Privacy policy
XAtlas Group Holdings
Last updated: October 27, 2026
1. Introduction
At XAtlas Group Holdings (hereinafter, “XAtlas Group”, “the Group”, or “we”), we recognize the importance of protecting the privacy, confidentiality, and security of the personal information of those who visit our website, enter into commercial relationships, or interact with our business activities.
This Privacy Policy describes the principles and procedures applicable to the collection, use, storage, protection, and possible disclosure of personal data obtained through the official website:
Our commitment is to promote responsible, transparent, and secure processing of personal information, in accordance with the legal provisions that apply.
This policy applies to the institutional website and to data processing carried out under the responsibility of the entity that operates it.
Companies, platforms, and services affiliated with the XAtlas Group ecosystem may have independent privacy policies.
2. Data controller
The controller of the personal data collected through the Website will be the legal entity that actually operates the site under the trade name XAtlas Group Holdings.
The legal identification, jurisdiction, and other information required by applicable law must be available to data subjects through the mechanisms established by law.
Inquiries relating to privacy and data protection may be made through the contact form available at:
Where applicable regulations require the controller, its address, or a representative to be publicly identified, that information must be incorporated into this policy or provided by the mechanism permitted by law.
3. Scope of the policy
This Privacy Policy applies to personal data obtained through:
- Browsing the Website.
- Contact forms.
- Requests for commercial information.
- Inquiries about business projects.
- Institutional communications.
- Proposals for collaboration or strategic alliances.
- Contacts related to investments and business development.
- Digital interactions with representatives of the Group.
- Analytics and security systems of the Website.
The processing of information carried out by other companies in the XAtlas Group ecosystem may be subject to particular policies and conditions.
4. Personal data we may collect
Depending on the type of interaction, the following categories of information may be collected.
4.1. Identification data
- First and last name.
- Company or organization.
- Position or professional role.
- Country or region.
- Professional identification information provided voluntarily.
4.2. Contact data
- Email address.
- Telephone number.
- Information included in forms.
- Other means of contact provided voluntarily.
4.3. Commercial and business information
- Economic activity.
- Business sector.
- Commercial interests.
- Collaboration proposals.
- Requests for technology services.
- Information about business projects.
- Inquiries related to investments.
4.4. Technical and browsing information
Where necessary for the operation and security of the Website, the following may be processed:
- IP address.
- Browser type.
- Operating system.
- Technical identifiers.
- Date and time of access.
- Pages visited.
- Security logs.
- Technical information related to cookies.
4.5. Information provided voluntarily
Data that users choose to include in their communications with XAtlas Group may also be processed.
We ask that users avoid sending sensitive or confidential personal information that is not necessary to respond to the relevant inquiry.
5. Purposes of processing
Personal data may be processed for the following purposes, where a valid legal basis exists:
a) Handling of inquiries
To receive, manage, and respond to requests made through forms or institutional channels.
b) Commercial relationships
To assess collaboration opportunities, develop commercial proposals, and manage relationships with clients, suppliers, and strategic partners.
c) Business development
To analyze business proposals, technology initiatives, business projects, and cooperation opportunities.
d) Technology services
To manage requests related to artificial intelligence, automation, digital transformation, and the development of business solutions.
e) Information security
To detect unauthorized access, prevent fraudulent activities, and protect the technology infrastructure.
f) Legal compliance
To meet legal obligations, requests from competent authorities, and legally required document-retention needs.
g) Institutional communications
To send corporate information, news, or commercial communications where consent or another legal basis that permits it exists.
h) Improvement of the Website
To analyze its operation, identify errors, and improve the browsing experience, respecting privacy preferences and applicable obligations.
6. Legal bases for processing
The processing of personal data will be carried out on the legal basis that corresponds to each situation and jurisdiction.
The bases that may apply include:
Consent: where the user expressly authorizes a specific processing operation.
Contractual or pre-contractual relationship: where it is necessary to manage a request or perform an agreement.
Compliance with legal obligations: where the regulations require certain information to be retained or disclosed.
Legitimate interest: where applicable law so permits, a legitimate purpose exists, and the processing does not unduly override the rights of individuals.
A legal basis will not be used where it is not valid under the applicable regulations.
Where consent must be obtained, it must be informed, specific, and freely given.
7. Artificial intelligence and data processing
XAtlas Group develops and promotes initiatives related to artificial intelligence, automation, and business technologies.
In certain activities, technology tools that incorporate artificial intelligence features may be used.
Where these tools are involved in the processing of personal data, efforts will be made to apply the following principles:
- Minimization of information.
- Purpose limitation.
- Security and confidentiality.
- Human supervision where appropriate.
- Access control.
- Risk assessment.
- Regulatory compliance.
Personal data will not be used to train third-party artificial intelligence models without a valid legal basis and without meeting the applicable information, consent, or authorization requirements.
Where automated processes are implemented that produce legal effects, or similarly significant effects, on individuals, the safeguards required by the corresponding legislation will be applied.
8. Confidentiality of information
XAtlas Group recognizes the confidential nature that information received in the context of business inquiries, investment proposals, technology projects, and commercial relationships may have.
Access to personal data must be limited to authorized persons who need to know it in order to perform legitimate functions.
Efforts will be made so that employees, collaborators, and providers subject to confidentiality obligations use the information exclusively for the authorized purposes.
The submission of a business proposal through the Website does not, of itself, constitute a contractual confidentiality agreement.
Where a project requires special confidentiality obligations, they must be established by the corresponding agreement.
9. Disclosure of data to third parties
XAtlas Group will not commercialize databases of personal data as an independent activity without a valid legal basis and without complying with the corresponding legal obligations.
Personal data may be disclosed, where necessary and legally permitted, to:
- Hosting and technology infrastructure providers.
- Information technology service providers.
- Business communications providers.
- Storage and security services.
- Professional advisers subject to duties of confidentiality.
- Affiliated companies, where a legitimate purpose and a valid legal basis exist.
- Competent administrative or judicial authorities, where legally required.
Providers that process information on behalf of the controller must be subject to contractual obligations and appropriate safeguards.
The fact that different companies belong to the same economic group does not automatically authorize the unrestricted exchange of personal data.
10. International transfers of data
Because of the international nature of XAtlas Group’s activities, certain processing operations may involve providers or entities located in different countries.
Where international transfers of personal data are made, the requirements of applicable law must be met.
As appropriate, mechanisms such as the following may be used:
- Adequacy decisions.
- Contractual data protection clauses.
- Additional contractual safeguards.
- Valid consent in the cases permitted by law.
- Other mechanisms recognized by the competent authorities.
International transfers incompatible with applicable legal obligations will not be made.
Where required, data subjects will be informed of the recipients, the countries involved, and the safeguards used.
11. Retention of data
Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected.
Retention periods will depend on:
- The nature of the information.
- The purpose of the processing.
- The existence of contractual relationships.
- Legal retention obligations.
- The need to address claims.
- Applicable limitation periods.
Once the corresponding purposes have been fulfilled, the data will be deleted, anonymized, or retained in a restricted manner where a legal obligation so justifies.
Specific retention periods must be established in accordance with the processing actually carried out.
12. Security measures
XAtlas Group will endeavor to implement reasonable and proportionate technical and organizational measures to protect personal data.
These measures may include:
Technological security
- Encryption of communications by means of HTTPS.
- Access controls.
- Protection of systems and servers.
- Security updates.
- Authentication systems.
- Backups.
- Activity logs and incident-detection mechanisms.
Organizational security
- Restriction of access according to role.
- Confidentiality commitments.
- Incident-management procedures.
- Assessment of providers.
- Internal information-protection policies.
No computer system can guarantee absolute security.
If incidents affecting personal data occur, the measures required by applicable law will be adopted, including notifications to authorities and affected persons where they are required.
13. Cookies and tracking technologies
The Website may use cookies and similar technologies.
These technologies may serve different functions.
Necessary cookies
They enable essential functions related to browsing, security, and operation of the site.
Preference cookies
They make it possible to remember certain settings selected by the user.
Analytics cookies
They may be used to understand the operation of the Website and to obtain browsing statistics.
Marketing cookies
Where implemented, they may be used to measure campaigns or to personalize advertising communications, always under the corresponding legal conditions.
Non-essential cookies that require consent will remain disabled until valid authorization is obtained.
Users may manage their preferences through the tools available on the Website and the settings of their browsers.
The categories described do not necessarily imply that all of them are installed or active.
14. Rights of data subjects
Persons whose personal data are processed may exercise the rights recognized by applicable law.
Depending on the jurisdiction, these may include:
Right of access: to know what personal data are processed and for what purpose.
Right of rectification: to request the correction of inaccurate or incomplete information.
Right of updating: to request that information be kept up to date.
Right of erasure: to request the deletion of data where legally appropriate.
Right to object: to object to certain processing in the cases recognized by law.
Right to restriction: to request restrictions on certain processing where the regulations so provide.
Right to portability: to receive or transmit personal information where legally applicable.
Right to withdraw consent: to withdraw an authorization previously given, without affecting the lawfulness of prior processing.
Rights relating to automated decisions: to request the corresponding safeguards where automated decisions are subject to regulation.
The exercise of these rights may be subject to the conditions, exceptions, and time limits established by applicable law.
15. Procedure for exercising rights
Data subjects may submit requests relating to their personal data through the contact form available at:
The request must make it possible to reasonably identify the requester and to describe the right the requester wishes to exercise.
Where necessary, additional elements may be requested in order to verify the identity of the data subject, while seeking not to collect excessive information.
Requests will be handled within the time limits established by applicable law.
The exercise of rights will be free of charge where the corresponding regulations so provide.
Data subjects may also lodge complaints with the competent data protection authorities.
16. Privacy of minors
The Website is directed primarily at professionals, companies, investors, organizations, and persons interested in business and technology activities.
It is not specifically designed to collect personal information of minors.
Where processing of minors’ data is identified that requires authorization from their legal representatives, the corresponding measures will be applied.
If unauthorized collection of minors’ personal data is detected, the actions required by applicable law will be taken.
17. Third-party links and services
The Website may contain links to external platforms, companies, applications, or services.
XAtlas Group does not necessarily control the privacy practices of these third parties.
Users should consult the privacy policies of external sites before providing personal information.
The inclusion of links does not imply that third parties’ data-processing practices are identical to those of XAtlas Group.
18. Companies and platforms in the XAtlas Group ecosystem
XAtlas Group may develop, manage, promote, or participate in different companies, brands, and technology platforms.
These organizations may operate through independent legal entities.
Each company or platform will be responsible for adequately informing individuals about the processing of personal data that it carries out under its own responsibility.
This Privacy Policy principally governs the processing of information related to the institutional Website of XAtlas Group.
It does not replace the specific policies that may apply to commercial platforms, e-commerce systems, subscription services, business solutions, or technology applications.
19. Commercial communications
XAtlas Group may send institutional and commercial communications to persons who have authorized their receipt or where another valid legal basis exists.
These communications may include information about:
- Business projects.
- Technology solutions.
- Artificial intelligence.
- Automation.
- Strategic alliances.
- Corporate activities.
- New services and developments.
Recipients may request to stop receiving commercial communications through the mechanisms made available.
Opt-out requests will be handled in accordance with applicable legal obligations.
20. Updates to the policy
XAtlas Group may modify this Privacy Policy to reflect legal, technological, organizational, or operational changes.
Updates will be published on the Website, indicating the corresponding date.
Where changes substantially affect the purposes of processing or require a new authorization, consent will be requested or the measures required by applicable law will be adopted.
21. Applicable law
The processing of personal data will be governed by the law applicable according to the responsible entity, the establishment involved, the location of the data subjects, and the characteristics of the processing.
Where appropriate, data protection rules of different jurisdictions may apply.
XAtlas Group will endeavor to comply with the legal obligations that correspond to its operations and international relationships.
This policy does not limit the non-waivable rights recognized for data subjects.
22. Contact and privacy inquiries
For inquiries, requests for information, or the exercise of rights related to the protection of personal data, users may use the contact form available on the official site:
Requests will be handled in accordance with applicable legal provisions.
© 2026 XAtlas Group Holdings. All rights reserved.
Technology · Artificial Intelligence · Business · Investment
Building the Future with AI, Automation & Enterprise Technology