1. Controller
The data controller is XEOTYPE SRL, RO48497754, J24/1044/2023, with registered address in Municipiul Sighetu Marmației, Strada Dragoș Vodă, Nr. 185, Județ Maramureș, Romania. Contact: contact@xeotype.com.
This policy applies to the public Xeotype websites and communication flows operated by Xeotype, including xeotype.com, hub.xeotype.com, robotics.xeotype.com, prints.xeotype.com when launched, public contact forms, collaboration requests, product enquiries, email communication and WhatsApp conversations initiated from the websites.
2. What data we may process
Depending on how you interact with Xeotype, we may process the following categories of personal data:
- Identity and contact data: name, surname, role, organisation, email address, phone number, preferred communication channel and country.
- Business and billing data: company name, fiscal details, registration data, billing address, delivery address, purchase history, invoice details and payment status. Xeotype does not intentionally collect card data on these public websites.
- Project and request data: product ideas, collaboration descriptions, robotics requirements, software requirements, quantities, deadlines, sketches, links, photos, videos, 3D files, drawings, technical references and other information you choose to send.
- Communication data: email content, WhatsApp messages, meeting notes, call summaries, support messages, quote discussions and follow-up decisions.
- Technical data: IP address, browser type, device information, operating system, approximate access time, requested URL, referrer, status code, security logs and diagnostic logs generated by hosting infrastructure.
- Media and event data: photos, videos or public project references where you provide them, consent to their use, or they relate to public Xeotype work, public competitions or public portfolio materials.
3. Why we process data
- To answer contact, product, robotics, software, 3D printing, prototype and collaboration enquiries.
- To evaluate feasibility, prepare quotes, estimate delivery, suggest technical solutions and decide whether Xeotype can accept a request.
- To manage orders, fulfil accepted work, deliver products, provide support, handle changes and maintain communication.
- To issue invoices, keep accounting records, manage payment status, resolve disputes and comply with legal obligations.
- To operate, secure, debug and improve public websites and prevent misuse, fraud, spam, malware or unauthorised access.
- To document public portfolio work, product examples, robotics projects and ecosystem development, where lawful and appropriate.
4. Legal bases
Depending on the context, Xeotype may rely on one or more of the following legal bases under the GDPR:
- Consent: when you voluntarily send a message, request contact, agree to receive a reply, provide optional materials, subscribe to a future communication flow or allow the use of certain media.
- Pre-contractual steps: when you request a quote, order discussion, product evaluation, collaboration assessment or technical proposal.
- Contract performance: when processing is required to deliver an accepted order, project, product, support task or collaboration.
- Legal obligations: when records are required for accounting, tax, audit, consumer protection, security or regulatory reasons.
- Legitimate interests: for normal business communication, website security, service improvement, portfolio management, dispute prevention, fraud prevention and protecting Xeotype’s rights, provided those interests are not overridden by your rights and freedoms.
5. Contact forms, email and WhatsApp
Some Xeotype pages may use forms that generate an email, open your email client, open WhatsApp or route your request through a website form handler. If the form only opens your email client, the website itself does not store the form content before you send it. Once you send the message, Xeotype receives and processes it as business communication.
When you contact Xeotype through WhatsApp, your interaction is also subject to WhatsApp’s own terms, privacy policy and technical processing. Avoid sending unnecessary sensitive information through public communication channels.
6. Files, prototypes and technical materials
If you send technical files, drawings, photos, videos, logos, robotics documentation, school or event materials, 3D models, code snippets or other project files, Xeotype processes them only for evaluation, communication, production, delivery, support, documentation or legal protection connected to your request.
Please do not send special-category data, confidential student data, health data, ID documents, bank details, passwords, source code secrets or third-party confidential files unless Xeotype specifically requests them and an appropriate secure channel or agreement is in place.
7. Minors, schools and educational contexts
Xeotype projects may relate to educational organisations, robotics teams, students, youth projects and public events. The public websites are not intended to collect children’s personal data directly. If a school, team, mentor, organiser or parent sends information about minors, that person must ensure they have the required authority and consents for the intended communication, event documentation or product/project context.
If you believe that a minor’s personal data was sent to Xeotype without proper authority, contact contact@xeotype.com and we will review the situation.
8. Sharing data and processors
Xeotype does not sell personal data. Data may be shared only when necessary with:
- hosting, domain, infrastructure, email, security and technical providers;
- communication platforms such as email or WhatsApp when you choose those channels;
- accounting, invoicing, legal, audit or administrative providers;
- delivery, courier or logistics providers for physical products;
- production, prototyping or specialist subcontractors where needed for a confirmed request;
- public authorities, courts or regulators where legally required.
Where required, providers act under appropriate confidentiality, security and data protection obligations.
9. International transfers
Xeotype is based in Romania and primarily operates in the European Union. Some technology providers may process data in other countries. Where personal data is transferred outside the European Economic Area, Xeotype relies on appropriate safeguards where required, such as adequacy decisions, standard contractual clauses or equivalent lawful mechanisms used by the provider.
10. Retention
Xeotype keeps personal data only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law.
- Simple enquiries may be kept for the time needed to reply and maintain reasonable follow-up records.
- Quotes, order discussions and project communication may be kept for the duration of the commercial relationship and a reasonable limitation period.
- Invoices, accounting and tax records are kept for the period required by applicable law.
- Server logs are generally kept for limited security and diagnostic periods, unless longer retention is needed to investigate abuse, incidents or legal claims.
- Portfolio materials may remain published while they are relevant, unless a valid removal request or contractual limitation applies.
11. Security
Xeotype uses reasonable technical and organisational measures to protect data, including access limitation, secure hosting practices, careful handling of business communication and deletion or restriction where data is no longer needed. No internet communication is completely risk-free, so please avoid sending unnecessary sensitive information through ordinary email, forms or messaging apps.
12. Your rights
Under the GDPR, individuals may have rights including the right to be informed, access personal data, rectify inaccurate data, request erasure, restrict processing, request portability, object to processing based on legitimate interests, withdraw consent where consent is the legal basis, and not be subject to certain solely automated decisions.
To exercise these rights, contact contact@xeotype.com. More details are available on the GDPR requests page.
13. Automated decision-making
Xeotype does not currently use the public websites to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. If this changes, the policy will be updated and appropriate safeguards will be provided.
14. Complaints
If you believe your data protection rights have not been respected, you may contact Xeotype first at contact@xeotype.com. You may also contact the Romanian data protection authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, through dataprotection.ro.
15. Updates
This policy may be updated as Xeotype websites, products, contact flows, order processes and communication systems evolve. The latest version will be published on this page and will show the update date above.
