Privacy Policy
This policy explains how XP Group handles personal data when you use our website, contact us or subscribe to our communications. It does not replace the information provided for a specific client engagement.
1. Who is responsible for your data
The controller is XPGRP, LDA, trading as XP Group, a Portuguese company with registration and tax number 517619490, whose registered office is at Avenida da Liberdade, n.º 9, 6.º direito, 1250-139 Lisboa, Portugal. For privacy enquiries or to exercise your rights, contact info@xpgrp.com or write to this address.
2. Information we collect
When you contact us, we receive the information you provide, such as your name, email address, telephone number, country of residence, organisation and the content of your enquiry. Our website systems also process technical information, such as your IP address, browser, access times and pages requested, to operate and protect the website. Information collected through cookies is explained in our Cookie Policy.
Please send only what is needed for your enquiry. Do not use the general contact form to send passports, financial records, health information, criminal records or other sensitive documents. Where documents are needed for a service, we will explain how to provide them and how they will be handled.
Providing information is voluntary. Fields marked as required are needed to respond or take the action you request; without them, we may be unable to do so.
3. Why we use your data
Responding to enquiries. We use your contact details and message to answer you and discuss the support you request. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). For general enquiries and communications with business representatives, it is our legitimate interest in responding to requests and managing professional relationships (Article 6(1)(f)).
Operating and securing the website. We process technical information to deliver the website, diagnose faults and prevent misuse. The legal basis is our legitimate interest in maintaining a secure, functioning service (Article 6(1)(f)). This does not authorise the use of non-essential cookies without consent.
Optional communications and cookies. Where you subscribe to updates or enable optional cookies, we rely on your consent (Article 6(1)(a)). We use your information only for the purpose you selected. Sending an enquiry does not subscribe you to marketing.
Legal obligations and claims. We process information needed to comply with applicable law, including responding to data protection requests (Article 6(1)(c)), and, where necessary, for our legitimate interest in establishing, exercising or defending legal claims (Article 6(1)(f)).
4. Who receives your information
Access is limited to authorised team members and providers supporting our website, communications and enquiry management. Providers acting on our behalf are subject to data protection, confidentiality and security obligations. Information may also be disclosed to professional advisers or public authorities where necessary for legal obligations or claims.
Where your enquiry requires an independent lawyer, adviser or other service provider, we will identify the intended recipient and explain the proposed referral before sharing your details. We share only what is needed for your request, not a general permission for partners to market to you. An independent provider is responsible for its own processing and privacy information.
5. International transfers
XP Group may process or access personal data from locations outside the European Economic Area (EEA), including where members of our team, service providers or technology partners operate internationally.
Where personal data is transferred to a recipient outside the EEA and such transfer is subject to the GDPR rules on international data transfers, XP Group will ensure that an appropriate legal mechanism is in place, such as an adequacy decision adopted by the European Commission, standard contractual clauses, or another safeguard permitted under applicable data protection law.
Further information about the safeguards applicable to international transfers may be requested by contacting us at info@xpgrp.com.
6. How long we keep information
Enquiries that do not become engagements: 15 working days after the last substantive contact.
Subscriptions: until you unsubscribe or we discontinue the list. We retain minimum opt-out information to respect your choice, and evidence of consent for the period needed to demonstrate compliance or address a related claim.
Cookies: for the periods stated in the Cookie Policy. Any personal data derived from them have the retention periods identified there.
Separate retention periods apply to client engagements and will be explained by the relevant provider. Records needed for legal obligations or an actual or reasonably anticipated dispute are retained for the applicable statutory period or until the matter and any appeal period end. We then delete or irreversibly anonymise them.
7. Your choices and rights
Subject to the GDPR’s conditions, you may request access, correction, erasure or restriction of your data. Portability applies to data you provided where processing is automated and based on consent or a contract.
You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time, without giving a reason, and we will stop using your data for that purpose.
You may withdraw consent at any time through the email unsubscribe link, Cookie settings or info@xpgrp.com, as appropriate. Withdrawal does not affect the lawfulness of earlier processing.
Contact info@xpgrp.com to exercise your rights. Requests are normally free. We respond without undue delay and within one month. If the complexity or number of requests requires an extension of up to two further months, we will explain it within the first month. We may request necessary identity checks only if we have reasonable doubts about your identity.
You may complain directly to Portugal’s Comissão Nacional de Proteção de Dados (CNPD), or another competent supervisory authority where you live, work or consider that an infringement occurred. You do not need to contact us first. Contact the CNPD
8. Security and automated decisions
We apply technical and organisational measures appropriate to the risks, including access controls and confidentiality requirements. No internet service can be guaranteed completely secure.
We do not use the data covered by this policy to make decisions based solely on automated processing that produce legal or similarly significant effects on you.
9. Changes to this policy
The date above identifies the latest version. If we materially change how we use your data, we will provide the relevant information before the change takes effect and obtain fresh consent where required.