1. Scope and data controller
This Privacy Policy explains how Xaton Tech Ltd ("Xaton", "we", "us" or "our") processes personal data in connection with (i) visits to www.xatontech.com (the "Website"), (ii) business and other professional enquiries, and (iii) recruitment enquiries and job applications, including applications sent by email. It is intended to provide information under Articles 13 and, where applicable, 14 of Regulation (EU) 2016/679 (the "GDPR").
The data controller for the activities described in this Policy is Xaton Tech Ltd, registration number HE 457333, registered office: 88-SC, Eleftheriou Venizelou str., 3035, Limassol, Cyprus. Contact: info@xatontech.com.
This Policy does not govern personal data processed within software products licensed to corporate customers, nor does it replace any product-specific privacy notice or data processing agreement. The controller/processor roles for such activities are determined separately by the relevant arrangements and applicable law.
2. Categories and sources of personal data
Depending on how you interact with us, we may process the following categories:
| Interaction | Personal data potentially processed |
|---|---|
| Website visits | IP address, browser/device characteristics, approximate location derived from IP, access times, requested pages, referral information, technical logs, security events and cookie choices. |
| Business enquiries | Name, professional contact details, organisation, role, subject of enquiry, correspondence and any information voluntarily provided. |
| Recruitment | Name, email/phone, CV, employment and education history, qualifications, portfolio or publicly provided professional profile, interview notes, assessment results and correspondence; where relevant, references or information supplied by recruitment intermediaries. |
| Legal and security matters | Information reasonably necessary to investigate incidents, respond to lawful requests, comply with legal obligations or establish, exercise or defend legal claims. |
We generally obtain information directly from you or through your use of the Website. For recruitment, we may also receive information from a recruiter, a person referring you, professional references you have authorised us to contact, or publicly accessible professional sources where relevant and lawful. Where Article 14 GDPR applies, we provide the required information within the applicable timeframe, unless a lawful exception applies.
We do not ask applicants to provide sensitive information such as health details, political or religious beliefs, or identity documents at the initial application stage. If such data is received or becomes necessary for a particular lawful purpose, we will assess the applicable GDPR Article 9 condition and provide additional information where required.
3. Purposes and legal bases
| Purpose | Legal basis under GDPR |
|---|---|
| Operate, secure and troubleshoot the Website; prevent abuse; maintain technical logs | Article 6(1)(f): legitimate interests in reliable and secure Website operation; Article 6(1)(c) where a specific legal duty applies. |
| Respond to business and professional enquiries and assess potential B2B cooperation | Article 6(1)(f): legitimate interests in professional communications and business development; Article 6(1)(b) where steps are taken at an individual's request before entering into a contract with that individual. |
| Review job applications, communicate with candidates, conduct interviews and make hiring decisions | Article 6(1)(b) for pre-contractual steps requested by the applicant, and/or Article 6(1)(f) for managing and evaluating recruitment, as applicable. |
| Keep candidate details for consideration for future, unrelated vacancies | Article 6(1)(a): separate, freely given consent, where this option is offered. |
| Comply with law; respond to requests; protect legal rights | Article 6(1)(c) for legal obligations; Article 6(1)(f) for legitimate interests in establishing, exercising or defending legal claims. |
| Use non-essential analytics, functional or marketing cookies where deployed | Article 6(1)(a): consent for personal-data processing associated with such technologies, together with the applicable ePrivacy consent requirements. |
Where we rely on legitimate interests, we consider the necessity of the processing and its impact on the individuals concerned. You may object to processing based on Article 6(1)(f), as described below.
4. Recruitment-specific information
Applications may be submitted to a recruitment contact or other email address communicated by Xaton. We use candidate information to assess qualifications and suitability, arrange interviews, communicate recruitment decisions, and, where appropriate, prepare a potential employment or contractor relationship.
Providing a CV and relevant contact details is generally necessary for us to assess an application; providing other information is voluntary unless specifically identified as necessary for a lawful stage of the recruitment process. Failure to provide necessary information may prevent us from evaluating the application.
We do not use an application for unrelated marketing. We will not add a candidate to a future-vacancies talent pool without an appropriate separate legal basis, normally opt-in consent. Where automated screening or AI-assisted recruitment tools are introduced, the process, safeguards and any additional disclosure requirements will be assessed and this Policy updated before deployment.
5. Recipients and service providers
Personal data may be accessed, on a need-to-know basis, by authorised Xaton representatives and personnel responsible for website administration, correspondence, recruitment, information security, legal or compliance matters. We may use third-party service providers such as website hosting, email, IT security, document storage, recruitment platforms or professional advisers, subject to appropriate contractual and security safeguards. We may disclose information to competent public authorities or courts where required by law.
We do not sell personal data. Disclosure to a separate corporate entity, including an affiliated company where applicable, must have a legitimate purpose and appropriate legal basis; corporate affiliation alone does not authorise unrestricted data sharing.
6. International transfers
Where personal data is transferred outside the European Economic Area, we will assess the destination and recipient and implement a valid GDPR Chapter V transfer mechanism where required, such as an adequacy decision or the European Commission's Standard Contractual Clauses together with supplementary measures where appropriate. You may request information about relevant safeguards using the contact details above.
7. Retention
We retain personal data only for as long as necessary for the relevant purpose, taking account of legal requirements, security needs and potential claims. Our indicative retention approach is:
| Category | Retention approach |
|---|---|
| Website technical and security logs | A limited period proportionate to security and troubleshooting needs, normally up to 90 days unless an incident or legal obligation requires longer. |
| Routine business correspondence | For the duration of the enquiry or relationship and thereafter only as reasonably necessary for follow-up, record-keeping or legal claims. |
| Unsuccessful recruitment applications | Normally up to 6 months after the recruitment decision, unless a longer period is justified and documented by applicable law or an actual dispute. |
| Future-vacancy talent pool | Up to 12 months from consent or until consent is withdrawn, whichever occurs first; renewal requires a fresh valid basis. |
| Successful applicants | Relevant records may transfer to an appropriate employment/contractor file, subject to a separate applicable privacy notice and retention rules. |
| Cookie records | For the lifespan described in the Cookie Policy and the associated technical register, subject to the need to demonstrate consent. |
These periods must be implemented in internal retention procedures. Information relevant to a legal claim, investigation or mandatory preservation requirement may be retained for longer where justified.
8. Security
We apply appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration and disclosure, taking into account the nature of the information and associated risks. No method of electronic transmission or storage is completely secure.
9. Your GDPR rights
Subject to applicable conditions and exceptions, you have the right to request access to your personal data, rectification, erasure, restriction of processing and data portability; to object to processing based on legitimate interests; and to withdraw consent at any time where processing is based on consent, without affecting earlier lawful processing. You also have the right not to be subject to a decision based solely on automated processing where Article 22 GDPR applies.
To exercise your rights, contact info@xatontech.com. We may request proportionate information to verify identity. We will respond within the time limits set by the GDPR, ordinarily within one month, subject to permitted extensions.
You may lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or another competent EU/EEA supervisory authority. You are not required to contact us before exercising that right.
10. Cookies and similar technologies
We may use strictly necessary cookies and, where enabled and consented to, optional cookies or similar technologies. The categories, purposes, third-party providers, retention periods and available controls are described in the Cookie Policy at www.xatontech.com/cookie-policy. Non-essential technologies requiring consent will not be activated before that consent is obtained.
11. Children
The Website is intended to provide corporate information and is not directed to children. We do not knowingly solicit personal data from children through the Website. If we become aware of inappropriate collection, we will take appropriate steps under applicable law.
12. Changes and contact
We may update this Policy to reflect changes in our processing activities or applicable law. The current version and its date will be available on the Website. For questions or requests concerning privacy, please contact info@xatontech.com.