data Processing Policy

2.1. Xlocat reserves the right to unilaterally modify and amend the Xlocat Privacy Policy and Personal Data Processing Policy at any time. Xlocat informs the users of amendments to the Xlocat Privacy Policy and Personal Data Processing Policy on the website http://xlocat.com and in the App at least one month before the amendments enter into force, unless the Xlocat Privacy Policy and Personal Data Processing Policy are only amended on the basis of changes made to legislation.

2.2. The Xlocat Privacy Policy and Personal Data Processing Policy apply from the date of their publication on the website http://xlocat.com and in the App to all users and their personal data, including both existing and new users.

3. Personal data and their processing

3.1. Personal data are any data that relate directly or indirectly to a natural person and make it possible to identify that person.

3.2. Personal data processing primarily includes the collection, storage, retention, streamlining, use, modification, transmission, disclosure and deletion of the user’s personal data by Xlocat, as well as other personal data processing activities prescribed by law.

3.3. In providing its service, Xlocat processes the following personal data of users:

• data allowing the personalisation of the user (first name, surname, photo, gender);

• details of the user’s means of communication (telephone number, email address);

• the country of residence or stay of the user;

• preferred language of communication;

• number of the user’s account in the Stripe payment system;

• transactions made and executed between Xlocat and the user;

• make and model of the user’s device and the IP address;

• details of the creation of the App user account and on the user’s activities when using the App (login time, number of logins, in the case of Facebook, Google, Apple, Linkedin or any other third party service provider, also the fact that the person logged in via the respective service provider and the so-called access token, data on the user’s transactions with other users and the execution of transactions).

3.4. Personal data processing may take place only if it complies with at least one condition specified in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).

3.5. Xlocat processes the user’s personal data on different legal bases, depending on the purpose of the processing. This is not an exhaustive list of purposes for which the data may be processed, as there may be circumstances in which it is necessary to process the data operationally for other purposes which are compatible with at least one of the grounds set out in the GDPR.

3.6. Xlocat processes personal data in particular for the purpose of facilitating the use of the App by users, including the execution and performance of transactions with and/or between users, but also to enable Xlocat to comply with legal requirements.

3.7. Where Xlocat is under a legal obligation to process personal data, Xlocat cannot prevent the processing of personal data on this basis and the user cannot prohibit the processing of personal data on this basis.

3.8. Based on law, personal data are processed for the following purposes:

3.8.1. Accounting: for accounting purposes, Xlocat processes personal data (first and last name) and financial data (number of the user’s account in the Stripe payment system and the transactions made and executed between Xlocat and the user).

3.8.2. Submission of data to public authorities: in the cases provided for by law, Xlocat may be obliged to submit data to public authorities (including the Police and Border Guard Board, the Tax and Customs Board, etc.). The user is informed of the transmission of personal data, unless informing the user is prohibited by law.

3.9. Based on legitimate interest, personal data are processed for the following purposes:

3.9.1. Dispute resolution: in the event of litigation or out-of-court disputes, Xlocat may process personal data and documents relevant to the dispute on its own behalf or on behalf of users. Xlocat will retain the personal data and documents related to litigation for longer than the minimum retention period required by law if this is necessary. The need to retain such personal data and documents will be assessed periodically.

3.9.2. Security: in order to ensure the security of the user’s data, Xlocat implements security measures in the App that help ensure the security of the user’s data. Xlocat may contact the user for the development of the service or for the management of the relationship with the user, using the contact details provided by the user to Xlocat. Xlocat may conduct satisfaction surveys to analyse user satisfaction and preferences with respect to the products and services of Xlocat and its partners that the user uses or has used, in order to enable more effective product and service development.

3.9.3. Informing users: Xlocat may send the user information about new projects in the App. Personal data processing on the basis of legitimate interest does not require the consent of the data subject, but Xlocat has created the possibility for users to control the processing of personal data for this purpose and to opt out if they wish to do so.

This list of personal data processing on the basis of legitimate interest is not necessarily exhaustive. In accordance with legislation and as necessary, Xlocat may also process the personal data of user for other purposes on the basis of legitimate interest. Regarding the processes of processing based on legitimate interest, the user always has the right to ask for additional information and to object.

3.10. Based on the data subject’s consent, personal data are processed for the following purposes:

3.10.1. Marketing: Xlocat asks for the user’s consent to allow Xlocat to send to the user Xlocat products and related promotional materials and/or notices, as well as the products and/or promotional materials and/or notices of persons belonging to the same group of companies as Xlocat or other third party partners. If the user has granted his/her consent to Xlocat to send any marketing material, Xlocat may send the user information and/or offers by email or by telephone, according to the user’s preferences. Xlocat may also ask for the user’s consent to perform other data processing operations not previously mentioned. The user may always decline to grant their consent to data processing. The user can always withdraw their consent to data processing.

3.10.2. Other data sent by the user to Xlocat: Xlocat may also process other data relating to the User where there is a legitimate need to do so for the purposes of using the App and where the processing of such data is not against the law.

3.10.3. Processing of personal data of job applicant: the processing of the personal data of a natural person may also take place when a person who wants to apply for a job with Xlocat sends his/her personal data to Xlocat. In this case, the data are processed in order to take pre-contractual measures. It is recommended that a person who wants to apply for a job consult Xlocat prior to submitting their personal data in order to determine the composition of the personal data required for the job application.

4. Data transmission

4.1. Xlocat may transfer the user’s personal data primarily to:

(a) the other group companies or to group partners in other countries, if necessary in connection with the performance of Xlocat’s contractual obligations;

(b) an accountant or auditor, where such a service is provided by an external service provider, as well as to persons providing legal assistance in connection with transactions with or between users;

(d) any other person, agency or organisation if this is necessary for Xlocat to perform its duties and functions under the Terms of Use of the App;

(e) persons to whom Xlocat is obliged to submit the user’s personal data by law.

4.2. Xlocat only has the right to transmit the user’s personal data to third parties if this is purposeful considering the App’s rights and obligations towards the user and the transmission of the user’s personal data to such a user is not in conflict with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).

4.3. When transmitting data to a third party, Xlocat ensures that personal data protection is continuously ensured when the personal data are transmitted. For this purpose, a written agreement is concluded with the person to whom the data are transmitted, setting out the rules for the processing of the data by the recipient.

5. Protection of user’s rights

5.1. A data subject has:

5.1.1. the right to request access to their personal data. The user has the right to access the user’s personal data held by Xlocat at any time. As a rule, Xlocat has made the personal data available to the user through the App. However, the user has the right to request Xlocat to send the personal data collected about the user, which the User cannot access through the App;

5.1.2. the right to request the correction of personal data if the user’s personal data used by Xlocat is incorrect;

5.1.3. the right to request the erasure of personal data held by Xlocat, in particular where the processing is based on legitimate interest or consent. The erasure of personal data is not possible if the processing or retention of the data is necessary for compliance with a legal obligation or if the personal data is necessary for the achievement of the purpose for which they were collected. If Xlocat is not able to erase the personal data, it will give the reasons of this to the requesting user;

5.1.4. the right to object to personal data processing if the personal data are processed on the basis of legitimate interest;

5.1.5. the right to restriction of the processing of their personal data if:

5.1.5.1. the user has contested the accuracy of the personal data, until Xlocat verifies the accuracy of such data;

5.1.5.2. the processing of the personal data is unlawful, but the user does not request erasure of the personal data;

5.1.5.3. the user needs the personal data for the preparation, submission or defence of legal claims;

5.1.5.4. the user has filed an objection to the processing of personal data, until it is checked whether Xlocat’s legitimate reasons outweigh the user’s justifications.

5.2. In order to exercise any of the above rights, the user may send a request to Xlocat via the App or by email: info@xlocat.com. When a right is exercised, this must be clearly expressed in the letter to Xlocat. A copy of any personal data concerning the user that is not available through the App will be provided to the user within 30 days of receipt of the request.

5.3. The user has the right to contact the Data Protection Inspectorate of the Republic of Estonia or the Harju County Court of the Republic of Estonia in order to protect his/her personal data.

6. Technologies used

6.1. Xlocat uses cookies – small text files placed on the hard drive of the user’s device by the website server. This allows Xlocat to collect certain information from the web browser of the user’s device and, among other things, it makes it possible to remember an active session and this helps navigate the website.

6.2. Cookies must be enabled on the user’s device in order to use the website http://xlocat.com and the App.

6.3. Xlocat is working to protect the website http://xlocat.com and the App from unauthorised access or unauthorised modification, disclosure or infringement. For this purpose, Xlocat uses, among other things, SSL for data encryption, which ensures that the data is transferred securely from the client’s device to the Xlocat server.

7. Data retention

7.1. Xlocat will retain personal data for as long as necessary to achieve the objective for which they were collected. Personal data collected for accounting purposes are retained for 7 years as of the end of the financial year when the transaction was recognised in the accounting of Xlocat.

7.2. The information is kept and archived on a trusted server, which may be located in the Republic of Estonia or in another country. A limited number of people have access to the server. Xlocat does not store live streams and has no access to recordings. Each stream is shown only to the user who ordered it (1-to-1). If a stream is recorded, the recording is saved with a third-party service for 14 days. During this time only the ordering user and the filming user can download it, if both agree. After 14 days the recording is deleted.

7.3. Security is ensured by strict standards of confidentiality protection, which are handled by specialised third party organisations.

8. Questions

8.1. If the user or any other person has questions or concerns about the Xlocat Privacy Policy or Personal Data Processing Policy, or if the user or another person has questions or concerns about a breach of privacy, Xlocat can be contacted by email at: info@xlocat.com.