Privacy statement

Last updated: 14 October 2026. This statement explains which personal data this website processes, why we do so and what your rights are. It covers this website only, not the Xelphia platform itself.

Who we are

[legal name] ("Xelphia", "we") is responsible for processing personal data on this website.

Address: [address]
Chamber of Commerce (KvK) number: [KvK number]
Email: [email address] Do you have a question about privacy, or do you want to exercise one of your rights? Email us at [email address].

What we process and why

When you visit the website

To show you the website and keep it secure, our servers process technical data such as your IP address, your browser type and the pages you request. We need this to deliver the website. The legal basis is our legitimate interest in a working, secure website. When you request a page that does not exist, we record the address you requested, the page you came from and your browser type (user agent), so that we can repair broken links. We do not record your IP address for this. These records are deleted after 90 days at the latest.

When you contact us

When you contact us by email, by phone or through a form on this website, we use the details you give us, such as your name, email address and message, to answer you and, if you ask for it, to arrange a meeting or prepare a proposal. For a form, we also record the page and the button you used. The legal basis is taking steps at your request before entering into an agreement or, for other questions, our legitimate interest in answering them.

Cookies and analytics

Necessary cookies are always on. Analytics and marketing cookies are only used with your consent. With that consent, we use Google Analytics to see how visitors use the website, so we know what to improve. You can withdraw your consent at any time through "Cookie settings" at the bottom of every page. Our cookie policy lists the cookies we use and explains how to change your choice.

Who receives your data

We do not sell your personal data. We only share it with parties that help us run this website and process the data on our behalf:

[hosting provider], which hosts the website and its files.
Google Ireland Limited, for Google Tag Manager and, with your consent, Google Analytics. Google may process data in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission considers to offer an adequate level of protection. We also disclose data when the law requires us to.

How long we keep your data

We keep personal data no longer than we need it for the purposes above:

Records of pages that were not found: up to 90 days.
Contact requests and correspondence: [retention period for contact requests].
Your cookie choice: one year, in your own browser.
Google Analytics data: [Google Analytics retention period].

Your rights

You have the right to access your personal data and to have it corrected or deleted. You can also ask us to restrict its processing, object to processing based on our legitimate interest, and receive your data in a machine-readable format. Where we rely on your consent, you can withdraw it at any time. This does not affect processing that took place before. Send your request to [email address]. We respond within one month and may first ask you to confirm your identity. Not satisfied with how we handle your data? Please let us know. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Security

We take appropriate technical and organisational measures to protect your personal data. The website is only available over an encrypted connection (HTTPS), and only authorised people have access to the data.

Changes

We may update this statement, for example when the website changes. The date at the top shows when we last changed it.