PrivacyPolicy

1. Roles and Responsibilities for Client Data

X3WEB's role depends on the nature of the data being processed:

• As Responsible Party (Controller): X3WEB is the Responsible Party for personal information it collects directly for its own business operations, such as client contact details, billing information, and website analytics.
• As Operator (Processor): Where X3WEB hosts, stores, or processes personal information on behalf of a client (e.g., website form submissions, hosted mailbox data, CRM leads, customer data uploaded by the client), the client remains the Responsible Party/Controller. In these cases, X3WEB acts only as an Operator/Processor to the extent applicable.

The client is responsible for ensuring a lawful basis, providing necessary notices, obtaining consent where required, and giving lawful instructions relating to their end-user or customer data. X3WEB processes such data only to provide the requested service, secure systems, comply with law, and follow client instructions where applicable.

Registered address: 4 Edmonton Alley, Northcliff, Johannesburg, South Africa

Email: Accounts@x3web.co.za

Phone: +27 64 725 0842 (Support) | +27 68 906 3369 (Sales)

2. Information We Collect

We collect personal information depending on how you use the Services.

A. Information you provide to us

• Contact details: name, email address, phone number, company/business name, province/city, and any address you choose to provide
• Business details you submit: monthly turnover range, marketing budget range, requested services
• Communications: messages you send us (support requests, enquiries, feedback), including attachments
• User content: content you submit through forms or uploads (e.g., text, images, documents)

B. Information collected automatically

• Device and usage data: IP address, device type, browser type, operating system, pages viewed, clicks, time on page, referring/exit pages
• Approximate location data: derived from IP address
• Cookies and similar technologies: used to operate the site, remember preferences, measure performance, and (where enabled) support advertising/remarketing (see section 5)

C. Information from third parties (where applicable)

We may receive information from service providers and platforms used to provide the Services, such as payment processors, analytics providers, advertising platforms (e.g., Meta and Google), and scheduling and communications tools.

3. How We Use Personal Information

Service delivery and operations

• Provide, maintain, and improve the Services
• Manage bookings/meetings and respond to requests
• Provide customer service and technical support
• Set up and administer accounts (if applicable)
• Process transactions (if applicable) and send service-related notices

Communications

• Respond to enquiries and support requests
• Send administrative messages (updates, security notices, changes to terms/policies)

Marketing and advertising (where permitted)

• Send marketing communications (you can opt out at any time)
• Measure and improve marketing performance
• Run advertising and remarketing (only where enabled and permitted), including conversion measurement

Security and compliance

• Protect against fraud, abuse, and security incidents
• Enforce our terms and protect our legal rights
• Comply with applicable laws, regulations, and lawful requests

4. Legal Bases for Processing (Where Required)

Where laws require a legal basis (such as GDPR/UK GDPR and similar regimes), we process personal information under one or more of the following bases:

• Contract: to provide the Services you request
• Consent: where you provide permission (e.g., certain cookies/remarketing, optional marketing where required)
• Legitimate interests: to operate, improve, and secure our Services; prevent fraud; measure and improve performance; and communicate with business customers about relevant services
• Legal obligation: to comply with legal requirements (e.g., tax/accounting and regulatory compliance)

5. Cookies and Similar Technologies

We use cookies and similar technologies (including pixels/tags) for the following categories:

• Strictly necessary cookies — Required for core site functionality, security, and basic operations.
• Preferences cookies — Remember choices such as form/session preferences where applicable.
• Analytics cookies — Help us understand how the site is used so we can improve performance.
• Advertising/marketing cookies (where enabled) — Used to measure ad performance and, where applicable, support remarketing/interest-based advertising on platforms like Meta and Google.

Your choices: You can control cookies via your browser settings. Blocking some cookies may impact site functionality.

6. How We Share Personal Information

We do not sell your personal information.

Service providers (processors)

We share information with vendors who help us run the Services, such as hosting and infrastructure providers, website analytics providers, email and communication tools, customer support tools, scheduling/booking tools, payment processors (if applicable), and advertising/marketing platforms (if applicable and enabled).

Legal, safety, and rights

We may disclose information if required by law, court order, or lawful government request, or if necessary to protect our rights and property, enforce agreements, prevent fraud or security threats, or protect users or the public.

Business transfers

If we are involved in a merger, acquisition, restructuring, or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate safeguards.

7. International Data Transfers

Because we operate and may use service providers globally, your personal information may be processed in countries other than your own. Where required by law, we use safeguards for international transfers, such as adequacy decisions (where applicable), Standard Contractual Clauses (SCCs) or equivalent contractual protections, and other lawful mechanisms permitted by applicable law. You can request information about the safeguards we use by emailing Accounts@x3web.co.za.

8. Data Retention

We keep personal information only as long as necessary for the purposes described in this policy. Typical retention examples:

• Enquiry and booking form submissions: up to 24 months after last interaction
• Client/service records (contracts, invoices, billing): typically 5–7 years as required for accounting/tax and business record-keeping
• Support communications: up to 24 months after issue resolution
• Marketing opt-in records: while you remain subscribed, plus a reasonable period to maintain suppression lists

We may retain aggregated or de-identified information for longer periods.

9. Security

We take reasonable technical and organisational measures to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your Privacy Rights and Choices (Global)

Depending on where you live, you may have one or more of the following rights:

• Access: request a copy of your personal information
• Correction: request correction of inaccurate or incomplete information
• Deletion: request deletion of your personal information (subject to legal exceptions)
• Portability: request a portable copy of certain information
• Restriction: request that we limit processing in certain cases
• Objection: object to certain processing (including some marketing or legitimate interest processing)
• Withdraw consent: where processing is based on consent, you can withdraw it at any time
• Opt out of marketing: you can unsubscribe from marketing emails at any time

Email Accounts@x3web.co.za with your request. We may need to verify your identity before responding.

11. Regional Notices

A. EEA/UK/Switzerland (GDPR/UK GDPR)

You have the rights described above, including the right to object to processing based on legitimate interests and to lodge a complaint with a supervisory authority in your country.

B. South Africa (POPIA)

You may request access, correction, or deletion of your personal information and object to processing in certain circumstances. You may lodge a complaint with the Information Regulator (South Africa).

C. California (CPRA) (If Applicable)

If applicable, California residents may have rights to know, delete, correct, and opt out of certain "sharing" for cross-context behavioural advertising. Contact us at Accounts@x3web.co.za.

D. Brazil (LGPD) and other jurisdictions

Similar rights may apply, including access, correction, deletion, portability, and information about sharing. Rights and terminology vary by country/state. We apply the relevant standard based on your location and the applicable law.

12. Children's Privacy

Our Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from children under the age required by local law. If you believe a child has provided personal information, contact Accounts@x3web.co.za and we will take steps to delete it.

13. Third-Party Links

Our Services may link to third-party websites or services. We are not responsible for their privacy practices. Please review their policies before providing personal information.

14. PAIA Manual (South Africa)

For South Africa, our PAIA Manual (Section 51) is available on request. If you need a copy, email Accounts@x3web.co.za.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the Effective date above. Your continued use of the Services after changes become effective means you accept the updated policy.