Privacy Policy

1. Who We Are

Xpat Community is operated by EDMS SL, a company registered in Spain. We are the data controller responsible for your personal information collected through our platform, website, and associated applications.

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

Email: info@xpat.es
Website: xpat.es

2. What Data We Collect

We collect the following categories of personal data:

2.1 Data You Provide Directly

• Name and email address when you register for an account
• Profile information you choose to add
• Content you submit, including comments, posts, or event listings
• Communications you send to us via email or contact forms

2.2 Data Collected Automatically

• Device information including browser type, operating system, and device identifiers
• Usage data including pages visited, time spent, and features used
• IP address and approximate location data
• Cookies and similar tracking technologies (see Section 7)

2.3 Data From Third Parties

• If you connect via social login (e.g. Google, Facebook), we receive basic profile data from that provider
• Analytics data from third-party tools we use to improve the platform

3. How We Use Your Data

We use your personal data for the following purposes:

• To create and manage your account
• To deliver the Xpat Community service, including personalised content and venue recommendations
• To send you our newsletter and daily updates (where you have opted in)
• To send push notifications through our app (where you have enabled them)
• To respond to your enquiries and provide customer support
• To improve our platform through analytics and usage insights
• To comply with legal obligations
• To protect the security and integrity of our platform

4. Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Contract: Processing necessary to provide you with our service
• Consent: Where you have given explicit consent, such as for marketing communications
• Legitimate interests: To improve our service, prevent fraud, and ensure platform security
• Legal obligation: Where we are required to process data to comply with applicable law

5. How We Share Your Data

We do not sell your personal data to third parties. We may share your data with:

• Service providers who help us operate the platform (hosting, analytics, email delivery) — bound by data processing agreements
• WhatsApp / Meta, where you subscribe to our WhatsApp Channel — subject to Meta's own privacy policy
• Law enforcement or regulatory authorities where required by law
• A successor entity in the event of a merger, acquisition, or business transfer

Any third party we share data with is required to handle it in accordance with applicable data protection law.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. If you delete your account, we will remove your personal data within 30 days, except where we are required to retain it for legal or regulatory reasons.

7. Cookies

We use cookies and similar technologies to:

• Keep you logged in to your account
• Remember your preferences
• Understand how the platform is used through analytics
• Deliver relevant content

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the platform. By continuing to use Xpat Community, you consent to our use of cookies as described in this policy.

8. Your Rights Under GDPR

As a data subject in the European Union or European Economic Area, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — request deletion of your personal data in certain circumstances
• Right to restriction — ask us to limit how we process your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at info@xpat.es. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is completely secure and we cannot guarantee absolute security.

10. International Transfers

Your data is stored and processed within the European Economic Area. Where we use third-party services that transfer data outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR requirements.

11. Children's Privacy

Xpat Community is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at info@xpat.es and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the platform or by email. Your continued use of Xpat Community after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy:

EDMS SL
Email: info@xpat.es