GDPR Privacy Policy.

For individuals in the EEA, the UK, and Switzerland

EFFECTIVE DATE · August 5, 2026

If you are outside the European Economic Area, the United Kingdom and Switzerland, our US Privacy Policy applies to you instead. Privacy Policy

Introduction and Scope

Your privacy is important to XS. This GDPR Privacy Policy (this "Policy") explains how XS ("we," "us," or "our") collects, uses, shares, and protects personal data relating to individuals located in the European Economic Area ("EEA"), the United Kingdom ("UK"), and Switzerland in connection with:

the XS website and platform at https://xs.global (the "Site");
XS Origination, XS Portfolio, XS Reporting, and the other features of the XS platform available under your subscription;
our operating professionals program, where included in your plan; and
our marketing communications, events, and other interactions with you.

We refer to all of these together as the "Services." This Policy is written to meet the requirements of the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection. If you are located outside the EEA, the UK, and Switzerland, our US Privacy Policy applies to you instead.

This Policy also applies to individuals whose personal data we obtain from sources other than the individual, such as professionals at companies and firms whose publicly available business information appears in XS Content. Section 4 explains where we obtain such data.

Who We Are and How to Contact Us

The controller of your personal data is:

XS46164 Westlake Dr, PO Box 650061, Sterling, VA 20165Email: privacy@xs.global

We have not appointed a Data Protection Officer. Privacy matters are handled by our Compliance Officer, who can be contacted at privacy@xs.global. We have not appointed a representative in the EU or UK under Article 27 GDPR.

2.1 Controller and Processor Roles

For personal data that we collect through the Site, your account (such as your registration and billing details), and our communications with you, XS acts as the controller. For personal data that you or your organization enter into or upload to the Services, such as contacts, deal notes, pipeline information, and portfolio company data ("Customer Data"), you or your organization is the controller and XS acts as a processor on your behalf. Our processing of Customer Data is governed by our Terms & Conditions and our Data Processing Addendum rather than by this Policy, except where this Policy expressly states otherwise.

Personal Data We Collect

Depending on how you interact with the Services, we may collect the following categories of personal data:

Identity and contact data: name, job title, firm or organization, business email address, telephone number, business address, and professional profile links (such as LinkedIn).
Account and subscription data: username, password (stored in hashed form), XS plan, subscription and renewal history, communication preferences, and account settings.
Payment data: billing name and address and limited payment details. Full payment card numbers are collected and processed by our third-party payment processor and are not stored by XS.
Professional and market data: information about your professional role and your firm's investment focus, sectors, geography, and similar business information, including information compiled from publicly available sources.
Configuration data: the investment criteria and settings you configure in the Services and the data sources you connect.
Content you provide: messages you send us, support requests, and feedback.
Technical and usage data: IP address, device and browser type, operating system, referring pages, pages viewed, links clicked, time spent on the Services, email open and click activity, platform usage logs, and data collected through cookies and similar technologies (see Section 11).

Special categories of personal data. We do not seek to collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, or genetic or biometric data), and we do not collect personal data relating to criminal convictions or offences.

Where We Obtain Personal Data

We obtain personal data from the following sources:

Directly from you, when you register for an account, purchase a subscription, configure the Services, or contact us.
Automatically, through your use of the Services, by means of server logs, cookies, and similar technologies.
From publicly available sources, including company websites, press releases, regulatory filings, professional networking sites, news publications, and industry databases, which we use to compile market maps, company profiles, and research.
From third parties, including data providers, payment processors, systems that you or your organization connect to the Services, and your colleagues (for example, when an administrator at your organization adds you as an authorized user).

Where we obtain your personal data from a source other than you, we will provide you with the information required by Article 14 GDPR within a reasonable period, and in any event no later than the first time we communicate with you, unless doing so is impossible or would involve a disproportionate effort, in which case this Policy serves as that notice.

Purposes and Lawful Bases for Processing

We process your personal data only where we have a lawful basis to do so under Article 6 GDPR. The table below describes the purposes for which we process personal data and the lawful basis we rely on for each.

Purpose of processing	Lawful basis
To create and administer your account, provide the Services you have requested, and manage your subscription, including billing and renewals.	Performance of a contract with you, or steps taken at your request before entering into a contract.
To process payments and maintain financial records.	Performance of a contract; compliance with legal obligations (including tax and accounting laws).
To compile, maintain, and present market maps, company profiles, scores, and analytics, which make business information about companies and market participants available to subscribers.	Our legitimate interests in providing market intelligence to investment professionals, balanced against your interests and rights. We limit this processing to professional and business-related information. You may object at any time (see Section 9).
To conduct research and to publish aggregated findings.	Our legitimate interests in producing market research.
To send you product updates and other marketing communications about XS features, research, events, and Services.	Your consent, where required by law; otherwise our legitimate interests in promoting our Services to existing customers and to business contacts, subject to your right to opt out at any time.
To make operating professionals available to you, where included in your plan.	Performance of a contract with you.
To operate, maintain, secure, and improve the Services, including analytics, troubleshooting, and product development.	Performance of a contract; our legitimate interests in maintaining and improving the Services.
To protect the security and integrity of the Services, to detect and prevent fraud, abuse, and violations of our Terms & Conditions, and to enforce our rights.	Our legitimate interests in protecting the Services, our users, and our business; compliance with legal obligations.
To respond to your enquiries and requests, including requests to exercise your data protection rights.	Performance of a contract; compliance with legal obligations; our legitimate interests in responding to you.
To comply with applicable laws, regulations, court orders, and requests from governmental authorities.	Compliance with legal obligations.
In connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business.	Our legitimate interests in conducting and completing such a transaction.

Where we rely on legitimate interests, we have carried out a balancing assessment to ensure that our interests are not overridden by your interests or fundamental rights and freedoms. You may request further information about our assessments by contacting us.

How We Share Personal Data

We share personal data in the following circumstances:

Within your organization. Information in your account, and Customer Data, is visible to the other authorized users of your organization's account in accordance with the permissions your organization configures.
With service providers acting as our processors, including providers of cloud hosting, data storage, email delivery, payment processing, customer relationship management, analytics, customer support, and IT security. These providers may access personal data only to perform services for us and are contractually required to protect it.
With operating professionals engaged by XS to work with your organization, where included in your plan, and only to the extent necessary for them to provide those services to you.
With our professional advisers, including lawyers, accountants, auditors, and insurers, where necessary for them to provide their services.
With our affiliates, for the purposes described in this Policy.
With governmental authorities, regulators, courts, and law enforcement, where required by law, regulation, or legal process, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
With a successor or acquirer, in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to appropriate confidentiality protections.

We do not sell personal data to third parties for their own marketing purposes.

International Transfers

XS is based in the United States, and personal data we collect is stored and processed in the United States and may be processed in other countries where we or our service providers operate. These countries may not provide the same level of data protection as the EEA, the UK, or Switzerland.

To the extent your personal data is transferred to countries outside of the EEA, the UK, or Switzerland, such transfers will only be made in accordance with applicable data privacy laws. For further information about the safeguards or derogations used, please contact our Compliance Officer at privacy@xs.global.

Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, and reporting requirements, and to resolve disputes and enforce our agreements. In general:

account and subscription data is retained for the life of your account and for 7 years thereafter;
Customer Data is retained for the subscription term and the export period described in our Terms & Conditions, after which it is deleted in accordance with our Data Processing Addendum;
compiled company and professional information is retained for as long as it remains relevant, or until we receive and act on a valid request for removal;
marketing data is retained until you unsubscribe or object, after which we retain a suppression record to ensure we honour your choice;
financial and transaction records are retained for the period required by applicable tax and accounting laws; and
technical and usage logs are retained for 12 months.

We may retain aggregated or anonymized data, which does not identify you, for research and analytics purposes indefinitely.

Your Rights

Subject to applicable law and certain exceptions, you have the following rights in relation to your personal data:

Access: to obtain confirmation of whether we process your personal data and, if so, to receive a copy of it together with certain information about our processing.
Rectification: to have inaccurate personal data corrected and incomplete personal data completed, including business information about you that appears in XS Content.
Erasure: to have your personal data deleted in certain circumstances, including where it is no longer necessary for the purposes for which it was collected or where you have withdrawn consent or objected to processing.
Restriction: to have the processing of your personal data restricted in certain circumstances, such as while the accuracy of the data is being verified.
Data portability: to receive personal data that you have provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means.
Objection: to object at any time to processing based on our legitimate interests, including the inclusion of your professional information in XS Content, and to object at any time to processing for direct marketing purposes.
Withdrawal of consent: to withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before withdrawal.
Automated decision-making: not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects concerning you. See Section 10.

9.1 How to Exercise Your Rights

You may exercise these rights by contacting us at privacy@xs.global or at the postal address in Section 2. You may also unsubscribe from marketing emails using the link included in each email, and you may update much of your account information directly through your account settings.

We may need to verify your identity before responding to a request. We will respond within one month of receipt, although this period may be extended by up to two further months where requests are complex or numerous, in which case we will inform you. We do not charge a fee for responding to requests unless a request is manifestly unfounded or excessive.

9.2 Right to Lodge a Complaint

If you have concerns about our processing of your personal data, we encourage you to contact us first so that we can try to resolve them. You also have the right to lodge a complaint with a supervisory authority. In the EEA, this is the data protection authority in the member state of your habitual residence, place of work, or the place of the alleged infringement. In the UK, this is the Information Commissioner's Office (ico.org.uk). In Switzerland, this is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

Automated Decision-Making and Profiling

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The Services generate scores, rankings, alerts, draft materials, and other outputs about companies, firms, and market activity; these outputs are tools that support decisions made by our users and are not automated decisions by XS about you. We may use profiling in a limited way to personalize content and communications, which you may object to at any time.

Cookies and Similar Technologies

We use cookies, pixels, and similar technologies on the Site and in our emails. These fall into the following categories:

Strictly necessary technologies, which are required to operate the Services, keep you logged in, and maintain security. These do not require your consent.
Functional technologies, which remember your preferences and settings.
Analytics technologies, which help us understand how the Services are used so that we can improve them, and which may be provided by third parties such as Google Analytics.
Marketing technologies, including email open and click tracking, which help us measure the effectiveness of our communications.

Where required by law, we will ask for your consent before placing non-essential cookies and similar technologies, and you may withdraw or change your consent at any time through the cookie settings on the Site. You can also control cookies through your browser settings, although disabling certain cookies may affect the functionality of the Services.

Security

We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include encryption of data in transit, access controls, secure hosting, and staff training. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential.

Children

The Services are intended for business professionals and are not directed to individuals under 18 years of age. We do not knowingly collect personal data from anyone under 18. If you believe we have collected personal data from a minor, please contact us so that we can delete it.

Third-Party Websites and Platforms

The Services may contain links to third-party websites and may be integrated with third-party platforms and systems. This Policy does not apply to the practices of third parties, and we encourage you to review their privacy policies before providing personal data to them.

Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we do, we will revise the Effective Date at the top of this Policy and, where the changes are material, we will provide additional notice, such as by email or by a prominent notice on the Site. We encourage you to review this Policy periodically.

Contact Us

If you have any questions about this Policy or our data protection practices, or if you wish to exercise your rights, please contact us at:

XS46164 Westlake Dr, PO Box 650061, Sterling, VA 20165Email: privacy@xs.globalAttention: Compliance Officer