Privacy Policy
This Privacy Policy applies when using the website «xerux.gal», owned by XERUX SERVIZOS ONLINE S.L. (hereinafter, the Controller), and when using the contact methods published on the website (postal mail, email, telephone and WhatsApp).
The Controller processes data lawfully, fairly and transparently. It only processes data that is adequate, relevant and limited to what is necessary in relation to the specific, explicit and legitimate purposes for which it is obtained, and does not process it for purposes incompatible with those.
This Policy is permanently accessible through the link provided on the website, named “Privacy Policy”, and may be updated at any time, either as a result of a regulatory change or because the website configuration is modified.
Who is the Data Controller?
Company name: XERUX SERVIZOS ONLINE S.L.
NIF: B25977968
Phone: +34 698122991
Email: contacto@xerux.gal
For what purpose and on what legal basis is the data processed?
To browse the website «xerux.gal» it is not necessary to provide any data. The mandatory nature of answering the questions posed, or of the data requested through the website, is indicated by adding an asterisk (*) after the question or form field. If the required data is not provided, it will not be possible to deliver the requested service or feature.
The Controller processes the recorded information for the following purposes:
- Contact: the data sent through any of the contact means and/or channels provided on the website is used to manage the requests received. The legal bases for processing are the data subject’s consent and the legitimate interest of the Controller in attending to and managing the requests received.
- Exercise of rights: the data provided is used to attend to and respond to data subjects who exercise their rights under data protection regulations. The legal basis for processing is compliance with a legal obligation.
- Data protection notifications: the data provided is used to manage incidents and notifications related to security in accordance with data protection regulations. The legal basis for processing is compliance with a legal obligation.
The Controller will only process personal data in accordance with the purposes described in this Policy. The data provided and collected will be processed solely and exclusively for the time necessary and for the purposes for which it was collected at each moment, as well as to determine any liabilities that may arise from the purposes of the processing. The Controller has established different retention periods depending on the type of data and the purpose applicable to its processing. Data processed on the basis of the data subject’s consent will be kept until they revoke their consent, unless it must be kept blocked for the formulation, exercise or defense of claims or in compliance with a legal obligation.
People who use the contact methods identified on the website are solely responsible for the information they provide to the Controller, and must refrain from providing personal data of other people, unless they have the relevant authorization, whereby such people have been previously and duly informed about the content of this Privacy Policy and, specifically, that they consent to their data being provided to the Controller to be processed for the relevant purposes.
Use of the website and the contact methods provided on it is not authorized for children under fourteen.
To which recipients will the data be disclosed?
The Controller does not disclose personal data to third parties, unless a legal provision states otherwise or the data subject gives express consent. The Controller may disclose personal data to the competent authorities: tax and customs, judicial, State security forces and bodies, and any other recipient that applies under current regulations.
The data sent through the website «xerux.gal» is stored on the premises of the Controller’s service provider, located within the territory of the European Union, Supabase Inc, hosted in Amazon Web Services (AWS) data centers in Ireland. If WhatsApp is used as a contact method, that data is stored on the servers of WhatsApp, LLC., an entity located in the USA and subject to the EU-US Data Privacy Framework, in accordance with Commission Implementing Decision (EU) 2023/1795 of 10 July 2023.
What are your rights regarding your data?
Anyone has the right to obtain confirmation as to whether or not the Controller is processing personal data concerning them, to access their personal data, and to request the rectification of inaccurate data or the completion of incomplete data.
You also have the right to request the erasure of your data when, among other reasons, the data is no longer necessary for the purposes for which it was collected. The Controller will erase it without undue delay unless it must be kept to comply with a legal obligation, or for the formulation, exercise or defense of claims.
In certain circumstances, data subjects may request the restriction of the processing of their data, in which case it will be blocked and may only be processed for the formulation, exercise or defense of claims.
Likewise, data subjects have the right, in certain circumstances, to receive the personal data they have provided to the Controller in a structured, commonly used and machine-readable format.
In certain circumstances and for reasons relating to their particular situation, the data subject may object to the processing of their data and the Controller will stop processing it, except for compelling legitimate grounds, or for the formulation, exercise or defense of claims.
All these rights may be exercised at any time by requesting it from XERUX SERVIZOS ONLINE S.L by sending an email to contacto@xerux.gal.
Where the data subject’s consent has been requested to process the data, it may be revoked at any time by notifying us in the terms described in the previous paragraph. This revocation will in no case have retroactive effect.
If the data subject considers that they have not obtained satisfaction in the exercise of their rights, they may file a complaint with the Spanish Data Protection Agency, the supervisory authority competent in data protection matters, whose contact details are: calle Jorge Juan, 6 - 28001 Madrid.
Last updated
February 1st, 2026
