• DEDeutsch
  • ENEnglish
  • FRFrançais
Request a free audit
LEGAL

Privacy Policy

Applies to www.xegit.com. Version: October 2026.

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

XEGIT GmbH
Rüsselsheimer Straße 22
60326 Frankfurt am Main, Germany
Represented by its Managing Director, Fabrice Fanguing Youbi
Phone: +49 69 97358738
Email: datenschutz@xegit.de

2. Data Protection Officer

Our Data Protection Officer can be reached at: datenschutz@xegit.de.

3. General Information and Legal Bases

Personal data is any information relating to an identified or identifiable natural person. We process personal data only to the extent necessary to provide a functional website and our content and services. The legal bases are in particular:

  • Art. 6(1)(a) GDPR – consent
  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures
  • Art. 6(1)(c) GDPR – legal obligation
  • Art. 6(1)(f) GDPR – legitimate interests

Where information is stored on or read from your device, this is based on § 25(1) TDDDG (consent) or § 25(2) TDDDG (strict necessity) of the German Telecommunications Digital Services Data Protection Act.

4. Hosting and Server Log Files

This website is hosted by o2switch, Chem. des Pardiaux, 63000 Clermont-Ferrand. When you visit the website, the server automatically collects information transmitted by your browser (server log files):

  • IP address
  • date and time of the request
  • page or file requested, amount of data transferred, HTTP status code
  • referrer URL
  • browser type and version, operating system

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the error-free display, stability and security of our website. Log files are deleted after 7 days unless they are needed longer to investigate a security incident. We have concluded a data processing agreement with our hosting provider pursuant to Art. 28 GDPR.

5. SSL/TLS Encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the padlock symbol in your browser’s address bar.

6. Contacting Us

If you contact us by email, phone or via our contact form, we process the information you provide (e.g. name, company, contact details and content of your enquiry) in order to handle your request.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). The data is deleted once your enquiry has been fully dealt with, unless statutory retention obligations apply (in particular § 257 HGB and § 147 AO: up to ten years).

7. Cookies

This website uses only technically necessary cookies that are strictly required for its operation (§ 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).

Non-essential cookies are only set with your consent via our consent banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the website footer.

You can also configure your browser to notify you when cookies are set, to allow cookies only in individual cases, or to block them entirely.

8. Google Search Console, Google Ads and Google Tag Manager

We use the following services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”):

  • Google Tag Manager lets us manage the tags embedded on our website. The Tag Manager itself does not set cookies or create user profiles; it only loads further tags, and does so only once you have given your consent.
  • Google Ads with conversion tracking lets us measure the success of our advertisements. If you reach our website via a Google ad, Google sets a cookie on your device that records whether you then take certain actions on our website (e.g. sending an enquiry). We only receive aggregated statistics and cannot identify you personally.
  • Google Search Console lets us monitor how our website appears in Google search results. We only receive aggregated data (e.g. search queries, impressions, clicks); Search Console does not set cookies on our website.

Google Tag Manager and Google Ads are used exclusively on the basis of your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time with effect for the future via the “Cookie settings” link in the website footer. Google Search Console is used on the basis of our legitimate interest in the visibility of our website in search results (Art. 6(1)(f) GDPR).

Google may transfer data to Google LLC in the United States; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR). We have concluded a data processing agreement with Google where required. You can manage personalised advertising at https://adssettings.google.com. Further information: https://policies.google.com/privacy.

9. Fonts

The fonts used on this website are hosted locally on our server. No connection to third-party servers (e.g. Google Fonts) is established when you visit our pages.

10. Company Pages on Social Networks

We maintain company pages on LinkedIn and Facebook. When you visit these pages, the platform operators process your data in accordance with their own privacy policies – in some cases even if you do not have an account. We have only limited influence on this processing.

For the creation of page statistics (Facebook “Insights”, LinkedIn “Page Analytics”), we are joint controllers with the respective operator (Art. 26 GDPR). In the relevant agreements, the operators have assumed primary responsibility for this processing and for handling data subject requests.

We operate these pages on the basis of our legitimate interest in modern corporate communication (Art. 6(1)(f) GDPR). The operators may transfer data to the United States; their US parent companies are certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR). You may exercise your rights both against us and directly against the operators.

11. Job Applications

If you apply for a position with us, we process your application data solely for the purpose of conducting the recruitment process (Art. 6(1)(b) GDPR). If no employment relationship results, we delete your documents no later than six months after the process has ended, unless you have consented to longer storage (e.g. for a talent pool).

12. Recipients and Third-Country Transfers

We only disclose your data where permitted by law. Recipients may include IT service providers (hosting, email), our tax advisors and public authorities within the scope of legal obligations. Service providers acting on our behalf are bound under Art. 28 GDPR. Transfers outside the European Economic Area take place only on the basis of an adequacy decision of the European Commission (Art. 45 GDPR) or appropriate safeguards such as standard contractual clauses (Art. 46 GDPR).

13. Retention Period

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. Thereafter the data is deleted or its processing restricted.

14. Your Rights

Within the limits of the law, you have the right at any time to:

  • access your stored data (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdraw consent with effect for the future (Art. 7(3) GDPR)
  • lodge a complaint with a supervisory authority (Art. 77 GDPR)

Right to object under Art. 21 GDPR: Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing purposes at any time without giving reasons.

To exercise your rights, simply contact datenschutz@xegit.de.

The supervisory authority competent for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, https://datenschutz.hessen.de. You may also contact the supervisory authority in your country of residence.

15. Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

16. Changes to this Privacy Policy

We update this privacy policy when our services or the legal situation change. The version published on this website applies.

This English version is provided for convenience. In case of discrepancies, the German version at www.xegit.de shall prevail.

Version: October 2026