Privacy policy

1. Scope and data controller

This notice covers the website and expressions of interest in XPADIA’s planned London gathering. The date and venue have not yet been set. An application is not an invitation, reservation or attendance confirmation. The form does not collect marketing or image consent or acceptance of the Warsaw event terms. Documents and consents relating to the Warsaw event on 6 October 2026 retain their original scope.

The controller is XPADIA LTD, incorporated under Cyprus law on 6 March 2023, registration HE 444439. Registered office: Mykinon 12, Floor 6, 1065 Nicosia (Lefkosia), Cyprus. Correspondence address: Labs Tower, 4 Fotie Pitta, 1065 Nicosia, Cyprus. EU VAT: CY60014811J. Contact: info@xpadia.com.

AVATARLAND sp. z o.o., ul. Trybunalska 46, 60-325 Poznań, Poland, KRS 0000099765, NIP 7792167451, operates the website and handles applications on XPADIA’s behalf and instructions. Assistance: info@MocneStronyCypru.pl.

2. Data, purposes and lawful bases

The form collects first and last name, company, position, email, telephone with country calling code, reasons for interest and whether the application is made personally or by an authorised representative; in the latter case, it also collects the representative’s name. We record the language, time, reference, event identifier and privacy-notice version. Do not include health data, identity document details or other particularly sensitive information.

We use these details to handle and answer the application, share confirmed details of this gathering and individually assess possible attendance. The basis is Article 6(1)(f) GDPR: XPADIA’s legitimate interest in organising a business gathering and handling voluntary applications. Providing data is voluntary, but required fields are necessary to process the form. Invitation decisions are not made solely by automated means.

Technical data, including IP address, request and browser information and session data, are processed as necessary to operate and secure the website, prevent abuse and establish or defend claims, under Article 6(1)(f) GDPR. Where a specific legal duty requires particular records, Article 6(1)(c) GDPR applies.

An expression of interest is not consent to general marketing or to sharing details with developers and partners for their marketing. It is not an entry on a confirmed participant list.

If a representative supplies data, that person is the source. We ask them to provide this notice to the person concerned. The controller also fulfils its own transparency obligations within the time limits in Article 14 GDPR.

3. Recipients, storage and retention

Access is limited to XPADIA, AVATARLAND, authorised application staff and necessary hosting and email providers, including dhosting. Legal advisers or competent authorities may receive data where necessary and lawfully justified. Processors act on documented instructions.

Each accepted application is first saved as a separate JSON file in a private server directory outside public_html and then emailed to the team with a JSON attachment. Mail failure does not remove the saved application. The archive is not public or automatically shared with partners. We also record the mail-transport status.

Data are retained as needed to process the application and provide organisational contact about the gathering. Once handling is complete, the application is withdrawn or the planned event is cancelled, data no longer needed are deleted. Only information necessary for legal obligations or establishing, pursuing and defending claims may be retained longer, within applicable time limits. Backups and logs have restricted access and follow provider retention cycles; details are available from the controller.

4. Sessions and website statistics

The necessary CYPRUSEVENT session cookie secures the form and allows errors and confirmations to be displayed. On HTTPS it uses Secure, HttpOnly and SameSite=Lax. Blocking the session may prevent submission. We do not use advertising cookies or advertising profiling. Images and fonts are local.

Cloudflare Web Analytics runs by default on domains with measurement enabled. According to the provider’s documentation, measurement uses neither cookies nor browser storage. It records page, referral, device and performance statistics. We do not send form contents, names, emails or telephone numbers or link statistics to applications. Where personal data are involved, the basis is Article 6(1)(f) GDPR: the legitimate interest in analysing and improving the website. The script can be blocked without disabling the form.

The provider is Cloudflare, Inc., USA. Technical data may be processed outside the EEA; appropriate transfer safeguards are required, such as an adequacy decision or standard contractual clauses. Information about the applicable mechanism and copies of safeguards are available from the controller. See the analytics documentation and Cloudflare privacy policy. Transfer from Poland or Germany to XPADIA in Cyprus is not itself a transfer outside the EEA.

5. Your rights and contact

Where provided by the GDPR, you have rights of access and a copy, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your particular situation and withdraw your interest in the gathering. Contact info@xpadia.com or info@MocneStronyCypru.pl.

You may complain to a competent supervisory authority, particularly in your country of habitual residence, work or the alleged infringement, such as a German data protection authority, the Polish UODO or the Cyprus authority. Requests are handled without undue delay, normally within one month, subject to legally permitted extensions. We do not routinely require a copy of an identity document.