1. Data controller
Daler Dustov, trading as XV Platform, Neustr. 8, 54518 Plein, Germany. Email: info@xv-platform.de; phone: +49 176 80 688451. You can also use this email address to exercise your data protection rights.
2. Scope
This policy covers these XV Platform pages, enquiries about websites, apps, CRM, integration, AI and automation, and the shared support page linked from the footer. It does not cover accounts, payments or shipment tracking in separate products such as Logi Pro, which have their own privacy notices. Project-specific data processing is agreed and explained separately.
3. Hosting and technical access data
When this website is accessed, we process in particular the IP address, time, requested page or file, status, data volume and the browser, device and referrer information sent by the browser. This is used to deliver the website, analyse errors and prevent misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure, functional website.
We use IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, and netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, for hosting and technical infrastructure. These providers may process the data needed to provide their services on our behalf. Provider information: IONOS privacy policy and netcup privacy policy.
4. Contact and project enquiries
The project form sends your name, email address, selected area and description over an encrypted connection to our server and to our CRM for processing. Your enquiry is retained on the server and may remain there if forwarding is delayed. The form no longer creates an email draft. Contract-related enquiries rely on Article 6(1)(b) GDPR; other business enquiries rely on Article 6(1)(f) GDPR. Direct emails are processed through the email services involved.
5. Support, CRM and attachments
The support form processes your name, email address, topic, service, customer type and issue description, together with an optional phone number and up to three images (PNG, JPG, WebP or GIF, up to 5 MB each). It also records the language, form page, time and request identifier. Your request is handled in our CRM and protected server storage. Attachments are stored outside the public web directory; the CRM receives an internal reference. Technical delivery statuses are stored. For misuse prevention, the IP address is converted into a keyed identifier. Depending on the enquiry, the legal basis is Article 6(1)(b) or (f) GDPR. Send only necessary information and no access credentials.
6. Cookies, browser storage and local resources
The forms use a necessary session for security and CSRF protection (cookie xv_session, HttpOnly, SameSite=Strict; Secure over HTTPS). Your cookie preference is stored for up to 180 days in localStorage under xv_analytics_consent_v1 . The language is selected by opening the corresponding URL. Necessary storage is based on section 25(2), no. 2 TDDDG and, where personal data is involved, Article 6(1)(f) GDPR. Fonts, images and scripts are served locally. The demonstrations do not call AI models or send form data to AI services.
7. External links and WhatsApp
Instagram, WhatsApp and project websites are external links rather than embedded feeds. Only when you open a link does the relevant service receive the connection data needed to provide it and process that data under its own responsibility.
When contacting us through WhatsApp, your phone number, profile details, messages and connection data are processed in particular by WhatsApp Ireland Limited and the service providers involved. Processing outside the EEA, including within the Meta group, is possible. Please read the WhatsApp privacy policy. Depending on your enquiry, our processing relies on Article 6(1)(b) or (f) GDPR. You can also contact us by email or phone.
The WhatsApp selector offers contacts in Germany and Tajikistan. You choose the recipient when opening a contact. If you use the Tajikistan contact, your message may be accessed from outside the EEA. You can instead use the email address or German phone contact provided.
8. Recipients and international processing
Access is granted to authorised staff and the technical providers used for hosting, email and support/CRM infrastructure. Where required for an agreed project, separately agreed project partners may also be involved. Disclosure may be required by law or to enforce or defend legal claims. Enquiry data is not sold.
Where providers process data on our instructions, the requirements of Article 28 GDPR must be observed. Additional services processing data outside the EEA may be used only subject to Articles 44 et seq. GDPR; further information is provided in the relevant context. External linked services process data independently under their own notices.
9. Retention periods
Enquiries, support requests, attachments and internal support logs are retained for as long as needed to handle or document the matter or defend legal claims. Data no longer required must be deleted unless a retention obligation or another continuing legal basis applies. Successful forwarding to the CRM does not automatically end storage on the web server.
Technical logs are processed for operation, troubleshooting and investigating misuse; incident-related data may be needed until an investigation is complete. Invoices and other business records subject to retention obligations are kept for the applicable statutory periods. Your cookie preference remains in the browser for up to 180 days or until you delete the website data.
10. Required information
Contacting us is voluntary. However, without the required form information we cannot identify or answer your enquiry. Optional details and attachments are not a requirement for making a request.
11. Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction and data portability (Articles 15–20 GDPR). You may withdraw consent with effect for the future; this does not affect the lawfulness of earlier processing.
Right to object: For processing based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation under Article 21 GDPR. Contact: info@xv-platform.de.
12. Complaints
You may lodge a complaint with a data protection supervisory authority. For our registered location, the competent authority is in particular the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate, Postfach 30 40, 55020 Mainz: Contact the supervisory authority.
13. Automated decisions and changes
The website enquiries described here do not involve decisions based solely on automated processing with legal or similarly significant effects within the meaning of Article 22 GDPR. We update this policy when features or data processing change.
14. AI and data in client projects
Integrating AI into a client project is agreed separately from using this website. Before connecting an AI service, we determine the processing purpose, data categories, model provider, access, retention, possible international transfers and any required human review points. Where data is processed on behalf of a client, instructions and any required agreement under Article 28 GDPR are agreed. This policy is not a general authorisation to pass project data to external AI services or use it to train models.
15. Google Analytics
Google Analytics 4 is loaded only after your consent (Basic Consent Mode). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records in particular page views, device/browser details and selected interactions, such as confirmed enquiries or contact clicks. Names, email addresses, message text and attachments are not sent to Analytics. Query parameters and fragments are removed from the page URL configured by us. Advertising personalisation and Google Signals are disabled.
The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. With consent, Google may in particular set _ga cookies. Processing in the USA or other third countries is possible; the applicable transfer mechanisms and Google contractual terms apply. You may withdraw consent at any time in the cookie settings in the footer. This disables Analytics for subsequent page views and we delete accessible Analytics cookies; earlier processing remains lawful. Retention within the Analytics property follows the setting configured there. Google privacy policy; How Analytics uses data.
15. Google Analytics
Google Analytics 4 is loaded only after your consent (Basic Consent Mode). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records in particular page views, device/browser details and selected interactions, such as confirmed enquiries or contact clicks. Names, email addresses, message text and attachments are not sent to Analytics. Query parameters and fragments are removed from the page URL configured by us. Advertising personalisation and Google Signals are disabled.
The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. With consent, Google may in particular set _ga cookies. Processing in the USA or other third countries is possible; the applicable transfer mechanisms and Google contractual terms apply. You may withdraw consent at any time in the cookie settings in the footer. This disables Analytics for subsequent page views and we delete accessible Analytics cookies; earlier processing remains lawful. Retention within the Analytics property follows the setting configured there. Google privacy policy; How Analytics uses data.