Privacy Policy

Introduction

Xandiora AS ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website xandiora.world and use our investment finance education services.

Data Controller Information

The data controller for your personal information is Xandiora AS, a Norwegian company with registration number 576231469, located at Thereses gate 10, 4627 Kristiansand, Agder, Norway. For privacy-related enquiries, please contact us at privacy@xandiora.world or by telephone at +47 38852608.

Data Collection

The data we collect may include the following categories of personal information:

• Contact Information: Name, email address, phone number, postal address
• Educational Information: Learning preferences, educational background, investment experience level
• Technical Information: IP address, browser type, device information, website usage data
• Communication Records: Correspondence, support requests, feedback, and consultation notes
• Payment Information: Billing details and transaction records (processed securely through third-party payment providers)

How We Use Your Information

We use the data we collect for the following purposes, and how we use your information is always based on a lawful basis under GDPR:

• Service Provision: To deliver our investment finance education services and respond to your enquiries
• Personalisation: To customise educational content and recommendations based on your learning needs
• Communication: To send important updates, educational materials, and respond to your questions
• Website Improvement: To analyse website usage and improve our digital services
• Legal Compliance: To comply with applicable laws and regulations
• Marketing: With your consent, to send promotional materials about our educational programmes

Cookies and Tracking Technologies

We may use cookies and tracking technologies for analytics, advertising, and remarketing purposes, including Google Ads. These technologies help us measure campaign effectiveness, deliver relevant advertisements, and improve our services. You can manage your cookie preferences at any time through our cookie consent banner. For detailed information about our use of cookies, please refer to our Cookie Policy.

Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal bases:

• Contract Performance: To provide our educational services and fulfil our contractual obligations
• Legitimate Interests: To improve our services, conduct analytics, and ensure website security
• Consent: For marketing communications and certain cookies (where required)
• Legal Obligation: To comply with applicable laws and regulations

Data Sharing and Disclosure

We may share your personal information in the following circumstances:

• Service Providers: With trusted third-party providers who assist in delivering our services
• Legal Requirements: When required by law or to protect our legal rights
• Business Transfers: In connection with mergers, acquisitions, or asset sales
• Consent: When you have given explicit consent for specific sharing purposes

Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Typically, we retain contact and educational information for the duration of our business relationship plus seven years for legal and regulatory compliance. Website analytics data is generally retained for 26 months, whilst marketing data is retained until you withdraw consent.

Your Rights

Under GDPR and applicable data protection laws, you have the following rights regarding your personal information:

• Right of Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data under certain circumstances
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Data Portability: Request transfer of your data to another service provider
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent for processing where consent is the legal basis

International Data Transfers

Your personal information may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions by the European Commission, to protect your personal information in accordance with GDPR requirements.

Data Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include encryption, secure servers, access controls, and regular security assessments. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

Third-Party Services

Our website may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these external services. We encourage you to review the privacy policies of any third-party services you interact with through our website.

Children's Privacy

Our services are designed for adults and we do not knowingly collect personal information from individuals under the age of 16. If you believe we have inadvertently collected information from a minor, please contact us immediately so we can delete such information.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of our services after such changes constitutes acceptance of the updated Privacy Policy.

Contact Information

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us using the following information:

Supervisory Authority

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or your local data protection supervisory authority.