Website privacy
Your data, explained.
What we process when you visit this website or write to XPT, and how to exercise your rights.
No advertising, analytics, tracking cookies, or visitor accounts. The only browser preference is the language you choose, kept for the current tab session.
Who is responsible
The data controller is XPT OÜ, Estonian Commercial Register number 14465145, VAT number EE102073304. Registered address: Katusepapi tn 4/2, 11412 Tallinn, Estonia. For privacy questions or rights requests, email software@xpt.is.
Visiting the website
To deliver a page, our server receives your IP address, request time, requested address and technical request information. Routine website access logging is disabled. If an error occurs, the error log may contain your IP address, the request and diagnostic details.
We process these details to deliver and protect the website and resolve faults. The legal basis is our legitimate interest in operating a reliable and secure website (GDPR Article 6(1)(f)). We do not use them to analyse individual browsing behaviour or build advertising profiles.
Language settings and browser storage
On a language-neutral address, we use the language preferences supplied by your browser to choose English, Russian or Estonian. This happens on your device. Automatic selection creates no stored preference.
If you choose a language manually, sessionStorage stores only its code under xpt.language for this tab session. It is not sent to our server or linked to an identifier. Use “Use browser language” in the language menu to clear it. Closing the tab normally ends the session; browser session-restore features may restore it. The old persistent language preference is removed when the updated script runs.
This storage serves the language choice you expressly request. It is not used for advertising or analytics. The site uses no cookies or third-party embeds. All images and scripts are served from xpt.is, and fonts come from your device.
Email enquiries and support
When you email us, we receive your email address, any name you provide, your message, attachments and delivery information. Sending a message is voluntary. Please include only what is needed for your enquiry and avoid sending passwords, payment-card details or sensitive personal data. Without a way to contact you, we may be unable to respond.
We use correspondence to answer questions and provide support. General enquiries are processed on the basis of our legitimate interest in responding (Article 6(1)(f)). Requests concerning a contract with you or steps you ask us to take before one are processed under Article 6(1)(b). Where a specific legal duty requires records or a response, Article 6(1)(c) applies.
Our mail system also performs automated spam and security checks. These can use sender IP addresses, domains and information derived from messages. External reputation lookups are configured in our mail filter; depending on the check, DNS or email-security services may receive an IP address, domain, URL-related information or a hash. The purpose is to protect the mailbox from abuse, based on Article 6(1)(f).
Where data is handled and who receives it
The website and our mailbox are hosted on a server in Lithuania, in the European Union. XPT staff handle enquiries and administer the systems. We do not use a separate marketing or customer-support platform, and we do not sell personal data.
Email delivery involves the mail and network providers used by you and the recipients. DNS and mail-security lookups involve the relevant service operators. Their processing is separate from simply visiting this website. We may disclose information to authorities when a specific legal obligation requires it.
This website contains no Apple SDKs or embedded Apple services and does not send visitor data to Apple. Future applications and App Store purchases will have their own privacy information. Server location alone does not determine where every email recipient, service operator or staff member accesses information. You can ask us about the recipients and safeguards relevant to your enquiry.
How long information is kept
The language preference lasts for the current tab session. Routine website error logs are rotated daily, retaining the current file and 13 daily archives, normally up to 14 days. If an entry is needed to investigate a specific security incident or establish a legal claim, only the relevant information may be retained separately for that purpose.
For ordinary enquiries, the retention period is determined by completion of the conversation and any agreed follow-up. Correspondence needed for a contract, a specific legal record-keeping duty or a legal claim is kept for the period applicable to that purpose. Mail delivery and security logs use separate rotation and size limits; these are not a substitute for reviewing whether the records are still needed.
Your rights and how to use them
You can request access, rectification, erasure or restriction of processing. You can object to processing based on legitimate interests, including by explaining your particular situation. Data portability applies where processing is automated and based on consent or a contract. Rights are subject to the conditions and exceptions in the GDPR.
Send a request to software@xpt.is. No account is required. We respond without undue delay and normally within one month. If the request is complex or there are several requests, the period may be extended by up to two further months; we will explain this within the first month. Requests are normally free. Any fee or refusal must meet the narrow conditions for manifestly unfounded or excessive requests.
If we reasonably doubt who is making a request, we may ask for proportionate information to verify identity. Please do not send an identity document unless we specifically explain why it is necessary. We do not carry out profiling or solely automated decisions with legal or similarly significant effects on visitors or correspondents.
You may complain to the Estonian Data Protection Inspectorate or the supervisory authority where you live, work or believe an infringement occurred. You also have the right to seek a judicial remedy. You do not have to contact us before making a complaint.
Estonian Data Protection Inspectorate · info@aki.ee
Applications and changes to this notice
This notice covers the website and direct enquiries. Before releasing an application or changing how we process data, we will provide the information relevant to that activity. The date above identifies the current version of this notice.