Privacy Policy & GDPR
Who is responsible for your data
The controller of personal data collected through this website is:
XTON sp. z o.o., ul. Stanisława Wigury 14, 33-300 Nowy Sącz, Poland NIP 7343606177 · VAT-EU PL7343606177 · KRS 0000122264 · REGON 180202681
One legal entity operates all XTON® market websites. For any question about your data, or to exercise any of the rights listed below, use the details on our contact page.
This policy applies to visitors from both the United Kingdom and the European Union. Depending on where you are, your data is protected by the UK GDPR (the retained version of the General Data Protection Regulation, read together with the UK Data Protection Act 2018) or by the EU GDPR (Regulation (EU) 2016/679). The article numbers referred to below are the same under both.
What we collect, and why
| What | When | Why |
|---|---|---|
| Name, e-mail address, phone number, company, message | You send an enquiry through a form on this site | To answer your enquiry and, where relevant, prepare an offer |
| Page address the enquiry was sent from | Together with the product enquiry form | So we know which machine you are asking about |
| A random identifier, IP address, page address, referrer, browser | Only after you consent to analytics | To see which pages are used and how visitors find us |
| IP address and request logs | Every visit | Technically necessary to serve the site and protect it from abuse |
| IP address, browser and device signals | Only when you start filling in or submit a form (the Cloudflare Turnstile check loads at that moment, not when the page opens) | To check that the form is sent by a person and not a bot; the check produces a one-time token that is sent with your form to Basin, which verifies it with Cloudflare |
We do not buy personal data, we do not build profiles, and we do not make any decision about you by automated means.
Legal basis
- Answering your enquiry — Art. 6(1)(b) UK GDPR / EU GDPR, steps taken at your request before entering into a contract; and Art. 6(1)(f), our legitimate interest in replying to people who contact us.
- Analytics — Art. 6(1)(a) UK GDPR / EU GDPR, your consent. Nothing is loaded and nothing is stored until you give it, and you can withdraw it at any time.
- Serving and securing the site — Art. 6(1)(f) UK GDPR / EU GDPR, our legitimate interest in running a working, protected website.
- Protecting our forms — Art. 6(1)(f) UK GDPR / EU GDPR, our legitimate interest in keeping our forms free of spam and automated abuse. The Cloudflare Turnstile check is strictly necessary for the form you chose to use, so it does not depend on the cookie banner.
Cookies
Before you make a choice in the cookie banner, this site stores nothing on your device beyond the record of that choice, and sends nothing to Google.
In the United Kingdom the use of cookies is also governed by the Privacy and Electronic Communications Regulations (PECR), and in Ireland by the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011). In line with both, we set non-essential cookies only with your consent.
| Cookie | Category | Purpose | Lifetime |
|---|---|---|---|
cc_cookie | Strictly necessary | Remembers your cookie choice, when you made it and which version of the banner it applies to | 6 months |
_ga | Analytics | A random identifier for your browser | 2 years |
_ga_<ID> | Analytics | Session state for Google Analytics | 2 years |
The analytics cookies are set only after you accept the analytics category. If you withdraw that consent, they are deleted. You can change your choice at any time through the “Cookie settings” link in the footer of every page.
Our banner offers “Accept all” and “Reject all” with equal prominence, on the same screen, in one click. Refusing costs you nothing — the site works identically.
Who else receives your data
| Recipient | Role | Where |
|---|---|---|
| Basin (usebasin.com) | Delivers and stores form submissions | United States |
| Google (Google Analytics) | Website analytics — only with your consent | United States |
| Cloudflare | Hosting and content delivery; protection of our forms against spam and automated abuse (Turnstile) | United States |
| OpenStreetMap Foundation | Supplies the map tiles on our contact page; receives your IP address when that page loads | United Kingdom |
Enquiries sent from a given market are passed to the XTON® representative or regional distributor responsible for that market, so that someone who speaks your language and knows your market can answer you.
International transfers. Basin, Google and Cloudflare process data in the United States. For visitors in the EU/EEA, those transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework. For visitors in the United Kingdom, they rely on the UK Extension to the Data Privacy Framework (the “UK–US data bridge”). Where applicable, these are supplemented by the European Commission’s standard contractual clauses and, for UK data, the UK International Data Transfer Addendum to them. Data sent from the United Kingdom to us in Poland is covered by the UK adequacy regulations recognising the countries of the European Economic Area. Data processed by the OpenStreetMap Foundation in the United Kingdom is covered by the European Commission’s adequacy decision for the United Kingdom.
How long we keep it
- Enquiries — for as long as needed to handle your enquiry and the business relationship that may follow it, and afterwards for as long as claims arising from it can still be brought.
- Analytics — according to the retention period set in Google Analytics, and no longer than the lifetime of the cookies listed above.
- Server logs — for a short period, for security and diagnostics.
- Your cookie choice — 6 months, after which we ask again.
Your rights
Under the UK GDPR and the EU GDPR (as applicable) you may ask us to: give you access to your data, correct it, erase it, restrict how we use it, give you a portable copy, or object to processing we base on legitimate interest. Where processing is based on consent, you may withdraw that consent at any time — withdrawing it does not affect what we did lawfully beforehand.
To exercise any of these, contact us using the details on our contact page.
You also have the right to lodge a complaint with a supervisory authority:
- Poland — the President of the Personal Data Protection Office (UODO, uodo.gov.pl). As our controller is established in Poland, this is our lead supervisory authority under the EU GDPR.
- United Kingdom — the Information Commissioner’s Office (ICO, ico.org.uk).
- Ireland — the Data Protection Commission (DPC, dataprotection.ie).
You may also complain to the supervisory authority in the country where you live or work, or where you believe an infringement took place.
Children
This site is addressed to businesses. We do not knowingly collect data from children.
Changes
If we change how we process data, we update this page and, where the change affects what you consented to, we ask for your consent again.