Privacy Policy

Last updated: November 2026

1. Introduction

This Privacy Policy explains how XO10 B.V. ("XO10", "we", "us" or "our") collects, uses, stores and protects personal data when you visit xo10.io, contact us, or use our products and services, such as GleeGuide, GleeConnect, CityMaatje and VDR (together, the "Services").

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch privacy legislation. How we use cookies and similar technologies is explained in detail in our Cookie Policy. Some of our products have their own website with a separate privacy policy, such as gleeguide.ai.

2. Who we are

XO10 B.V. is the controller of the personal data described in this policy.

XO10 B.V.
Basisweg 32, 1043 AP Amsterdam, the Netherlands
Email: info@xo10.io
Phone: +31 (0)85 888 333 1

3. What we collect and why

3.1 Contact form and business contact

When you fill in our contact form, email or call us, we process your name, business email address, company name, your phone number (optional), your question and the content of our correspondence. We use this to answer your question, follow up on your request and, where relevant, prepare a proposal.

Contact form submissions are stored in our CRM system, ActiveCampaign. We may send you relevant follow-up emails as a business contact. Every email contains an unsubscribe link.

3.2 Website analytics and marketing tools

When you visit our website, we process technical data such as your IP address, browser and device type, pages visited, clicks and scroll behavior, referral source and the date and time of your visit. We use the following tools for this, only after you have given consent through our cookie banner (Cookiebot):

• Google Analytics 4 (Google): measures website usage so we can improve content and the user journey. If you also consent to marketing cookies, Google may use this data for advertising features.
• Microsoft Clarity (Microsoft): shows anonymized heatmaps and session recordings of how visitors use our pages, so we can find and fix usability problems. Form input is masked.
• Leadinfo (Leadinfo B.V., the Netherlands): recognizes which companies visit our website based on the IP address of their business network, and which pages they view. With Leadinfo Replay we can also see how these company visits move through the website. Leadinfo shows company information, not information about you as a private individual.
• LinkedIn Insight Tag (LinkedIn): measures the results of our LinkedIn campaigns and gives us anonymized, aggregated insights into the professional background of visitors.
• ActiveCampaign site tracking (ActiveCampaign): links website visits to your contact record if you are already known to us, for example after filling in a form or clicking a link in one of our emails.

Some technical data is always processed to deliver the website safely, such as by our hosting provider Vercel and our content management system Storyblok, and by Vercel Speed Insights, which measures page performance without cookies. You can change or withdraw your consent at any time via your cookie settings or the cookie icon on our website. See our Cookie Policy for more information about the cookies we use.

3.3 Customers and platform users

When your organization uses one of our products, we process account and usage data (such as login details, settings and activity logs), contract and billing details, and support correspondence. We use this to provide, secure and improve our products and to manage the customer relationship.

Data that our customers process about their own guests, customers or users through our products is processed by us as a processor on their behalf, under a data processing agreement. For questions about that data, contact the organization concerned directly.

4. Legal bases

We process personal data on one or more of the following legal bases:

• Consent (Article 6(1)(a) GDPR): for analytics, marketing and other non-essential cookies and tools. You can withdraw consent at any time.
• Contract (Article 6(1)(b) GDPR): to perform a contract with you or take steps at your request before entering into one.
• Legitimate interest (Article 6(1)(f) GDPR): to follow up on business requests, maintain business relationships, send relevant business emails, and secure our website and products, provided your interests do not outweigh ours.
• Legal obligation (Article 6(1)(c) GDPR): for example tax and accounting obligations.

5. AI and platform processing

Our products use artificial intelligence. We implement appropriate technical and organizational measures, including redaction of personal data where possible. We do not use our customers' confidential business data or their end users' data to train public AI models unless explicitly agreed otherwise in writing.

6. Processors and other recipients

We do not sell personal data. We share personal data only with parties that help us deliver our Services, under a data processing agreement where they process data on our behalf:

• ActiveCampaign (United States): CRM, email and site tracking
• Vercel (United States): website hosting and performance measurement
• Storyblok (Austria): content management system
• Google (Ireland / United States): Google Analytics and Google Tag Manager
• Microsoft (Ireland / United States): Microsoft Clarity
• Leadinfo (the Netherlands): company recognition and Leadinfo Replay
• LinkedIn (Ireland / United States): LinkedIn Insight Tag
• Usercentrics / Cookiebot (Denmark): cookie consent management
• Amazon Web Services (EU regions): hosting of our products

We may also share data with professional advisers (such as accountants or lawyers) where necessary, and with authorities when required by law.

7. International transfers

Some of these providers are based in the United States or may access data from there. We only transfer personal data outside the European Economic Area with appropriate safeguards: certification of the provider under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision, and/or the European Commission's Standard Contractual Clauses.

8. Retention

We keep personal data no longer than necessary for the purposes described in this policy:

• Contact and sales requests: up to 24 months after our last contact, unless a business relationship follows.
• Customer, contract and billing data: for the duration of the relationship and afterwards for as long as legally required (generally 7 years for tax purposes).
• Website analytics data: according to the retention settings of the tools concerned; see our Cookie Policy.

9. Your rights

Under the GDPR you have the right to access, correct and delete your personal data, to restrict its processing, to data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw that consent at any time. Withdrawing consent does not affect processing that took place before.

Send your request to info@xo10.io. We respond within one month and may ask you to verify your identity. If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

10. Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse and unauthorized access. XO10 B.V. works according to ISO 27001 standards and is ISAE 3402 certified. We are preparing for our ISO 27001 recertification, which takes place in January 2027.

11. Cookies

We use cookies and similar technologies on our website. Our Cookie Policy explains which cookies we use, why, how long they are stored, and how you can change your preferences.

12. Changes to this policy

We may update this Privacy Policy, for example when we start using new tools or services. The latest version is always published on this page with an updated date.

13. Contact

Questions about this Privacy Policy or about how we handle your data? Contact us:

XO10 B.V.
Basisweg 32, 1043 AP Amsterdam, the Netherlands
Email: info@xo10.io