Privacy Policy

§ 01

Data Controller

The data controller for personal data processing is X DIGITAL ASSETS SIA, registration number 40203611907, Mārupes pagasts, Latvia.

Data processing is carried out in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the Latvian Personal Data Processing Law.

§ 02

What Personal Data We Process

We process only the data necessary for the stated purposes:

Data Category	Specific Data	Collection Method
Contact information	Name, email address, phone number (if provided)	Contact form, email
Company data	Company name, job title	Contact form
Message content	Request text, project description	Contact form
Technical data	IP address, browser, visit time	Automatically in server logs (for security and operation; not used for analytics)

§ 03

Processing Purposes and Legal Basis

• Responding to inquiries — legal basis: performance of a contract (GDPR Art. 6(1)(b)) or legitimate interests.
• Provision of services — legal basis: performance of a contract.
• Website security and technical maintenance — legal basis: legitimate interests (GDPR Art. 6(1)(f)).
• Compliance with legal obligations — legal basis: legal obligation (GDPR Art. 6(1)(c)).

§ 04

Data Recipients and Third-Party Transfers

Personal data is not sold to third parties. Data may be disclosed to:

• Cloudflare — site delivery, protection and our own services (form intake, AI chat) run on the Cloudflare network. Cloudflare Turnstile checks that a form is filled in by a person rather than a bot; it is a security tool and does not build statistics about you.
• Google Cloud (Vertex AI) — if you write in the AI chat, your message is passed to a language model to produce a reply. Do not enter sensitive or confidential data into the chat.
• Email service provider — the content of your enquiry is delivered to our mailbox so that we can reply.
• Government authorities — only when required by Latvian or EU legislation.

Data is not transferred outside the European Economic Area without appropriate safeguards.

§ 05

Data Retention Periods

Data Type	Retention Period
Contact form inquiries	3 years from the date of contact or until the inquiry is fulfilled
Contractual data	10 years (in accordance with the Latvian Commercial Law)
Technical log files	Up to 12 months

§ 06

Your Rights as a Data Subject

Under the GDPR, you have the following rights:

• Right of access — to obtain confirmation as to whether we process your personal data and to request a copy thereof.
• Right to rectification — to request the correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — to request the deletion of data where there is no legal basis for its continued storage.
• Right to restriction of processing — to request the restriction of processing in certain circumstances.
• Right to object — to object to processing based on legitimate interests.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Withdrawal of consent — to withdraw consent at any time (without affecting the lawfulness of prior processing).

§ 07

Cookies

We use cookies to ensure the functionality of our website. Cookies are small text files stored on your device.

• Essential cookies — ensure the basic functionality of the website. Legal basis: legitimate interests.

We do not use analytics, marketing or tracking cookies - there is no Google Analytics, no other statistics tool and no advertising pixels on the website. Because we use only essential cookies, no separate consent is required and the website shows only an informational notice. More information: Cookie Policy.

§ 08

Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction. These measures include:

• HTTPS encryption across the entire website
• Access rights restriction (need-to-know principle)
• Regular security audits
• Employee training on data protection

In the event of a data breach, we will notify the competent authorities and affected individuals within the timeframes prescribed by the GDPR.

§ 09

Policy Amendments

We reserve the right to update this privacy policy. Material changes will be communicated by publishing the new version on the website with an updated date. We recommend reviewing this document periodically.

§ 10

Filing a Complaint

If you believe that we are processing your data unlawfully, you have the right to file a complaint with the supervisory authority:

We encourage you to contact us first so that we can resolve the matter through direct communication.

§ 11

Client-Submitted Documents and Content

This section applies whenever a Client (natural or legal person) submits documents, files, text or other content to us (the "Submitted Content") in connection with our services, including contract drafting, legal consultations, system development, AI analysis or any other engagement.

11.1. Purposes and legal basis

We process Submitted Content only for the following purposes:

• Performance of services requested by the Client (legal basis: contract performance, GDPR Art. 6(1)(b)).
• Compliance with statutory obligations such as accounting, tax or disclosure requirements (legal basis: legal obligation, GDPR Art. 6(1)(c)).
• Protection of our legitimate interests, including establishing or defending legal claims (legal basis: legitimate interests, GDPR Art. 6(1)(f)).

We do not use Submitted Content for any other purpose, including marketing, profiling, third-party services or AI model training, unless there is a separate written agreement with the Client.

11.2. Confidentiality

All Submitted Content is treated as confidential information protected in accordance with the contract concluded between the parties, professional secrecy obligations and Section 22 of the Latvian Commercial Law. Confidentiality continues to apply after the engagement ends, unless the law requires otherwise.

Our employees, partners and processors have signed confidentiality undertakings or are subject to equivalent legal duties.

11.3. Storage and deletion

Type of Submitted Content	Retention period
Contracts and accounting documents	10 years after the transaction ends (Section 13.1 of the Commercial Law, Accounting Law)
Client project working materials	Duration of the service + 3 years (or shorter at the Client's written request)
Text/PDF submitted to AI Demo page	Not stored - processed in memory and discarded immediately after the response is returned
Correspondence and emails about a project	5 years from the last communication
Materials containing third-party personal data	Only as long as needed for service performance, no longer than the periods above

The Client may request deletion of their Submitted Content before the above periods, unless the law or our legitimate interests (e.g. retention of performance evidence) require longer storage. Requests should be sent to info@xda.lv with the subject "Submitted Content deletion request".

11.4. Security measures

• End-to-end HTTPS encryption during upload (TLS 1.3).
• Storage in encrypted repositories (AES-256 or equivalent).
• Need-to-know access restrictions - only personnel directly engaged on the project.
• Regular backups and recovery procedures.
• Audit logging of access to sensitive documents.

§ 12

Use of AI and Automated Processing

In certain services (for example, the AI Demo page at xda.lv/en/demo or in custom-built AI solutions delivered under separate agreements) we use artificial intelligence (AI / LLM) models to analyse or process Submitted Content.

12.1. How it works

• The submitted text or document content is sent to a cloud AI provider (e.g. Anthropic, OpenAI or others - current list available on request) only to complete that specific request.
• The AI provider acts as a processor within the meaning of GDPR Art. 28 under the applicable data processing agreement (DPA).
• Neither we nor the AI provider use Submitted Content to train new AI models - this is explicitly prohibited under our supplier contracts.
• Responses are returned to the Client and are not disclosed to third parties.

12.2. Transfers outside the EEA

Some AI providers are located outside the European Economic Area (EEA), for example in the USA. For such transfers we ensure appropriate safeguards under GDPR Art. 46, including:

• EU Commission Standard Contractual Clauses (SCCs, Decision 2021/914);
• EU-U.S. Data Privacy Framework certification (where applicable);
• Additional technical measures - encryption in transit and at rest, data minimisation prior to transmission.

The Client may request information about specific processors and their location by emailing info@xda.lv.

12.3. No automated decision-making

AI analysis results are informational and advisory. They do not constitute automated decision-making within the meaning of GDPR Art. 22 and they do not replace professional legal, financial or technical advice. Final decisions are always made by the Client or an authorised expert.

12.4. AI Demo page - special terms

§ 13

Client Warranties and Liability for Submitted Content

By submitting documents or other content, the Client represents and warrants that:

• The Client holds all rights and authority necessary to share the content - including copyright, usage licences and any third-party consents.
• The legal basis for processing any third-party personal data included in the Submitted Content is lawful (the Client has obtained the necessary consents, has provided the necessary notices, or another GDPR Art. 6 basis is in place).
• The Client has informed data subjects that their data may be processed in the course of our service, to the extent required by GDPR Arts. 13 and 14.
• Submitted Content does not violate Latvian, EU or other applicable law, including rules on trade secrets, state secrets, intellectual property or personal rights.
• The Client is responsible for ensuring that the Submitted Content does not contain malware, viruses or any other harmful code.

If any of these warranties is breached, the Client is liable for any resulting damages (including third-party claims against us) and shall indemnify and hold harmless X DIGITAL ASSETS SIA from such liability.

More detailed provisions are set out in our Terms of Use and, where applicable, in a separate service agreement or Data Processing Agreement (DPA) between the parties.

§ 14

Data Processing Agreement (DPA)

When the Client (as controller) shares personal data with us for processing (we act as processor), the parties are entitled - and in certain cases, under GDPR Art. 28, required - to enter into a separate Data Processing Agreement (DPA).

A DPA template and proposal can be requested by emailing info@xda.lv with the subject "DPA request". Our standard DPA is based on the EU Commission template (Decision 2021/915) and adapted to the specifics of our services.