Privacy Policy

Last updated: May 21, 2026

This Privacy Policy explains how XKEMA collects, uses, stores, shares and protects personal data when you access or use our website, platform, applications and related services.

1. Data controller

The data controller responsible for the processing of personal data described in this Privacy Policy is XKEMA.

Trade name: XKEMA
Website: https://www.xkema.com
Contact email: [email protected]
Country of operation: Spain

If XKEMA operates through a legal entity, the corresponding corporate identification details may be added or updated in this Privacy Policy.

2. Personal data we may collect

Depending on how you interact with XKEMA, we may collect and process the following categories of personal data:

Identification and contact data: name, surname, company, professional role, email address and other contact details provided by you.
Account data: username, authentication credentials, account settings, team memberships, permissions, subscription or licence information.
Technical data: IP address, browser type, device information, operating system, language, access logs, timestamps, security events and diagnostic information.
Usage data: pages visited, actions performed, features used, interaction data, analytics events and performance metrics.
User content and project data: files, documents, component data, BOMs, requirements, comments, engineering documentation, metadata and other information uploaded or generated within the platform.
Communications data: messages, contact form submissions, support requests, feedback, demo requests and related correspondence.
Billing and commercial data: where applicable, subscription status, invoicing details, payment status, plan information, purchase history and related commercial records.

3. How we collect personal data

We collect personal data directly from you, automatically through your use of the website or platform, and from third-party service providers where necessary for the operation of XKEMA.

When you create an account or log in.
When you complete a contact, demo or support form.
When you upload, create or manage content within the platform.
When you interact with our website, emails or services.
When cookies or similar technologies are used in accordance with our Cookies Policy.

4. Purposes of processing

XKEMA processes personal data for the following purposes:

To provide, operate, maintain and secure the XKEMA platform.
To create and manage user accounts, teams, roles, permissions and licences.
To store, process and display user content and project documentation.
To provide technical support, respond to enquiries and manage communications.
To improve usability, performance, reliability and product functionality.
To detect, prevent and respond to abuse, fraud, unauthorised access or security incidents.
To comply with legal, tax, accounting and regulatory obligations.
To manage subscriptions, billing, payments and commercial relationships where applicable.
To send service-related notices and essential communications.
To send optional marketing communications only where legally permitted or with your consent.

5. Legal basis for processing

We process personal data on the following legal bases, depending on the context:

Purpose	Legal basis
Providing access to the platform and services	Performance of a contract or pre-contractual measures
Account, licence, team and permission management	Performance of a contract / legitimate interest
Security, abuse prevention and access logs	Legitimate interest / legal obligation
Contact forms, demo requests and support communications	Consent / pre-contractual measures / legitimate interest
Analytics and non-essential cookies	Consent
Billing, accounting and tax records	Legal obligation / performance of a contract
Service updates and essential notices	Legitimate interest / performance of a contract
Optional marketing communications	Consent or legitimate interest where legally permitted

6. User content and engineering data

XKEMA is designed for hardware engineering workflows. Users may upload or generate technical documentation, BOMs, component information, files, requirements, comments, project metadata and other engineering-related content.

Users remain responsible for ensuring that they have the necessary rights, permissions, confidentiality authorisations and legal basis to upload and process such content through XKEMA.

XKEMA processes user content only to provide, maintain, secure and improve the services, subject to the applicable Terms of Service and any contractual agreements in place.

7. Data recipients and service providers

We do not sell personal data.

Personal data may be shared with or processed by trusted service providers when necessary for the operation of XKEMA, including:

Cloud hosting and infrastructure providers.
Database, storage and backup providers.
Email and transactional communication providers.
Security, monitoring and logging providers.
Analytics providers, where consent has been granted.
Payment and billing providers, where applicable.
Professional advisers, legal or accounting providers where necessary.
Public authorities, courts or regulators where legally required.

Such providers process data under appropriate contractual, confidentiality and data protection obligations where required.

8. Third-party services

XKEMA may use third-party services necessary for platform operation, security, communications, analytics or infrastructure.

These may include, depending on the active configuration:

Cloud hosting providers.
Object storage providers.
Email delivery providers.
Google reCAPTCHA for spam and abuse protection.
Google Analytics, only where analytics consent has been granted.
Payment processors, where paid plans are available.

9. International data transfers

Some service providers may process personal data outside the European Economic Area.

Where international transfers occur, XKEMA endeavours to ensure that appropriate safeguards are implemented in accordance with applicable data protection laws, such as European Commission adequacy decisions, Standard Contractual Clauses or equivalent lawful mechanisms.

10. Data retention

XKEMA retains personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, enforce agreements and maintain platform security.

Retention periods may vary depending on the type of data:

Account data: retained while the account remains active and for a reasonable period thereafter.
User content: retained according to the account, workspace, subscription or contractual settings.
Security logs: retained for a limited period necessary for security and abuse prevention.
Billing and tax records: retained for the legally required period.
Analytics data: retained according to the applicable analytics configuration and consent settings.
Cookie consent records: generally retained for up to 180 days unless withdrawn earlier.

11. Security measures

XKEMA applies reasonable technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include access controls, authentication, encryption in transit where applicable, logging, monitoring, infrastructure protections and role-based permissions.

However, no internet-based service can guarantee absolute security. Users must also take appropriate measures to protect their accounts, credentials and uploaded information.

12. Your data protection rights

Subject to applicable law, you may exercise the following rights:

Access: to know whether we process your personal data and obtain a copy of it.
Rectification: to request correction of inaccurate or incomplete data.
Erasure: to request deletion of your personal data where legally applicable.
Restriction: to request limitation of processing in certain circumstances.
Objection: to object to processing based on legitimate interests.
Portability: to receive personal data in a structured, commonly used and machine-readable format where applicable.
Withdraw consent: to withdraw consent at any time where processing is based on consent.

You may exercise your rights by contacting us at: [email protected].

We may request additional information to verify your identity before responding to a rights request.

13. Right to lodge a complaint

If you believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.

In Spain, the competent authority is the Spanish Data Protection Agency, Agencia Española de Protección de Datos, AEPD.

14. Children

XKEMA is intended for professional and business use. It is not directed to children or minors, and we do not knowingly collect personal data from children.

15. Cookies and similar technologies

XKEMA uses cookies and similar technologies as described in our Cookies Policy.

You can manage your cookie preferences through the cookie settings available on the website.

16. Changes to this Privacy Policy

XKEMA may update this Privacy Policy from time to time to reflect legal, technical, operational or business changes.

Material changes may be notified through the website, platform notifications or other appropriate means.

17. Contact

For privacy-related questions, requests or communications, you may contact XKEMA at:

E-mail: [email protected]