Privacy policy

Who we are

XPATIC provides paid media and lead generation services to businesses that want to reach expats and foreign nationals living in their market.

We handle personal data in line with the UK General Data Protection Regulation and the Data Protection Act 2018, and with Regulation (EU) 2016/679 where it applies. That means we collect only what we need, tell you why we have it, keep it no longer than we have a reason to, and give you a route to see, correct or delete it.

What this policy covers

This policy covers information we collect about you through this website, including the enquiry form.

It does not cover data we process on behalf of our clients under a separate agreement. Where we run campaigns for a client, that client is the controller and we act as their processor under a written contract.

What we collect

What you give us. Your name, company, work email, phone number, and whatever you tell us about your market, sector and requirements through the enquiry form.

How you arrived. Campaign parameters in the link you clicked, such as source, medium and campaign, and advertising click identifiers, so we know which marketing brought you here.

Technical information. Your IP address and browser user agent, recorded when you submit the form.

We do not ask for and do not want special category data. Please do not include health, political, religious or similar information in the free-text box.

Why we use it

To reply to your enquiry. Our lawful basis is your consent, given when you tick the box on the form, together with our legitimate interest in responding to a business enquiry we received.

To measure our advertising. Understanding which campaigns produce enquiries. Our lawful basis is legitimate interest.

We do not sell your information, and we do not pass your enquiry to third parties for their own marketing.

Who we share it with

We use a small number of service providers to run this site and respond to you. Each is bound by contract to process data only on our instructions.

Hosting. Our server and database are hosted in the European Union.

Email delivery. A third-party provider delivers our notification and reply emails.

Advertising platforms. Where you arrived through a paid advert, we send the platform a record that an enquiry was made. This is sent from our server rather than your browser, and any email address or phone number in it is hashed so it cannot be read directly. It is used only to measure which adverts work. You can object using the contact details above.

Analytics. We use Google Analytics to understand how the site is used. Analytics cookies are only set if you accept them. See the cookie policy.

International transfers

Some of our providers are based outside the UK and the European Economic Area. Where data is transferred, we rely on the safeguards permitted under data protection law, such as adequacy decisions or standard contractual clauses.

How long we keep it

Enquiries that do not become clients are kept for two years, so we can pick up a conversation that resumes later, then deleted.

Records relating to clients are kept for as long as the relationship lasts and for six years afterwards, to meet tax and accounting obligations.

You can ask us to delete your enquiry sooner at any time.

Your rights

You have the right to ask for a copy of what we hold, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting what we did before you withdrew it.

Email hello@xpatic.com and we will respond within one month.

If you are not satisfied with our response you can complain to your national data protection authority. In the UK that is the Information Commissioner's Office, and in Spain the Agencia Española de Protección de Datos.

Changes

If we change this policy we will update the date at the top of this page.

Contact