Privacy

Draft framework for data minimisation, processing purposes, retention, individual rights and pre-pilot GDPR gates.

EXPERIMENT / UNTIL FURTHER NOTICE

Experimental mode until further notice. XIXOUT is experimental community software, not a financial service. Synthetic DEMO data in the public preview is distinct from real external tokens.

To the maximum extent permitted by applicable law, XIXOUT is provided in experimental mode on an “as is” and “as available” basis. It may contain errors and may be changed, restricted, suspended or discontinued at any time. To that same legally permitted extent, no warranty is given as to accuracy, completeness, availability, fitness for a particular purpose, uninterrupted operation or security. No content constitutes financial, investment, legal, tax or regulatory advice, an offer, a market, a licence, an approval or a third-party endorsement. Content or availability must not be relied on as the sole basis for any real-world decision.

No warranty. No right to rely.

To the maximum extent permitted by applicable law, the operator is not liable for indirect, consequential or purely economic loss arising from reliance on experimental content or temporary unavailability. Nothing in these terms excludes or limits liability that cannot lawfully be excluded or limited, including liability protected for consumers or weaker parties and liability for death or personal injury caused by negligence where applicable. The precise regime depends on the operator, the user, the governing law and the circumstances.

Pilot conditions

A confirmed operator does not replace professional review.

The operator is XIXOIO LTD; the confirmed, monitored contact for support, privacy and security is info@xixoio.com. The operator's pilot approval does not replace evidence of applicable legal, privacy, security and operational conditions or professional review of these drafts.

Mandatory review

EU/Czech counsel + DPO; UK counsel where in scope

This document is a product and compliance draft, not legal advice or approved final wording. Before an external pilot it requires review by qualified EU/Czech counsel and a DPO and, for UK users, by qualified UK counsel.

01controller identity and lawful basis for each purpose
02processors, transfers, retention and data-subject rights
03DPIA and privacy by design before the pilot

1. Status of this privacy information

The operator is XIXOIO LTD and the privacy contact is info@xixoio.com. This is a draft data map, not complete information under Articles 13 and 14 GDPR or UK GDPR. The precise processing roles of the operator and issuers, full identification details, any DPO, processors, lawful bases and retention periods still require evidence and professional review.

Until a DPO and qualified counsel confirm them and the information is available before collection, no external pilot or registration may begin. The operator is XIXOIO LTD; the confirmed, monitored contact for support, privacy and security is info@xixoio.com. The operator's pilot approval does not replace evidence of applicable legal, privacy, security and operational conditions or professional review of these drafts.

2. Intended categories of data

Data must be limited to what is necessary for a specified and explained purpose. A blockchain address is pseudonymous personal data. Private keys, seed phrases, payment data, KYC documents, biometrics, criminal-offence data and special-category data are outside the basic experiment and must not be collected secretly or speculatively.

01invitation and account: name, professional role, organisation, email and community-membership status
02access verification: native TOTP Authenticator factor, verification status and native session assurance; this flow requires no phone number or SMS and pairing secrets and codes are not stored in application logs
03pilot entitlement evidence: a minimal link between verified email, approved snapshot, access class, source fingerprint, status and validity, not a public holder list or the original portfolio contents
04optional token entitlement: pseudonymous address, network, challenge and evidence hashes, method, finalised block, threshold result and short validity; never a private key or exact balance
05security: time, IP address, device, sign-ins, permission changes, sessions and abuse records
06community: profile, posts, comments, reactions, reports, appeals and audited moderation actions
07support and development: feedback, diagnostics and evidence of accepting a document version

3. Purposes and lawful bases

Intended purposes are invitation and account administration, community access, optional short-lived token-scope verification, content display, security, reports, support and evidenced experiment development. Each purpose needs its own lawful basis, scope, recipients and retention.

Contract, legitimate interests, consent and legal obligation are not universal or interchangeable. Legitimate interests require a balancing test; consent must be freely given, specific, informed and withdrawable.

4. AI and automated processing

AI must not autonomously determine access, moderation, rights or regulatory status with significant effect. Assistive drafts require labelling, a limited mandate, human review and correction.

Before AI is enabled, the provider, inputs, purpose, retention, training, transfers, subprocessors, human oversight and individual rights must be documented. XOUT-AI-001 sets further conditions.

5. Recipients, processors and international transfers

Only roles and suppliers needed for an approved purpose and supported by documented authority may receive data. Recipient categories, named processors, processing locations and Article 28 GDPR terms must be documented before the pilot.

A transfer outside the EEA or UK requires a valid mechanism, assessment of destination law and supplementary safeguards. A supplier's location or cloud marketing statement is not a transfer mechanism.

6. Retention and erasure

Each category needs a defined period or objective criterion. Account content, security logs, moderation, backups and audit records must not be kept indefinitely. Data is securely deleted or irreversibly anonymised when the period ends unless law requires longer retention.

Erasure does not mean silently rewriting history. Personal identifiers may be pseudonymised while preserving a minimal, access-restricted record of a lawful action; the process must be explained and tested.

7. Individual rights and contact point

Privacy requests can be sent to the confirmed, monitored contact info@xixoio.com. The address alone does not demonstrate a complete requester-verification, deadline, export, rectification, erasure or response-record process; those operational procedures require evidence before the corresponding processing.

01access to data and processing information
02rectification of inaccurate and completion of incomplete data
03erasure or restriction where statutory conditions are met
04objection to legitimate-interests processing and withdrawal of consent without retrospective effect
05portability where applicable and complaint to the competent supervisory authority

8. Cookies, analytics and security

Until the regime is approved, only technically necessary session and authentication mechanisms should be used. Optional analytics, marketing identifiers or profiling require assessment, transparency and prior consent where applicable.

This document claims neither end-to-end encryption, anonymity nor certification. Controls must match the actual deployment and security evidence. The DPO must determine whether a DPIA is required before the pilot.