Privacy Policy

This policy covers personal data collected through www.xio-sa.com. Licences for EXIOBASE and for the spend-based factor datasets are governed by their own agreements.

Who we are

XIO Sustainability Analytics AS, organisation number 931970429, is the controller for personal data collected through this website. Our registered address is Gaustadalléen 21, 0349 Oslo, Norway.

The data we collect

What you send us through the contact form: your name, your company name, your work email address, your message, and which of our products you indicated an interest in. We also record the date of the submission.

When you open a page, your browser sends your IP address to our hosting provider, as it would to any website. The provider uses it to deliver the page and to protect the site against abuse.

We run no analytics, advertising or tracking on this site. Fonts are served from our own domain, so opening a page sends no request to a third party. The content management system sets a session cookie for logged-in administrators only.

Purpose and legal basis

We use your details to answer your enquiry and, where relevant, to discuss a licence. The legal basis is your consent, given when you submit the form, together with our legitimate interest in responding to a business enquiry under Article 6(1)(a) and Article 6(1)(f) of the GDPR. We do not use your details for marketing unless you ask us to.

Handling your IP address to deliver the site and keep it secure rests on our legitimate interest under Article 6(1)(f) of the GDPR.

Retention

We keep enquiries for as long as we need them to answer you and to hold a record of a commercial relationship, and no longer than three years after our last contact with you, unless a contract requires otherwise.

Recipients

Submissions are stored in our own database, run by Neon on servers in Frankfurt, Germany. The website is hosted by Vercel: its servers in Frankfurt handle the contact form, and its worldwide network delivers the pages. Each submission is emailed to us through Resend, which sends from Ireland, and reaches us through Microsoft, whose services we use in Norway. All four act as processors on our behalf.

Vercel, Neon and Resend are US companies, so your details may be accessed from the United States. Each of them has agreed to the European Commission’s standard contractual clauses in its data processing agreement with us. We do not sell personal data, and we do not share it with anyone for their own purposes.

Your rights

You can ask for a copy of the data we hold about you, ask us to correct or delete it, or object to our processing. Write to xio@xio-sa.com and we will reply within one month. If our answer does not satisfy you, you can complain to the Norwegian Data Protection Authority, Datatilsynet.

Changes to this policy

We update this policy when our processing changes. If anything here is unclear, or you want to know exactly what we hold, ask us and we will tell you.