Data Privacy

Privacy Policy

Last updated: February 25, 2026

1. Controller Information

xytium FZ-LLC
Al Shohada Road, Street C
Al Hamra Area | P.O. Box 16111
Ras Al Khaimah – United Arab Emirates

Email: contact@xytium.com

xytium FZ-LLC ("xytium", "we", "our", "us") acts as the controller of personal data collected through this website and in the context of our services.

2. Scope of This Policy

This Privacy Policy applies to:

• Visitors of our website
• Prospective clients
• Business partners
• Newsletter subscribers
• Job applicants
• Contractors and freelancers.

3. Categories of Personal Data Collected

We may collect and process the following categories of personal data:

3.1 Contact & Identification Data

Name, company name, job title, email address, phone number, country.

3.2 Communication Data

Information provided via contact forms, emails, video meetings or direct communications.

3.3 Marketing & CRM Data

Interaction history, website activity, campaign engagement, lead scoring data and marketing preferences processed through HubSpot.

3.4 Technical & Usage Data

IP address, browser type, device information, operating system, pages visited, time spent and referring URLs.

3.5 Application Data

CVs, cover letters, work samples, professional background, references and other information submitted in connection with job or freelance applications.

We do not intentionally collect special categories of personal data unless voluntarily provided and necessary for a legitimate purpose.

4. Purpose and Legal Basis of Processing (GDPR)

If you are located in the European Union, processing is based on:

4.1 Consent (Art. 6(1)(a) GDPR)

• Newsletter subscription
• Marketing communications
• Non-essential cookies

4.2 Contractual Necessity (Art. 6(1)(b) GDPR)

• Provision of services
• Project execution
• Recruitment process

4.3 Legitimate Interests (Art. 6(1)(f) GDPR)

• Responding to inquiries
• Business development
• Improving our website and services
• Fraud prevention
• Network security

Our legitimate interest lies in operating and growing our business in a structured and secure manner.

5. Use of HubSpot (CRM & Marketing Automation)

We use HubSpot Inc., 25 First Street, Cambridge, MA 02141, USA, as our CRM and marketing automation platform.

HubSpot is used to:

• Manage contact data
• Process inquiries
• Send newsletters
• Track website interactions
• Perform marketing automation
• Analyze campaign performance
• HubSpot may collect:
• IP address
• Browser data
• Page views
• Form submissions
• Email engagement.

We have entered into a Data Processing Agreement (DPA) with HubSpot, including Standard Contractual Clauses (SCCs) to ensure GDPR-compliant international data transfers.

For more information: https://legal.hubspot.com/privacy-policy

6. Newsletter & Marketing Communication

If you subscribe to our newsletter:

• We store your email address and contact details.
• We track engagement (open rates, clicks) via HubSpot.
• You may unsubscribe at any time using the link provided in each email.

Processing is based on your explicit consent.

7. Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited.

Google Analytics collects:

• IP address (anonymized where applicable)
• Device and browser information
• Usage behavior
• Interaction data.

This information helps us analyze website performance and improve user experience.

Where required by law, Google Analytics is activated only after consent through our cookie banner.

We have entered into a Data Processing Agreement with Google and implemented appropriate safeguards for international transfers.

More information: https://policies.google.com/privacy

8. LinkedIn Insight Tag

We use the LinkedIn Insight Tag, provided by LinkedIn Ireland Unlimited Company.

This tool allows us to:

• Analyze campaign performance
• Measure conversions
• Build anonymized audience insights
• LinkedIn may process:
• IP address
• Device information
• Browser data
• Page visits.

Processing occurs only where legally permitted and, where required, based on consent.

More information: https://www.linkedin.com/legal/privacy-policy

9. Cookies

Our website uses:

• Essential cookies (technical functionality)
• Analytics cookies
• Marketing cookies.

Non-essential cookies are placed only after consent where required by applicable law.

You may manage cookie preferences through your browser settings.

10. Recruitment & Application Data

When applying for a position or freelance collaboration:

We process:

• CV and professional history
• Contact information
• Portfolio and references
• Interview notes

Application data is processed solely for evaluating professional suitability.

Retention:

• Successful candidates: data retained as part of contractual relationship
• Unsuccessful candidates: data deleted within [6–12 months], unless consent for longer retention is provided

Freelancers and partners may be required to sign confidentiality and data protection agreements.

11. Data Sharing

We may share personal data with:

• Hosting providers
• CRM and marketing platforms (HubSpot)
• Analytics providers (Google)
• Professional advisors
• Contracted team members involved in project execution

All service providers operate under Data Processing Agreements (DPA / AVV equivalent) ensuring:

• Confidentiality
• Technical safeguards
• GDPR-aligned protection standards.

We do not sell personal data.

12. International Transfers

As a UAE-based company using international technology providers, personal data may be transferred outside the EU.

Where applicable, we ensure compliance through:

• Standard Contractual Clauses (SCCs)
• Contractual safeguards
• Technical and organizational security measures.

13. Data Retention

Personal data is retained only as long as necessary for:

• Contract fulfillment
• Legal obligations
• Legitimate business interests.

Data is securely deleted when no longer required.

14. Data Subject Rights (EU Residents)

You may have the right to:

Access your personal data

• Rectify inaccurate data
• Request erasure
• Restrict processing
• Object to processing
• Withdraw consent
• Data portability
• Lodge a complaint with a supervisory authority.

To exercise your rights, reach out to: contact@xytium.com

15. Security Measures

We implement appropriate technical and organizational measures including:

• Secure hosting
• Encrypted data transmission (SSL)
• Access control systems
• Role-based access management
• Confidentiality agreements.

No online transmission can be guaranteed to be 100% secure.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal or operational changes.

The current version is always available on this page.