Privacy Policy

1. Controller

X-centives
Att. Christoph Apitius
Pol. 7, parc. 318
07500 Manacor, Spain

NIF: Y4711192R
VAT ID: ESY4711192R

Email: [email protected]

2. Hosting

Our website is hosted by Webgo GmbH, Germany. The server locations are within the European Union. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the provider.

3. General Information on Data Processing

As a general rule, we process our users’ personal data only to the extent necessary to provide a functional website and our content and services.

4. Collection and Storage of Personal Data and the Nature and Purpose of Its Use

4.1 Visiting the website

When you access our website, the browser used on your device automatically sends information to our website’s server. This information is temporarily stored in a log file. In particular, the following information may be recorded:

• IP address of the requesting computer
• date and time of access
• name and URL of the retrieved file
• website from which access takes place
• browser used and, where applicable, your computer’s operating system

We process the aforementioned data for the following purposes:

• ensuring that the website establishes a smooth connection
• ensuring convenient use of our website
• evaluating system security and stability

The legal basis is Art. 6(1)(f) GDPR.

4.2 Contact form

If you contact us using our contact form, the information you provide in the form, including the contact details entered there, will be stored by us for the purpose of processing your enquiry and in the event of follow-up questions.

The data is forwarded to our internal processing system to handle the enquiry. If you have any questions, you can contact us at [email protected].

The legal basis is Art. 6(1)(b) GDPR (performance of a contract or steps prior to entering into a contract).

4.3 Protection of forms using Cloudflare Turnstile

We use Cloudflare Turnstile to protect our forms against automated input. Cloudflare processes technical signals required to distinguish human input from automated access. Turnstile does not receive the contents entered in the forms. The legal basis is our legitimate interest in the security and functionality of our forms pursuant to Art. 6(1)(f) GDPR. Further information is provided in the Cloudflare Turnstile Privacy Addendum.

4.4 Newsletter

We send our newsletter exclusively through our own email system (SMTP).

• We use a double opt-in procedure for registration to ensure that you are in fact the owner of the email address provided.
• No external service providers are used.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

5. Use of Cookies / Integration of External Content

Our website itself does not set tracking cookies.

• However, certain external content (e.g. videos from YouTube or Vimeo) is only loaded after you have given your express consent (a ‘two-click solution’).
• Only after you have given your consent may these providers set cookies over which we have no control.

Further information is available in the respective providers’ privacy policies:

• YouTube (Google Ireland Limited)
• Vimeo (Vimeo Inc., USA)

6. Use of Google Fonts

We host Google Fonts locally. As a result, no data is transmitted to Google servers.

7. Social Media Links

Our website only contains links to our social media profiles (e.g. LinkedIn, Instagram and Facebook).

No data is transmitted to these providers when you visit our website. A connection to the platforms is only established if you actively click the respective link.

8. Privacy-preserving web analytics and session replays with Umami

We use a self-hosted Umami instance to analyse the use of our website in a data-minimising manner, identify technical errors and improve navigation. Scripts and data are transmitted exclusively through a first-party endpoint under x-centives.com.

We collect visited pages without URL parameters or fragments, the referring domain without external paths, time, browser and operating-system type, device type, language, screen size, country and fixed event categories such as 404 errors, contact activations and successful or failed form submissions. The upstream proxy removes the full IP address, city and region and does not forward them to Umami. Form data, names, email addresses, telephone numbers, messages, free-text errors and individual user identifiers are not sent to Umami. We do not track visitors across websites.

To improve usability, session replays are created for a random sample of 15% of visits. Recording stops after no more than five minutes. Replays contain interactions such as pointer movement, clicks, scrolling and page navigation. Masking is set to strict: all input values and visible page text are masked, while forms and editable content are excluded completely. Session replays are deleted automatically after 30 days and are not retained or exported by us.

Umami does not set cookies or store an analytics identifier in the browser. Processing is not used for advertising, profiling or identifying individuals. The legal basis is our legitimate interest in data-minimising audience measurement, error analysis and improvement of our website pursuant to Art. 6(1)(f) GDPR. This interest is limited by data minimisation, strict masking, short replay retention and the absence of cross-site tracking. We therefore do not use a cookie consent banner for this analytics setup.

You may object to web analytics at any time using the browser control below. We also respect your browser’s Do Not Track signal. The setting applies to the browser in use and can be changed again at any time.

9. Legal Bases for Processing

• Art. 6(1)(a) GDPR - consent
• Art. 6(1)(b) GDPR - performance of a contract / steps prior to entering into a contract
• Art. 6(1)(f) GDPR - legitimate interest

10. Rights of Data Subjects

You have the right:

• under Art. 15 GDPR, to request information about your personal data processed by us,
• under Art. 16 GDPR, to request the immediate rectification of inaccurate data,
• under Art. 17 GDPR, to request the erasure of your data stored by us,
• under Art. 18 GDPR, to request restriction of processing,
• under Art. 20 GDPR, to receive your data in a structured, commonly used and machine-readable format,
• under Art. 7(3) GDPR, to withdraw your consent at any time,
• under Art. 77 GDPR, to lodge a complaint with a supervisory authority.

11. Storage Period

• Contact form data is automatically deleted after the enquiry has been completed, provided that no statutory retention obligations apply.
• Newsletter data is stored until you withdraw your consent.
• Server log files are automatically deleted after 30 days.
• Umami session replays are deleted automatically after 30 days.
• Anonymised Umami page-view and event statistics are retained for no more than 24 months and are then deleted.

12. Data Security

We use the widely adopted SSL/TLS protocol during visits to our website. We also take technical and organisational measures to protect your data against manipulation, loss, destruction or unauthorised access.

13. Competent Supervisory Authority

The competent data protection supervisory authority is:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid
https://www.aepd.es

Users from Germany may also contact the data protection authority of the relevant federal state.