privacy policy

01. introduction

Welcome to xndr.io. This website is owned and operated by XNDR SLU ("we," "us," or "our"). We are committed to protecting your privacy. This Privacy Policy explains how we handle personal data in compliance with the Andorran Law 29/2021 of 28 October, on the Protection of Personal Data (LQPD).

02. data controller

The entity responsible for any personal data is:

03. personal data we collect

This website collects minimal personal data:

• - Contact form: When you use our contact form, your name, email address, and message are sent directly to us via email. This data is not stored on our servers or in any database.
• - We do not use cookies for analytics or tracking.
• - We do not have user accounts.
• - Newsletter: if you subscribe, we store your email address, whether it is confirmed, the dates you signed up, confirmed and (if you leave) unsubscribed, where you signed up, and which version of the consent text you agreed to. We also measure whether you open our emails and which links you click, using the tracking pixel and link tracking of our email provider (Resend); we keep only the time of your last open and your last click, and use it to see which emails work and to choose which emails go to which group of readers. Your email client may block the pixel, and you can unsubscribe at any time. Nothing else is stored: no IP address and no browsing profile. Links to xndr.io in our emails carry utm parameters so our cookie-free analytics can tell which email a visit came from. We send you at most three newsletter emails in any seven days.
• - Server logs that may contain IP addresses are used only for security and website maintenance and are deleted automatically.

04. how we use personal data & lawful basis

Information submitted through our contact form is used solely to respond to your inquiry. We do not use it for marketing purposes.

Newsletter subscribers are different: your email address is used to send articles, product news and offers from XNDR, on the basis of your consent, given through a double opt-in (you click a confirmation link we email you). You can withdraw consent at any time with the unsubscribe link in every email. Every email also links to a page where you can see, download or delete everything we store about you. Unsubscribing keeps your address on a suppression list so you are not mailed again; deleting your data removes it.

Our lawful basis for this processing under the LQPD is our legitimate interest in receiving and responding to messages you choose to send us, and, where you provide your details, your consent. Server logs are processed on the basis of our legitimate interest in the security and maintenance of this website.

05. data sharing, processors & international transfers

We do not sell your personal data or share it with third parties for their own purposes. However, to operate this website and receive your messages we rely on a small number of service providers acting as processors on our behalf:

• - Newsletter delivery: newsletter emails are sent through Resend (Resend, Inc.), which receives the recipient's email address and the message in order to deliver it. The subscriber list itself is stored in Cloudflare (D1).
• - Email delivery & routing: contact-form messages are delivered to us through our email provider (Cloudflare Email Routing) and mailbox provider. In doing so, your message is transmitted through their systems.
• - Hosting & infrastructure: this website and its server logs are hosted on our infrastructure provider.

Some of these providers may process data on servers located outside Andorra and the European Economic Area. Where that is the case, such transfers are covered by adequacy decisions and/or the providers' standard contractual clauses and equivalent safeguards.

06. data retention

We keep contact-form correspondence only for as long as needed to handle your inquiry and any follow-up, after which it is deleted. Server logs that may contain IP addresses are retained only briefly for security and maintenance and are then deleted automatically.

07. your rights

Under the LQPD (and, where it applies to you, the EU GDPR), you have the right to access, rectify, erase, restrict and object to the processing of your personal data, the right to data portability, and the right not to be subject to solely automated decisions. To exercise any of these, contact us at .

You also have the right to lodge a complaint with the Andorran Data Protection Authority (Agència Andorrana de Protecció de Dades, APDA) at www.apda.ad if you believe your data has been handled unlawfully.

08. changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be posted on this page.