Last updated: August 2026
1. Controller
The controller for data processing on this website is:
XmaraI
Registered seat: Cyprus
Email: team@xmarai.com
Website: https://xmarai.com
Further company details are in our Imprint.
2. What data we process
We process personal data only as needed to operate the website and respond to your enquiries:
- technical access data when you visit the site (server logs),
- information you submit via our contact / booking form.
We do not currently use third-party analytics, tracking or advertising cookies (no Google Analytics, Meta Pixel, etc.).
3. Hosting and server logs
When you visit this website, the server may store log data such as IP address, date and time, requested URL, referrer, browser/OS and status codes. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a secure, stable website). Logs are kept only as long as needed for security and operations, then deleted or anonymised.
4. Contact / booking form
If you request a call via the form, we collect the data you enter — typically name, email and any project details you provide. Purpose: handling your enquiry, scheduling and preparing a possible engagement. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) and/or Art. 6(1)(f) GDPR. We do not share this data with third parties for advertising. Without an engagement we usually delete enquiry data within 12 months, unless longer retention is required for legitimate reasons.
5. Email contact
If you email us (e.g. team@xmarai.com), we store the data needed to handle your message. Legal basis: Art. 6(1)(b) or (f) GDPR.
6. Cookies
We may use strictly necessary storage such as the Polylang language cookie (pll_language). Legal basis: Art. 6(1)(f) GDPR / equivalent ePrivacy rules for essential storage.
7. Your rights
You have rights of access, rectification, erasure, restriction, portability and objection under the GDPR. Contact team@xmarai.com. You may also lodge a complaint with a supervisory authority (for Cyprus: the Commissioner for Personal Data Protection; if you are in the EU/EEA, your local authority).
8. No automated decision-making
We do not use automated decision-making including profiling under Art. 22 GDPR.
9. Updates
We may update this policy when our services or the law change. The current version is always on this page.