Privacy Policy
This is a plain-English draft written to be readable, not a finished legal instrument. It has not been reviewed by counsel. Before you publish or rely on it, have a qualified lawyer confirm it fits your jurisdiction, your data flows, and your actual practices. Nothing here is legal advice.
Overview
XProgrammers (“we”, “us”, “our”) builds and rescues software for our clients. This policy explains what personal data we collect when you visit our site, contact us, or engage us for a project — and what we do with it.
We keep data collection deliberately small. We are a services business, not an advertising business: we do not sell personal data, and we do not run third-party ad tracking on our site.
Information we collect
We collect only what we need to reply to you and run an engagement:
- Information you give us. Your name, email, company, budget range, and the message you send through our contact form or by email.
- Engagement data. If we work together, the documents, credentials, and project materials you share with us under a signed agreement.
- Technical data. Basic, aggregated analytics such as pages viewed and approximate region — collected without third-party advertising cookies.
- Communications. Emails, call notes, and messages exchanged while we scope or deliver work.
How we use information
We use the information above to:
- Respond to your enquiry and scope a possible engagement.
- Deliver, support, and improve the services you've engaged us for.
- Send operational messages about a project (not marketing newsletters).
- Meet legal, accounting, and security obligations.
- Protect our systems and prevent abuse.
Legal bases
Where the GDPR applies, we rely on the following legal bases for processing:
- Contract — to take steps at your request before, and to perform, an engagement.
- Legitimate interests — to reply to enquiries, secure our site, and run our business, balanced against your rights.
- Legal obligation — to keep records we're required to keep.
- Consent — where we ask for it explicitly, which you can withdraw at any time.
Sharing & disclosure
We share personal data only when necessary, and never sell it. Recipients may include:
- Service providers (subprocessors) who help us operate — for example email, hosting, and analytics — bound by contract to protect your data. See our subprocessor approach.
- Professional advisers such as auditors and lawyers, where needed.
- Authorities, where the law requires it or to protect rights and safety.
- A successor in the event of a merger or acquisition, under equivalent protections.
Data retention
We keep personal data only as long as we need it. Enquiries that don't become engagements are deleted within 24 months. Engagement records are kept for the life of the contract and a reasonable period afterward to meet legal and accounting requirements, then deleted or anonymised.
Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct data that is wrong or incomplete.
- Delete your data (“right to be forgotten”).
- Restrict or object to certain processing.
- Receive your data in a portable format.
- Withdraw consent, and complain to a supervisory authority.
To exercise any of these, email legal@xprogrammers.com. We respond within one month.
Cookies & analytics
We use a small number of first-party cookies that are necessary for the site to function, plus privacy-respecting, aggregated analytics. We do not use third-party advertising or cross-site tracking cookies. You can block cookies in your browser without breaking the core site.
International transfers
We are a remote team with hubs in the EU. Where personal data is transferred outside your region, we rely on appropriate safeguards — such as the EU Standard Contractual Clauses — so your data keeps an equivalent level of protection.
Security
We protect personal data with encryption in transit and at rest, least-privilege access, and an actively maintained security program. For the full detail of our controls, see the Security page.
Children
Our services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we'll delete it.
Changes to this policy
We may update this policy as our practices or the law change. When we do, we'll revise the “Last updated” date above and, for material changes, give prominent notice. Continued use of our site after a change means you accept the revised policy.