Legal Basis for Processing
When we process your personal data, we do so on the basis that we can rely on a legal basis for such processing. The legal bases on which we rely are:

• Legitimate Interest
  We handle personal information for several legitimate business purposes, which may include one or more of the following:

  • Enhancing our services to improve the customer experience, including verification and validation.

  • Tailoring communications to be more relevant and meaningful.

  • Gaining deeper insights into how our customers engage with our services.

  • Offering direct marketing communications that we believe will be of interest to you.

  • Evaluating the efficacy of both our promotional campaigns and those of our clients.

  • Identifying and preventing fraud.

  These legitimate business purposes correspond to the following activities:

  • Direct Marketing: This includes postal and telephone marketing conducted by both us and third parties. In either case, the communications will pertain to products or services we believe align with your interests, based on the information you've provided.

  • Profiling: We may profile your information for marketing purposes to assist our clients in delivering more relevant marketing communications. For additional information, please refer to the profiling section

  • ID Protection & Tracing: This involves collaborating with appropriate agencies to safeguard your identity and prevent fraud.

• Consent
  When you consent to a particular organisation to reach out to you through communication channels that you have expressly approved for specific purposes, within the context of our data processing, these purposes are primarily related to marketing. When we ask your consent for a particular organisation, we will provide you with the option to select or check a box online to indicate your agreement. You can withdraw your consent at any time.

We will not change our legal basis without your permission, and you can find a summary of the various purposes in the table provided below:

Your Rights
According to the provisions of the UK GDPR, you have the following data protection rights

1. The right to be informed
   You have the right to be informed about the collection and use of your personal data, including: purposes for processing your personal data, the retention periods for your personal data, and who it will be shared with.

2. The right of access
   You have the right to access and receive a copy of your personal data, and other supplementary information.

3. The right to rectification
   You have the right to demand the rectification of any incorrect or inaccurate personal data we hold with respect to you.

4. The right to erasure
   You have the right to have your personal data erased if: (i) the data is no longer necessary in relation to the purposes for which it was collected or processed; (ii) you have withdrawn your consent; or (iii) the data have been unlawfully processed.

5. The right to restrict processing
   You have the right to have your data with processing restriction by satisfying one of the prerequisites listed in Art. 18 (1) GDPR (e.g., contesting the accuracy of your personal data).

6. The right to data portability
   You are entitled to demand the provision by us of all personal data communicated to us in a format, which allows its transmission to another controller.

7. The right to object
   You have an absolute right to stop your data from being used for direct marketing.

8. Rights in relation to automated decision-making and profiling.
   You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on you, except as allowed under applicable data protection laws

9. Right to withdraw consent at any time where relevant.
   You have the right to withdraw your consent to the processing of your information at any time and we must provide you with the information to need to do so, at the time we collect your data and each time we contact you. You can withdraw consent by sending us an email to: contact_uk@xlwinmarketing.net;
   
   

Profiling
Profiling enables organisations to better understand who their customers are so they can make their marketing communications more relevant. We use some of the information you provide to match with our clients data so that they will better understand the characteristics of their customers, such as age, hobbies and interests. This only happens when you are both on Offerspalace database and you are a customer of our client. We do not give them specific information about you but we will tell them how many of the customers are male/female or live in a certain city. We also help identify whether or not you have similar attributes to a typical customer of our client so they can target you with offers of goods and services tailored to you. We will never profile you on the basis of ethnicity, religion, politics or health as these are not valid reasons for which you should be targeted for marketing purposes and nor do we collect this information. We also do not make automated decisions about you which have a negative impact on your rights. Marketing Services Providers we share your data with can also use profiling to target you for marketing purposes. Once again you can ask us to stop using your data in this way at any time.

Contact and Complaints
If you have any questions, feedback or wish to make a complaint, please contact our Data Protection Officer at contact_uk@xlwinmarketing.net
Alternatively, you may contact GRCI Law Limited whom we have appointed to act as our UK Representative. If you wish to exercise your rights under the UK General Data Protection Regulation (GDPR), or have any queries in relation to your rights or privacy matters generally please email our Representative at ukrep@grcilaw.com or post your request or query to:
UK Representative, GRCI Law Limited, Unit 3, Clive Court, Bartholomew’s Walk, Cambridgeshire Business Park, Ely, Cambridgeshire, CB7 4EA, UK
When contacting our Representative please ensure you include our name (xlWin Marketing) in any correspondence.

You also have the right to lodge a complaint with a supervisory authority (the ICO) by writing to the Information Commissioner's Office at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or calling 0303 123 1113. Further information about how to do this can be found at: www.ico.org.uk.

Where and how long do we store your personal data and where can your data be exported

1. Your personal data is stored by us within the European Economic Area (EEA)
   Your data may be transferred to countries outside of the EEA or EU, to sponsors mentioned in our Sponsors List. These data transfers will be made on the basis of an Adequacy Decision where possible, there are Adequacy Decisions for Andorra, Argentina, Canada (for commercial operators), Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay. An Adequacy Decision means the regulations of these countries offer you the same level of protection as the EU. Where your data is transferred to a country that does not have an Adequacy Decision, we have contractual agreements and appropriate safeguards in place with each sponsor, based on standard clauses issued by the EU. These agreements ensure an appropriate and uniform protection of data at the level of European guidelines.

2. Safeguards for Transfers Not Covered by Adequacy Decisions
   If a transfer is not made on the basis of an adequacy decision, we ensure that appropriate safeguards are in place in accordance with Articles 46, 47, or 49 of the UK GDPR. These safeguards may include:

   • Standard Contractual Clauses (SCCs): Agreements based on the standard contractual clauses issued by the EU to ensure an equivalent level of data protection.

   • Binding Corporate Rules (BCRs): Internal policies adopted by multinational groups of companies to ensure adequate protection of personal data across the group.

   • Explicit Consent: Obtaining explicit consent from individuals for specific data transfers.

   • Other Safeguards: Any other appropriate safeguards as per the UK GDPR.

   • Obtaining Information on Safeguards

   You can request more information on the safeguards we have put in place or obtain a copy of these safeguards by contacting our Data Protection Officer at contact_uk@xlwinmarketing.net.

3. As long as there is no removal or blocking in accordance with the rights exercised by you, your data is stored permanently with the aforementioned purposes.
   After you have withdrawn any consent to data processing and/or have explained your objection to this, we put you on our so-called blocking list. This means that we no longer use your personal data for marketing purposes and also no longer hand them over. We then still store your data for legal purposes (for example, for evidentiary obligations and to prevent and assert claims, etc.) and delete it after a further period of four years unless there are compelling reasons against this or if, however, a corresponding data processing is permitted for other reasons, for example in the form of renewed consent. In addition, we act in the same way if we have no longer used your personal data during a period of 24 months.
   Legal Obligations: While the GDPR does not specify exact retention periods for personal data, we retain it for four years to comply with various legal obligations. For example, businesses may need to keep records for tax, audit, or regulatory reasons. This retention period is aligned with limitation periods for bringing legal claims, ensuring that we meet statutory requirements.
   Evidentiary Purposes: Another key reason for retaining data for this period is to ensure that we can defend against legal claims or fulfill evidentiary obligations. Many jurisdictions, including the UK, have limitation periods (such as for contract or tort claims) which can last up to four years. Retaining data for this period allows us to safeguard our legal rights and comply with relevant laws.

4. How we secure your personal data
   We take the relevant precautions – administrative, organizational, technical and physical – to protect your personal data against loss, theft, misuse, unauthorized access, unauthorized transmission, unauthorized amendment and destruction.
   This means, that your data is protected by entry controls (securely located servers, access to which is only granted under defined security procedures), admission controls (individual password, menu and employee authorization, current virus software), access controls (individual employee access authorization via personal accounts, identification and authentication requirements), disclosure controls (constant supervision and guidance to authorized personnel, no local storage of data, recording of all data exports and transmission), input controls (account-related auditing, time-stamp and host logging), task auditing (constant supervision by managers and data protection officers, transparent contract structure in coordination with management and data protection officers) , back-up streaming to other general security procedures [e.g. UPS, halon gas systems, etc.], back-up streaming to other locations [with all security measures, see access controls] nightly mirroring onto two hard discs, virus protection program). Despite these precautions and due to the insecure nature of the Internet, we are unable to guarantee the security of your data transmission to our website. Any transmission of your data to our website is, therefore, undertaken at your own risk.
   
   

Cookies Policy
You can view our Cookies Policy here.

Changes/additions
This privacy policy was last updated on 1 August 2024
xlWin will be able to change this privacy policy, especially if new laws or industry agreements arise which means that xlWin should change this or if xlWin considers it justified to change this for other reasons. This website, including the data protection declaration and the general terms and conditions, is not intended for minors. No personal data about minors is collected, used, and/or transmitted intentionally.