XSAVY

Privacy Policy

Last updated: 7 September 2026

1. Data Controller

XSAVY GmbH Otto-Heilmann-Straße 18 a 82031 Grünwald Germany Email: [email protected] Managing Director: Mohammad Yousuf

2. Overview of Data Processing

We process personal data only insofar as this is necessary to provide a functional website and our content and services. Personal data is generally processed only with consent or on the basis of a statutory permission. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing is permitted by law.

3. Legal Bases

The processing of personal data is based on the following legal bases: • Art. 6 (1) (a) GDPR — consent of the data subject • Art. 6 (1) (b) GDPR — performance of a contract or pre-contractual measures • Art. 6 (1) (c) GDPR — compliance with a legal obligation • Art. 6 (1) (f) GDPR — legitimate interest

4. Contact Form and Lead Data

If you contact us via the contact form or by email, the data you provide (name, email address, where applicable company, phone number, message) is processed for the purpose of handling your enquiry (Art. 6 (1) (b) and (f) GDPR). Data is passed to third parties only insofar as this is necessary for processing. The data is deleted once it is no longer required to achieve the purpose and no statutory retention periods apply.

5. Hosting and Server Logs

This website is hosted by DigitalOcean (EU/Frankfurt data centre). The host collects data in server log files such as IP address, date and time of the request, page accessed, browser type and referrer URL. The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR). Transmission is transport-encrypted (TLS/HTTPS). Log data is deleted after 30 days at the latest.

6. Transactional Emails (Amazon SES)

For sending transactional or application-related emails (including confirmations and replies to enquiries) we use Amazon SES (Amazon Web Services, EU). Replies from mailboxes operated by us (Roundcube/IMAP) are sent directly via the mail hosting server. In doing so, the data required for sending (in particular email address and message content) is processed. Transmission is transport-encrypted (TLS). The legal basis is our legitimate interest in reliable email delivery or the performance of a contract (Art. 6 (1) (f) and (b) GDPR).

7. Cookies

This website uses cookies. Necessary cookies are required for the operation of the website (Art. 6 (1) (f) GDPR). Analytics and marketing cookies are set exclusively after your explicit consent via our cookie banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can change or withdraw your settings at any time with effect for the future via our cookie policy.

8. Google Analytics (GA4) and Third-Country Transfer

This website uses Google Analytics 4 (provider: Google Ireland Ltd.). Use takes place exclusively after your explicit consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); without consent, no analytics cookies are set and no tracking is carried out. You can withdraw your consent at any time with effect for the future. This may involve a transfer of data to servers of Google LLC in the USA; this takes place on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR) and your consent (Art. 49 (1) (a) GDPR). We do not sell personal data.

9. Your Rights as a Data Subject

You have the following rights: access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), objection (Art. 21 GDPR), withdrawal of consent (Art. 7 (3) GDPR) and the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Competent supervisory authority: Bavarian State Office for Data Protection Supervision (BayLDA). To exercise your rights, a message to [email protected] is sufficient.

10. Data Storage, Deletion and Security

Personal data is stored only for as long as is necessary for the respective processing purpose or as statutory retention periods require. We take appropriate technical and organisational measures, in particular transport-encrypted transmission (TLS/HTTPS). In the event of a personal data breach, we act without delay within the scope of the statutory notification and communication obligations (Art. 33, 34 GDPR).

11. Processing on Behalf and Sub-Processors

When we operate email or websites for you, we process personal data in messages, forms and account data on your behalf as a processor under Art. 28 GDPR. We conclude a data processing agreement (DPA) on request. Processing generally takes place in the EU; access by the respective provider may also occur outside the EEA, in which case on the basis of appropriate safeguards (EU Standard Contractual Clauses, Art. 46 GDPR). Our sub-processors include: • DigitalOcean — website hosting (EU/Frankfurt) • Google Ireland Ltd. — Google Analytics/Ads (consent-based; third-country transfer to the USA on SCC basis) • Amazon Web Services/SES — transactional email (EU) • Hostinger International Ltd., Larnaca (Cyprus) — email and DNS hosting, where used (storage in Frankfurt; provider access possibly outside the EEA on SCC basis) We notify you before adding or replacing a sub-processor. Contact: [email protected].

12. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy to reflect changes in the legal situation or changes to our service. The version published at xsavy.com/datenschutz shall apply.