1. Legal Bases for Processing (Art. 6 GDPR)

Under EU law, we process your personal data only where a valid legal basis exists. We rely on:

• Contractual necessity: processing required to fulfil orders, provide accounts, or deliver services you requested.
• Legitimate interests: such as fraud prevention, platform security, analytics, and direct marketing (subject to your opt-out rights).
• Consent: for certain marketing communications, cookies, or optional data collections (you may withdraw anytime).
• Legal obligations: to comply with tax, anti-fraud, or regulatory requirements in Ireland and the EU.

2. Your GDPR Rights as an EU Data Subject

Under the GDPR (Arts. 15–22), you have the following enforceable rights:

Right of Access (Art. 15)

You may request confirmation of whether we process your data, and obtain a copy of your personal data along with details about processing purposes.

Right to Rectification (Art. 16)

You can request correction of inaccurate or incomplete personal data.

Right to Erasure (‘Right to be Forgotten’) (Art. 17)

You may request deletion of your personal data where it is no longer necessary, consent is withdrawn, or processing is unlawful.

Right to Restriction of Processing (Art. 18)

You can restrict how we use your data while we verify accuracy or legal grounds.

Data Portability (Art. 20)

You have the right to receive your data in a structured, machine-readable format and transmit it to another controller.

Right to Object (Art. 21)

You may object to processing based on legitimate interests, including direct marketing and profiling.

Automated Decision-Making (Art. 22)

We do not engage in solely automated decisions with legal or significant effects without human intervention.

3. Exercising Your GDPR Rights

To exercise any of the above rights, please:

• Use the privacy request form in your Xaysi account settings (Account → Privacy Requests).
• Contact our Data Protection Officer via email: dpo@xaysi.ie (for Ireland/EU inquiries).
• Write to our Irish registered address (see contact section).

We will respond within one month, as required by GDPR. You may also lodge a complaint with the Irish Data Protection Commission (DPC) if you are unsatisfied.

4. Ireland-Specific Provisions & DPC Oversight

For Irish residents, additional protections apply under the Irish Data Protection Act 2018:

• The Irish Data Protection Commission (DPC) is our lead supervisory authority for cross-border EU processing.
• You have the right to seek judicial remedy in Irish courts regarding data protection matters.
• We are not required to appoint an Irish-based representative if our processing is occasional and low-risk, but we maintain a voluntary DPO presence for transparency.

DPC contact: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Website: www.dataprotection.ie

5. International Data Transfers

As Xaysi operates globally, your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place, such as:

• EU Standard Contractual Clauses (SCCs) for transfers to third countries.
• Binding Corporate Rules (BCRs) where applicable.
• Adequacy decisions by the European Commission (e.g., UK, certain jurisdictions).

You may request a copy of the relevant transfer mechanisms by contacting our DPO.

6. Data Retention & Storage Limitation

We retain personal data only as long as necessary for the purposes outlined, or to comply with legal obligations (e.g., tax records: 7 years under Irish law). After retention periods expire, we securely delete or anonymise your data.

7. Cookies and Tracking Technologies (ePrivacy & GDPR)

Our website uses cookies and similar technologies. For EU/Ireland visitors, we require your prior consent for non-essential cookies (e.g., marketing, analytics). Essential cookies (e.g., session, security) are exempt. You can manage preferences via our cookie consent banner.

8. Children’s Data (Age of Digital Consent)

In Ireland, the age of digital consent for processing children’s data is 16 years old (Data Protection Act 2018). We do not knowingly collect personal data from children under 16 without parental consent. If you believe we have collected such data, please contact us.

9. Complaints to the Irish DPC

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the Irish Data Protection Commission or your local EU supervisory authority. We would appreciate the opportunity to resolve your concerns first, so please contact us initially.

10. Contact Information (GDPR / Ireland Representative)

Data Controller: Xaysi Marketplace Ltd.

Irish Correspondence Address: Xaysi EU Privacy Office, 3rd Floor, 2 Liffey Valley Office Campus, Dublin 22, D22 X5P6, Ireland.

Data Protection Officer (DPO): privacy@xaysi.ie (or dpo@xaysi.ie)

For general privacy inquiries related to Ireland/EU, please contact our support team via the Xaysi Help Centre.