Our X-BRAiN Statement

We value the confidence granted by entrusting your personal data to our Company and take your privacy very seriously.

1. Introduction

In accordance with Articles 12, 13 and 14 of the EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter the “GDPR”), this Privacy Notice explains how X-CITE S.A. (“X-CITE”) collects, processes and protects Personal Data received within its business activity.

This Notice shall cover the Processings made by X-CITE as of the date of first Processing.

The Notice is intended to all Data Subjects listed in Section 6.

2. Terminology

In this document:

“Controller” or “Data Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

“Customer”: means the customer who concluded a service agreement with X-CITE, in order to receive services offered by the Company within its business activity.

“Data Subject” or “you” means an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Data Protection Laws” or “Law”: means any law or regulation related to data protection and privacy applicable within your relationship with X-CITE. This includes in particular the Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (hereafter referred to as “GDPR”).

“X-CITE”,“we”, “us”, or “our” “Company”: means X-CITE S.A., incorporated as a public limited company under the laws of Luxembourg, whose registered office is located at 9 Rue du Laboratoire, L-1911 Luxembourg, registered in the Luxembourg Trade and Companies Register under number B 174828.

“Personal Data” means any information relating to a Data Subject.

“Privacy Notice”: means this privacy notice.

“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Processor” or “Data Processor” means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller.

“Sensitive Personal Data” means Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the Processing of genetic data, biometric data for the purpose of uniquely identifying the Data Subject, data concerning health or data concerning a Data Subject’s sex life or sexual orientation or data relating to criminal convictions and offences.

“Website”: means the website accessible from the URL address www.x-brain.io, which owner is X-CITE. Through the Website, any user can read the description of the products and services offered by the Company as well as a presentation of the managing team, contact X-CITE, request information, submit an application for a job, read and share with third parties, articles issued by the X-CITE‘s experts, etc. The Website is a showcase website, which does not contain a specific section for e-shop nor for online customer center. The use of the Website is subject to separate terms and conditions (the “Terms of Use”).

3. Our general commitments

Privacy is of most importance for X-CITE.

X-CITE is a Company for AI and IoT solutions. In our activity, we use standards and best practices to protect the end-users personal data of our customers.

We take into consideration not only data protection but also to ethic in general. Our products and services are built on the basis of “privacy & ethic by design” principles.

4. Purpose and Scope of this Notice

The purpose of this Notice is to give you some information about the manner we are processing your Personal Data, while acting as a Data Controller.

This does not cover the Processings performed by X-CITE as Processor. For this kind of processing, privacy aspects are governed by a separate agreement with the Data Controller, as foreseen by Article 28 of the GDPR.

Should you have any question with regard to the scope of this Notice, you may contact us, at any time, at the following address: getintouch@X-CITE.io

5. Who is the Data Controller?

X-CITE is a consulting company operating in Luxembourg and abroad, at international scale.

X-CITE, within the publication and management of the Website, acting as consultant for its customers or potential Customers, shall be deemed as the Data Controller of the Personal Data entrusted by the Data Subjects, as further defined in section 6 below.

6. Who are the Data Subjects?

Any natural personal providing us their Personal Data within our business activity, while acting as a Data Controller, shall be considered as a Data Subject.

You may find below a summary of the different types of Data Subjects, depending on the Processing made.

Processing Data Subjects
Processing performed on the Data transmitted by a person interested by our products or services Any potential customer (natural person), any customer (e.g: willing to contact X-CITE about the use of a service or for ordering additional services), any potential speaker, any potential business partner, any potential attendee to a conference or training organized by X-CITE.
Processing made on the Personal Data entrusted by our Customers Our Customers themselves (if the customers are natural persons), the directors, employees, agents, or consultants of our Customers, the directors, employees, agents or consultants of the suppliers or service providers of our Customers.
Processing made on the Personal Data of our Suppliers or sub-contractors The directors, employees, agents or consultants of our service providers or subcontractors.
Processing made on Personal Data transmitted by a Speaker The speaker himself, the directors, employees, agents, or consultants employing or assisting the speaker.
Processing done on Personal Data coming from our Business Partners The Business Partner himself (if this is a natural person), the directors, employees, agents, or consultants of the Business Partner
Processing made on the Personal Data entrusted by attendees of a conference or a training The attendees themselves, the directors, employees, agents, or consultants employing or assisting the attendees
Processing performed on the Data transmitted by a candidate The candidate himself (submitting a spontaneous application or answering to a job application). Where applicable, the references mentioned by the candidates, with their prior consent.

7. Which Personal Data do we collect and process?

We do not process Sensitive Data.

We collect the following categories of Personal Data:

Categories of Personal Data Examples
Contact details your first name, last name, age, date of birth, gender, e-mail address, residence address, phone number, country of residence, ID card or passport numbers.
Education, career and skills employment and education details (e.g.: job title, employment history, etc.) linked to a candidate within hiring recruitment process.

The collection and process of the Personal Data may be necessary to perform our contractual or legal obligations. As a consequence, if you object to the Processing of such kind of Personal Data, in accordance with this Privacy Notice, or refuse to provide them, we may not be able to deliver the services which might lead to the non-conclusion or termination of the agreement.

8. Who are the Recipients of your Personal Data?

We avoid sharing your Personal Data with the persons who are not concerned directly by the Processing.

Your Personal Data may be shared with:

  • X-CITE’s employees,
  • Competent authorities (this includes: Administration and Courts) to the extent legally permitted or required,
  • Our advisers subject to professional secrecy rules,
  • Third parties Service Providers (for example: our Information technology service provider hosting our website and ensuring the back-up of our Personal Data, fiduciary, banks, etc.).

9. Why do we process your Personal Data?

We process your Personal Data in order to:

  • Answer to any question regarding our products and services,
  • Perform our missions as described per our service arrangement,
  • Invoicing our services or make payments or any other financial transaction,
  • Investigate and prevent fraudulent activities, as the case may be, in accordance with the law,
  • Process your application, within a hiring process,
  • Handle complaints, pre-litigation and litigation issues.

We will never collect Personal Data which are not strictly necessary for the execution of our assignment.

We do not perform any profiling or other kind of automated Processing on your Personal Data.

10. On which legal basis do we process your Personal Data?

The Processing of your Personal Data relies on the following legal basis:

Data Subjects Legal Basis Categories of Personal Data Example(s) of Processing/ documents
Prospect Customers and Customers necessity to perform the service agreement concluded with X-CITE or in order to take steps at your request prior to entering into this agreement necessity to comply with a legal obligation legitimate interest: for promoting our activity and growing our business Contact details
Financial and banking Data
in case of request sent by you concerning our products and services any correspondence sent to you, to answer you or perform the service agreement, any payment received from you invoices
Suppliers necessity to perform the agreement concluded with X-CITE or in order to take steps at your request prior to entering into this agreement necessity to comply with a legal obligation Contact details
Financial and banking Data
any correspondence sent to you, any payment made to you
Speakers necessity to perform the agreement concluded with X-CITE or in order to take steps at your request prior to entering into this agreement necessity to comply with a legal obligation: for security reasons Contact details
Financial and banking Data
emails correspondence sent to you payments made to you, to compensate your speeches
Business Partners necessity to perform the partnership agreement concluded with X-CITE or in order to take steps at your request prior to entering into this agreement necessity to comply with a legal obligation legitimate interest: for promoting our activity and growing our business Contact details
Financial and banking Data
emails sent to you within business negotiations, mention of your name in an article published on our Website
Attendees of a conference or a training necessity to perform the agreement related to the event, concluded with X-CITE or in order to take steps at your request prior to entering into this agreement necessity to comply with a legal obligation legitimate interest: to receive a feedback from you about the event Contact details
Financial and banking Data (if the event is not free of charge)
emails, receipt of payments
Candidates/ References necessity to take steps at your request prior to entering into an employment agreement our legitimate interest: in order to assess the ability of the candidate to fulfil the requirements related to the position to which you apply Contact details
Employment history, skills, experiences, etc.
various correspondences exchanged during hiring process, CV, Referee reports, etc.

11. How are we collecting your Personal Data?

  • Information you give us:
    In some cases, we receive Personal Data directly from you. For instance, if you contact us to obtain information regarding our business activity.
  • Information we collect from other sources:
    We collect Information via third Parties. It concerns essentially the Personal Data about you given by your employer.

12. How are we processing your Personal Data?

We use appropriate technical and organizational measures to secure the Processing of your Personal Data, in accordance with Data Protection Laws requirements.

For example:

  • We use technological security measures like firewall, anti-virus softwares.
  • We or our employees and subcontractors have taken out contractual commitments in order to protect and restrict the access to the Personal Data
  • We deployed physical security measures (i.e.: security passes for our staff members to access to our premises)
  • We organized Staff trainings regarding your privacy and data protection concerns.

In general, we ensure that we keep your Personal Data secure and that they are accurate and up-to-date.

13. Are we transferring your Personal Data outside of European Union?

In principle, your Personal Data are being processed and stored in Luxembourg.

On exceptional basis, our subcontractors, service providers or suppliers may transfer the Personal Data outside of European-Union.

The transfer is authorized under Data Protection Laws, because, the Personal Data are processed:

  • in a country considered by the European Commission to offer an adequate level of protection, equivalent to those guaranteed in European Union,
  • in accordance with contractual measures, ensuring, according to the Law, the same level of protection as if the third party were located in the European Union.

14. How long do we process your Personal Data?

Data entrusted by Duration
Our Customers End of the Customer relationship for whatever reason, in accordance with the contractual terms set forth in the service agreement signed between you and our Company; End of retention period as required by law or by any competent authority regulating X-CITE business activity. In the overall, we keep a copy of your Personal Data for ten (10) years after the end of the commercial relationship for accounting and tax purposes, calculated in accordance with the applicable legal provisions; End of the period during which a litigation or an investigation might arise in connection with the Data processed or as the case may be, until the end of the litigation or investigation.
Prospect customers, potential Business Partners and any other Data Subject who did not sign a service agreement with X-CITE End of a three (3) years period after the sending of a business proposal (except where the person becomes a Client before the expiry of the said period)
Suppliers End of the commercial relationship for whatever reason, in accordance with the contractual terms set forth in the agreement signed with X-CITE; End of retention period as required by law or by any competent authority regulating X-CITE business activity. In the overall, we keep a copy of the Personal Data for ten (10) years after the end of the commercial relationship for accounting and tax purposes, calculated in accordance with the applicable legal provisions; End of the period during which a litigation or an investigation might arise in connection with the Data processed or as the case may be, until the end of the litigation or investigation.
Business Partners End of the commercial relationship for whatever reason, in accordance with the contractual terms set forth in the agreement signed with X-CITE; End of retention period as required by law or by any competent authority regulating X-CITE business activity. In the overall, we keep a copy of the Personal Data for ten (10) years after the end of the commercial relationship for accounting and tax purposes, calculated in accordance with the applicable legal provisions; End of the period during which a litigation or an investigation might arise in connection with the Data processed or as the case may be, until the end of the litigation or investigation.
Candidates Six (6) months after the end date of the hiring process (except where the candidate has been hired by X-CITE before the expiry of this period)

15. What are your rights with regards to the processing of your personal data?

Based on Data Protection Laws, you benefit from certain rights, that you can exercise, at any time, according to the procedure described in Section 16 below.

Rights Description
Right of information You have a right to be informed about how we will use and share your Personal Data. This explanation will be provided to you in a concise, transparent, intelligible and easily accessible format and will be written in clear and plain language. This Notice shall provide you with the information regarding our general Processings as defined in Section 4 (“Purpose and Scope of this Notice”). You may receive further and specific information, each time we are collecting your Personal Data.
Right of access You have the right to know whether your Personal Data are being processed or not and the way they are being used. This right to access to your Personal Data, includes also the right to obtain a copy of the Personal Data in our possession.
Right of rectification of your Personal Data This right includes the right to ask their updates or completion. If we have disclosed the relevant Personal Data to any third parties, we will take all reasonable steps to inform those third parties of the rectification, where materially feasible.
Right of erasure This right includes a right to be forgotten in accordance with the provisions of the applicable Law. We will make our best efforts to inform any recipient of your Personal Data about the exercise of this right, so that they could proceed to the erasure of your Personal Data. In some cases, we would not be able to satisfy your request, especially in case of legal constraints preventing us for doing so. In this situation, we will explain you the reasons of our position and propose you alternatives to protect your Personal Data as much as possible (e.g: restriction of Processing).
Right to restrict the scope of Processing In certain circumstances, you may wish to require restriction of Processing. For instance, in case of objection to Processing, we may need time to check the possibility to continue the delivery of our services despite of this objection. During this period, you could obtain a restriction of the scope of Processing. Another hypothesis could be, if you consider that a specific Processing is unlawful or in case of termination of the service agreement, but you still need a storage of your Personal Data, that are necessary within a legal action or any claim proceeding. We will inform each recipient to whom the Personal Data have been disclosed about this decision to restrict the processing, unless this is impossible or involves disproportionate effort.
Right to Data portability This right involves the right to receive the Personal Data provided by you to our Company in a structured, commonly used and machine-readable format and the right to obtain the transmission of these Data from X-CITE to another service provider, where technically feasible.
Right to withdraw consent You may withdraw your consent at any time. This withdrawal will not affect the lawfulness of the Processing based on your consent before this withdrawal.
Right to lodge a complaint In case of dissatisfaction with regard to the way we handled your request, you can complain to the competent supervisory authority. You may find further information under Section 16 below.

In case of use of your rights of erasure, restriction of processing or objection to processing, we can provide you, upon request in writing (as described in the paragraph below), the list of recipients who received your Personal Data.

In practice, how can you exercise your rights?

  • By sending a request using this address e-mail: getintouch@X-CITE.io
  • Or by sending a request per post to:
    X-CITE S.A.
    Data Protection Issue
    9 Rue du Laboratoire
    L-1911 Luxembourg

In order to ensure a smooth processing of your request, you shall provide us with the following information:

Your name, surname, organization, position, country of residence, e-mail, (if the request is sent per post, your postal address) customer reference, purpose of your request, rights you want to exercise and a copy of an identification document in order for us to verify that you are the Data Subject.

The document should contain an identification number, country of issue, period of validity, your name, and a picture.

Any request shall be processed by X-CITE without undue delay, and where feasible no later than one (1) month after its receipt, at least in order to inform you about the status of your request. This period may be extended for two (2) additional months for complex cases or due to a high volume of requests.

16. How can you lodge a complaint?

If you consider that the Processing of Personal Data relating to you infringes Data Protection Laws, you will have the right – without prejudice to any other judicial remedy – to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

In Luxembourg, the competent authority is the CNPD.
You may contact the CNPD:

  • By post:
    1 avenue du Rock’n’Roll
    Service des réclamations
    L-4361 Esch-sur-Alzette
    • By phone: Tél.: (+352) 26 10 60 -1
    • By fax: (+352) 26 10 60 – 29
    • By using the contact form : https://cnpd.public.io/fr/support/contact.html

    17. Amendments to this Notice

    X-CITE reserves its right to modify this Notice at any time. The new version shall be deemed to enter into force from the publication date mentioned in the header of this document and shall be applicable to any new agreement concluded as of this date, as well as to any agreement signed before this date.

    In case of disagreement with the terms of the new Notice, you may terminate the agreement concluded previously, in accordance with its terms.

    18. Applicable Law- Dispute

    The present Notice shall be governed and construed in accordance with Luxembourg law.

    Any dispute concerning the existence, interpretation or performance of this Notice which cannot be settle amicably, shall fall within the jurisdiction of the Courts of Luxembourg City, without prejudice to the rights of the Data Subjects to bring the matters before the court where he or she has her place of residence, where legally required, as well as its right to lodge a complaint with the supervisory authority.