**PRIVACY POLICY**
**OUR PRIVACY POLICY AT A GLANCE**
**Who are we?**
We are XREALITY FACTORY, S.L. and we handle your data as the Data Controller. This means we are responsible for how we use and protect your personal data.
**What do we use your data for?**
We use the data you have provided to us online or through other means to respond to your inquiries and suggestions, provide the services or products you requested, and send you personalized communications that you have subscribed to.
**Why do we have your data?**
We are authorized to process your data for several reasons. When you fill out a form or send an email with an inquiry or suggestion, we have a legitimate interest in addressing it. We are also authorized by your consent when you grant us permission to send you personalized offers.
**With whom do we share your data?**
We only share data with our partner companies to fulfill received requests and provide our services or products, with banking institutions, and with entities required by law. We never sell your data to third parties.
**What rights do you have?**
You have the right to access, rectify, or delete your personal data. You also have the right to object to the use of data you previously authorized us to use, to data portability, and to not be subject to automated individual decision-making.
When processing your personal data, we apply the following principles to ensure maximum protection for you:
– **Lawfulness, fairness, and transparency principle**: We will always require your consent to process your personal data for one or more specific purposes, which we will inform you about beforehand with full transparency.
– **Data minimization principle**: We will only request the necessary data in relation to the purposes for which we need it. The least possible amount of data.
– **Storage limitation principle**: The data will be retained no longer than necessary for the purposes of the processing. Depending on the purpose, we will inform you of the relevant retention period. In the case of subscriptions, we will periodically review our lists and delete records that have been inactive for a considerable amount of time.
– **Integrity and confidentiality principle**: Your data will be processed in a way that ensures adequate security of personal data and guarantees confidentiality. You should know that we take all necessary precautions to prevent unauthorized access or misuse of our users’ data by third parties.
In this privacy policy, you will find more detailed information on how we use the personal data of our customers, suppliers, and users, and in general, all individuals who have contact with us, regardless of the means they used to communicate (online form, phone, email, in person).
We like to be transparent about what we do with your personal data, so you understand the implications of the uses we carry out, and the rights you have in relation to your data. That is why we keep our Privacy Policy, Legal Notice, and Cookie Policy updated, which you can consult on this same website.
If you have any questions or want more information about the privacy policy, you can continue reading the document.
XREALITY FACTORY, S.L. is committed to complying with the current legislation on personal data processing. Through this privacy policy, XREALITY FACTORY, S.L., in accordance with the requirements outlined in the GDPR and LOPDGDD, informs users and individuals whose data is processed of the following:
1. **WHO IS THE DATA CONTROLLER FOR YOUR DATA?**
The data controller is XREALITY FACTORY, S.L.:
– Identity: XREALITY FACTORY, S.L. – B76137728
– Address: Avenida Pintor Felo Monzon, 34b, 35019 – Las Palmas de Gran Canaria (Las Palmas)
– Phone: 928707398
– Website: [www.xrf.ai](http://www.xrf.ai)
– Email: re@xrf.ai
XREALITY FACTORY, S.L. informs users that the data they provide through browsing our website, various data collection forms, or by sending emails will be processed by XREALITY FACTORY, S.L. and that such processing is included in the Register of Processing Activities managed by XREALITY FACTORY, S.L. in accordance with the provisions of the GDPR.
Here’s the translation of the provided privacy policy text into English:
—
**3. For How Long Do We Keep Your Data?**
**3.1. Web Users**
Data processed based on the user’s consent will be kept as long as it is relevant for the purpose for which it was collected and until the consent is revoked.
Data processed based on legitimate interest will be retained for the duration linked to the reason for collecting the data, ensuring adequate guarantees and respect for the rights and freedoms of the data subjects.
Data processed based on the execution of a contract or the adoption of pre-contractual measures will be kept for the duration of the contractual relationship and the subsequent time required by legal obligation.
The IP address obtained through cookies will be kept for one year to demonstrate the user’s consent.
For information on the retention period of cookies, please refer to our website under the “Cookie Policy” section.
**3.2. Providers**
Data processed based on legitimate interest will be retained for the duration linked to the reason for collecting the data, ensuring adequate guarantees and respect for the rights and freedoms of the data subjects.
Data processed based on a contract, as well as data processed based on a legal obligation, will be maintained for as long as the contractual relationship is in effect. The retention period for data once this relationship has ended, or if the processing is linked to a legal obligation, will be as legally required, and the data subject may not revoke the processing of the data except under legal provisions for blocking it.
**3.3. Clients**
Data processed based on the client’s consent will be kept as long as it is relevant for the purpose for which it was collected and until the consent is revoked.
Data processed based on legitimate interest will be retained for the duration linked to the reason for collecting the data, ensuring adequate guarantees and respect for the rights and freedoms of the data subjects.
Data processed based on a contract, as well as data processed based on a legal obligation, will be maintained for as long as the contractual relationship is in effect. The retention period for data once this relationship has ended, in the case of processing linked to a legal obligation, will be as legally required, and the data subject may not revoke the processing of the data except under legal provisions for blocking it.
**3.4. Job Applicants and Candidates**
Data processed based on the consent of the job applicant and candidate will be kept while the selection process they applied for is still open. If the application is not for a specific selection process and is for future applications, the retention period will be a maximum of one year, after which their CV will be deleted and destroyed, unless the individual expresses their desire for it to be retained and updated.
**3.5. Social Media Contacts**
Data processed from social media contacts will be retained while the user and XREALITY FACTORY, S.L. maintain a connection on the social network. Since it does not directly depend on XREALITY FACTORY, S.L., the processing of the data can only be restricted to consultations or deletions. We will process your data as long as the social media user is connected to XREALITY FACTORY, S.L. as ‘friends’, likes, follows, or similar buttons.
To rectify your data, restrict information, or manage the publications you share, it will not be XREALITY FACTORY, S.L. responsible for making such corrections; instead, the user must do so through their social media profile settings, in accordance with the privacy policy of the social media platform itself.
Regardless of the legal basis for data collection, it may be processed for scientific, historical, or statistical research, always implementing adequate guarantees and respecting the rights and freedoms of the data subjects.
**4. Additional Information on Data Processing**
Only individuals over 14 years old can provide data through our website and email. If you are under this age, you must obtain the consent of your parents or legal guardians.
The user guarantees the authenticity and accuracy of all data communicated to XREALITY FACTORY, S.L. and declares that they are over 14 years old, and will be solely responsible for any false or inaccurate statements made.
The personal data processed by XREALITY FACTORY, S.L. may be mandatory or voluntary. Through web forms, we will not request data of special categories to ensure your privacy. If it is necessary to collect data of special categories to provide a service, it will be requested through another means. The data to be requested in the forms are:
a) Identifying data: name and surname, phone number, postal and email address.
b) Data related to the request.
c) Data of users who want to receive information, commercial communications, and updates.
Voluntary information is that which the user is not obliged to provide in order to contact us.
Fields marked with an asterisk (*) or the word (required) in our forms are mandatory; refusing to provide them will result in the inability to provide the service or attend to your request.
If you provide data about third parties, you declare that you have their consent and commit to transferring the information provided in this clause, exempting XREALITY FACTORY, S.L. from any obligation. However, XREALITY FACTORY, S.L. may carry out verifications to ensure that the third party has been informed, adopting the diligence measures established in data protection regulations.
**5. To Whom Will Your Data Be Communicated?**
Data will not be transferred to third parties unless legally required or necessary to fulfill your request.
Among the recipients to whom your data may be communicated are:
– Public administrations and agencies when required by tax, labor, social security, or any other applicable regulation.
– Data processing companies (fraud detection and prevention providers, technology services, customer service, advertising and marketing services, and, in general, third-party providers necessary for the services offered by XREALITY FACTORY, S.L., such as messaging and transport service providers, etc.).
**6. Are There International Data Transfers?**
www.xrf.ai is hosted in Finland, a country in the European Union, within the Economic Area, or that complies with the guidelines established in Articles 46 and 47 of the GDPR; therefore, there will be no international transfers of data provided by users on the website.
Our website only accesses user data through the following means:
– Through the contact forms available to users on the website.
– Through cookies that the user has previously accepted.
International data transfers may also occur in connection with the previous assignments/communications, for which XREALITY FACTORY, S.L. will use the tools provided in Articles 46 and 49 of the GDPR as a guarantee for those transfers made to countries that do not have an adequacy decision from the European Commission.
In any case, third parties with whom certain personal data will be shared will have previously demonstrated the adoption of adequate technical and organizational measures for their proper protection, and transfers will only occur to third countries when there is a binding legal instrument according to Articles 46 and following of the GDPR. By accepting this privacy policy, you agree that an international data transfer may occur according to the guarantees indicated.
If the requirements established in the GDPR are not met, the interested party may consent to the international transfer or execute a contract in the interest of the interested party. Otherwise, authorization must be requested from the Control Authority.
Additionally, we inform you that some services provided by and for XREALITY FACTORY, S.L. may involve the transfer of personal data to a third country outside the EU, in “cloud” services offered by some of the main international providers (e.g., Google, Microsoft). In those services, compliance will be confirmed.
XREALITY FACTORY, S.L. does not sell users’ data to third parties under any circumstances.
**7. What Rights Do You Have and How Can You Exercise Them?**
Users can exercise the following rights before XREALITY FACTORY, S.L.:
a) Access their personal data.
b) Rectify inaccurate or incomplete data.
c) Request the deletion or cancellation of data when, among other reasons, they are no longer necessary for the purposes for which they were collected.
d) Oppose their processing.
e) Request the limitation of their data processing when any of the conditions provided in the regulations are met.
f) Request the portability of their data in cases provided in the regulations.
g) Prevent being subject to automated decisions.
h) Revoke consents granted.
To exercise their rights, the user must send a written request indicating the right they wish to exercise and include a document verifying their identity and a postal or email address for notification purposes. This request can be sent either by postal mail to: XREALITY FACTORY, S.L. Avenida Pintor Felo Monzon, 34b, 35019 – Las Palmas de Gran Canaria (Las Palmas), or to the following email address: re@xrf.ai.
XREALITY FACTORY, S.L. must respond to the request to exercise rights within one month from the receipt of the request. This period may be extended by another two months if necessary, taking into account the complexity and number of requests. We will inform you of any extension within one month of receiving the request, indicating the reasons for the delay.
Furthermore, individuals have the right to file a complaint with the competent Control Authority (Spanish Data Protection Agency) if they believe that XREALITY FACTORY, S.L. has violated the rights recognized by data protection regulations at www.aepd.es.
**8. Are My Data Safe?**
XREALITY FACTORY, S.L. has a contract with the hosting company Hetzner Online GmbH for the hosting of its website. It is a European company and has the latest security systems in place.
In any case, XREALITY FACTORY, S.L. guarantees the adoption of appropriate measures
**9. Links to Other Websites**
If you choose to leave our website through links to other websites not belonging to our entity, XREALITY FACTORY, S.L. will not be responsible for the privacy policies of those websites or for any cookies they may store on the user’s computer.