Privacy Policy

Draft – pending legal review. This text describes how the website actually works, but it must be reviewed and approved by a qualified lawyer, and the company details must be completed in the CMS, before the site goes live.

Last updated: 18 September 2026

1. Who is responsible for your personal data

The controller of the personal data described in this policy is Xentron Technologies s. r. o., with registered office at Gorkého 129/10, 811 01 Bratislava - Staré Mesto, Slovakia, company identification number (IČO) 57510571, entered in ⟨Nyilvántartó hatóság – kitöltendő⟩, ⟨Nyilvántartási bejegyzés – kitöltendő⟩ (in this policy: "Xentron", "we" or "us").

For any question about this policy, or to exercise any of the rights described in section 8, write to info@xentrontech.com.

2. What this policy covers

This policy explains how we handle personal data when you visit this website, contact us through one of our forms, or request a document from our resource library.

It does not cover the data processed inside our customers' own on-premise environments. That infrastructure is operated at the customer's premises and under the customer's control; our role, responsibilities and access there are defined in the service contract and in the data processing agreement concluded with that customer.

3. What we collect, why, and on what legal basis

3.1 Enquiries, proposal requests and the service configurator

When you submit a consultation request, a proposal request or the service configurator, we process:

• Contact details you provide: first and last name, business email address, and — where you choose to give them — telephone number, organisation, job title and country.
• Context you provide about your requirement: organisation size, estimated data volume, service level of interest, expected number of AI users, AI Agents of interest, industry, number of locations, planned timeline, and the message you write.
• Calculations you carried out on the site: the values and results of the ROI calculator and the choices you made in the service configurator, where you submit them with your request.
• Your consent record: which statements you agreed to, and when.

Purpose: to answer your enquiry, to prepare an individual proposal, and to keep a record of our correspondence with you.

Legal basis: Article 6(1)(b) GDPR — steps taken at your request before entering into a contract. Where you contact us on behalf of an organisation that is not yet a counterparty, we rely on Article 6(1)(f) GDPR, our legitimate interest in responding to business enquiries addressed to us. Optional consent statements shown on the form are based on Article 6(1)(a) GDPR and can be withdrawn at any time.

3.2 Documents from the resource library

Some documents are made available after you identify yourself. In that case we process the details listed in section 3.1 together with the identifier of the document you requested, and we send you a personal download link that remains valid for seven days.

Purpose: to deliver the document you asked for and to understand which material is useful. Legal basis: Article 6(1)(b) GDPR — performance of your request.

3.3 Requests concerning your own data

If you submit a request under section 8, we process your name, your email address and the content of your request in order to identify you, to act on the request, and to be able to demonstrate that we acted on it.

Legal basis: Article 6(1)(c) GDPR — compliance with our legal obligations under the GDPR.

3.4 Operating and protecting the website

Every request to the website is handled by our hosting infrastructure, which keeps short-lived technical logs. Together with each form submission we also store:

• the page you submitted from, the page you first arrived on, the referring website and any campaign parameters in that address;
• your browser identification string (user agent) and the language version you used;
• a keyed cryptographic hash of your IP address. We do not store the IP address itself; the hash cannot be converted back into an address without a secret key held by the application. It remains personal data in pseudonymised form.

Purpose: to keep the site available, to detect and stop automated abuse of our forms, and to be able to investigate a security incident. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in the security and integrity of our own service.

3.5 Measurement and statistics

The site includes a first-party event counter that uses no cookies and no device storage. It only increments aggregate totals per day, per page and per language. It does not record IP addresses, identifiers or any other data relating to an identifiable person, and it cannot be used to recognise you.

If we additionally use an analytics service, it is loaded only after you have given your consent in the cookie banner, and never before. You can withdraw that consent at any time through Cookie settings in the footer. See our cookie policy for the current list.

Legal basis: Article 6(1)(a) GDPR — consent, for the analytics service; for the aggregate counter no personal data is processed.

4. How long we keep your data

When the retention period expires, the record is anonymised automatically: name, email address, telephone number, job title, organisation, message text, browser identification string, referrer and the IP hash are erased. What remains is a record that cannot be linked to you, kept only so that our internal statistics stay consistent.

You can ask us to erase your data sooner — see section 8.

5. Who has access to your data

Your data is accessible to the members of our team who need it to answer you, under individual accounts with two-factor authentication and role-based permissions. Every access to and change of a record is logged.

We also use service providers who process data on our behalf, under a written data processing agreement and only on our instructions. Our current processors are listed in the processors section of this policy.

We do not sell personal data and we do not share it for third-party advertising.

We disclose data to a public authority only where we are legally required to do so.

6. Transfers outside the European Economic Area

Our website and the data submitted through it are hosted within the European Union.

Where a processor listed in section 5 would transfer personal data outside the European Economic Area, that transfer takes place only on the basis of an adequacy decision of the European Commission, or under the Standard Contractual Clauses together with the additional measures required in each case. You may ask us for a copy of the safeguards in place.

7. Prioritisation — and what we do not do

To help our team respond in a sensible order, the system calculates a simple internal priority number from the business information you provide (for example which service you asked about, the size of your organisation and whether you completed the configurator). It does not use any special category of data, it produces no decision on its own, and it has no legal effect on you.

We do not carry out automated decision-making producing legal effects concerning you, within the meaning of Article 22 GDPR, and we do not build behavioural profiles of visitors.

8. Your rights

Under the GDPR you have the right to:

• obtain access to the personal data we hold about you and a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, where one of the grounds in Article 17 GDPR applies;
• have processing restricted, in the cases set out in Article 18 GDPR;
• receive your data in a portable format and have it transmitted to another controller, where Article 20 GDPR applies;
• object to processing based on our legitimate interest, on grounds relating to your particular situation;
• withdraw your consent at any time, without affecting the lawfulness of what we did before you withdrew it.

The quickest way to exercise these rights is our data request form; you can also write to info@xentrontech.com. We will respond within one month; where a request is complex, we may extend that period by two further months and will tell you if we do. We may ask you for information needed to confirm your identity, and we will not use that information for anything else.

If you believe we have not handled your data lawfully, you may lodge a complaint with the supervisory authority:

Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky) Hraničná 12, 820 07 Bratislava 27, Slovak Republic https://dataprotection.gov.sk

You may also bring a complaint before the supervisory authority of the Member State where you live or work.

9. How we protect your data

The site is served exclusively over an encrypted connection and sends a restrictive content security policy. Forms are protected against automated submission, and the administration interface requires an individual account with two-factor authentication. Access to personal data is limited by role, and administrative actions are logged. Backups are taken regularly and their restoration is tested.

10. Changes to this policy

If we change how we handle personal data, we will update this policy and change the date shown at the top. Where the change is significant, we will say so on the website. If the change concerns cookies or similar technologies, we will ask for your consent again.