General Data Protection Regulation (GDPR)

We process your personal data based on the following legal grounds under GDPR:

• Consent: When you explicitly consent to data processing (e.g., marketing communications)
• Contract Performance: To fulfill our contractual obligations and provide our services
• Legal Obligation: To comply with applicable laws and regulations
• Legitimate Interests: For business operations, security, and service improvement (balanced with your rights)

Under GDPR, you have the following rights regarding your personal data:

To exercise any of your GDPR rights, you can:

• Contact us at hello@xcdify.com
• Use our contact form at /request-demo
• Access your account settings to manage certain data directly

We will respond to your request within 30 days (or inform you if we need more time). We may need to verify your identity before processing certain requests to protect your privacy.

For enterprise customers, we offer Data Processing Agreements (DPAs) that comply with GDPR Article 28. Our DPAs include:

• Clear definition of processing activities
• Security measures and technical safeguards
• Sub-processor information and approval processes
• Data breach notification procedures
• Assistance with data subject rights requests
• Data retention and deletion obligations

To request a DPA, please contact us at hello@xcdify.com.

We retain your personal data only for as long as necessary to fulfill the purposes outlined in our Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Account Data: Retained while your account is active and for 30 days after deletion
• Project Data: Retained while your account is active, accessible for 30 days after account deletion
• Marketing Data: Retained until you unsubscribe or withdraw consent
• Legal Records: Retained as required by applicable laws (e.g., tax records for 7 years)

After the retention period, data is securely deleted or anonymized in accordance with GDPR requirements.

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Other appropriate safeguards as required by GDPR Chapter V

We maintain a list of sub-processors and their locations. Contact us for more information about our data transfer safeguards.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay, and in any event within 72 hours of becoming aware of the breach, as required by GDPR Article 33 and 34.

Our breach notification will include:

• Nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

We implement Privacy by Design and Privacy by Default principles (GDPR Article 25):

• Data minimization: We only collect data necessary for our services
• Purpose limitation: Data is used only for specified, explicit purposes
• Storage limitation: Data is kept only as long as necessary
• Security measures: Technical and organizational measures are built into our systems
• Default privacy settings: Privacy-friendly defaults are applied

For GDPR-related inquiries, to exercise your rights, or to report a concern, please contact us:

You also have the right to contact your local data protection authority if you have concerns about how we handle your data.

Last updated: November 21, 2025