Privacy Policy

1. Introduction

Circularmonster B.V., trading as XITAD ("we", "us", or "our") respects your privacy and is committed to protecting the personal data of our clients, partners and website visitors. This policy describes how we collect, use, secure and share information when you use our platform, our website or our ITAD services.

2. Data we collect

We collect only data that is strictly necessary to deliver our enterprise services:

• Business contact details: Name, business email address, telephone number and job title of our contacts.
• Account & portal data: Login credentials, audit logs and interactions within the XITAD Enterprise Portal.
• Hardware and inventory data: the lists and files you supply. We ask you to remove data that can be traced to individuals. In practice, exports from an asset management system often still contain user names, departments or locations; whatever reaches us is then processed as personal data rather than treated as absent. On receipt we automatically strip hidden data such as location and author name from photos and documents.
• Technical data: IP addresses, browser type and metadata via essential cookies to safeguard the security of our platform.
• Data of buyers and processors: contact details, bids, invoicing details and the signed confidentiality undertaking.
• Business contact details of potential buyers: the company name and business email address of companies that buy or process IT hardware, which we receive or obtain from public business sources.

3. Purposes of processing

We process your data solely for the following purposes:

- Quoting, planning and executing IT Asset Disposition projects.
- Facilitating secure access to the XITAD Enterprise Portal.
- Generating legally watertight certificates of destruction (CoD) and audit trails.
- Complying with legal, fiscal and compliance-related obligations.
- Inviting potential buyers to bid on projects that suit their business, based on our legitimate interest in finding suitable buyers for each project (Article 6(1)(f) GDPR).
- Advertising measurement, only with your consent to marketing cookies: if you arrive through a Google ad, we record Google's click ID. If your residual value scan then becomes a qualified business enquiry, we report that click ID back to Google, so we can see which ads work and improve them. Without that consent we do not store the click ID or pass it on.

4. Who else processes your data

We do not sell your data. To deliver our service we engage the following parties, each for a defined purpose:

• OpenAI (United States): the contents of a supplied hardware list are sent to a language model to extract brand, model and quantities. This is the only processor outside the European Economic Area; the transfer relies on the European Commission’s standard contractual clauses.
• Resend (email), Moneybird (invoicing), Microsoft (calendar and meeting links), Cloudflare (form protection), Google (advertising and statistics, only after your consent) and Hetzner (hosting in Germany).
• Processing and logistics partners: the parties that collect, erase, process or buy the equipment. They receive only what they need for that assignment; the client’s name is shared only after a bid has been accepted.

Data processing agreements are in place with these parties, or their own processing terms apply. Processing partners additionally sign a confidentiality undertaking before they receive any data relating to an assignment.

5. Security and retention

Traffic to our platform runs over an encrypted connection, data is stored encrypted, access is bound to roles, and two-factor authentication is available for every account. We do not keep data longer than needed:

- A residual value scan that does not lead to a project, including the supplied file: 30 days. If we have qualified the scan as a business enquiry, we keep it longer, for as long as needed for follow-up in our customer system and within the retention period that applies to it.
- A scan that does lead to a project: for as long as the project and the subsequent retention obligation run.
- Invoices, certificates of destruction and the related records: 7 years, under tax retention rules.
- Relationship data in our customer system: for as long as the relationship runs, and thereafter until there is no business or legal reason to keep it.
- A buyer we invited who never activated or used their account: as a rule, that account becomes eligible for deletion 12 months after the last invitation or activity.

6. Your rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access to the personal data we process about you.
• Rectification of incorrect or incomplete data.
• Erasure of your personal data (the "right to be forgotten"), provided this does not conflict with our statutory retention obligation for audit trails.
• Restriction of, or objection to, the processing of data.
• Unsubscribing from invitations: every invitation contains a link to stop receiving invitations. We then keep only your email address and the time you unsubscribed, so that we respect that choice even after an unused account has been deleted.

7. Contact and complaints

For questions about this policy or to exercise your rights, please contact our privacy contact point:

Circularmonster B.V. (trading as XITAD)
Email: privacy@xitad.com
Phone: +31 (0)85 - 200 62 00

If we cannot resolve it together, you may lodge a complaint with the Dutch Data Protection Authority.