Privacy Policy of XEXPRESS
INTRODUCTION
As part of its activities, the company XEXPRESS collects and processes information, some of which is qualified as "personal data". XEXPRESS attaches great importance to respecting privacy and only uses data in a responsible and confidential manner and for a specific purpose.
The data collected is intended solely for the employees of XEXPRESS and its service providers. No transfer outside the European Union is made. Furthermore, no sensitive confidential data is collected. This data is stored and backed up securely (access identification, secure data, access traceability).
Our services are not intended for minor users. We do not knowingly collect information from children. If you are not of legal age, you must not access our services or provide us with information.
PERSONAL DATA
We only collect the data strictly necessary for the performance of our services. Below are the main methods we use to collect information:
- We collect information when you use the website Xexpress.com. When you visit our site, we may collect, gather, and store these uses, sessions, and related information.
- We collect the information you voluntarily provide to us. For example, we collect the information you provide to us when you make a quote request.
When accessing and browsing the website xexpress.com, two types of data may be collected:
-
Data transmitted directly
These are the data you directly transmit to us to contact the technical department, the administrative department, or to access the prices in our parts catalog. During registration, mandatory information is collected in the dedicated form, namely: "first name and last name," "email," and "phone number." Information related to your status as "Company" or "Individual" as well as your location (territorial) are also requested.
Once logged in, in order to respond to your requests (product information, quotes, orders), other information necessary for the processing of these requests may be required: "copy of registration document," "chassis number," "SIRET number," "VAT number," "Company Name," "Mailing Address," "Bank Account Number."
-
Data collected automatically
During your visits, we collect technical browsing data (IP address, pages viewed, referring page, visit duration, browser type and version) for audience-measurement and security purposes. This measurement is carried out in-house, server-side, without tracking cookies or any third-party advertising analytics tool. The processing is based on our legitimate interest (Article 6(1)(f) GDPR) in measuring traffic and protecting the site; you may object to it at any time (see "Your rights regarding your personal data").
DATA USAGE
We use your personal information for the following purposes:
- To provide and operate the offered services.
- To develop, customize, and improve our services.
- To process your information requests, quotes, orders, deliveries, and claims.
- To inform you about the status of your order and the tracking of your delivery.
- To respond to your feedback, inquiries, and requests and provide assistance.
- For internal statistical purposes.
- To enhance our data security and fraud prevention capabilities.
- To investigate potential violations, enforce our terms or policies, or comply with applicable laws, regulations, or government authorities.
- To occasionally send you promotional information or other information about our products.
Audience-measurement data is collected and processed in-house by XEXPRESS, the data controller, without any third-party analytics tool. It allows us to measure our website's traffic, views and any errors in order to continually improve the user experience. It is never transferred to a third party or used for purposes other than those detailed above, and is retained for a maximum of 90 days.
We will only use your personal information for the purposes defined in this Privacy Policy if:
- The use of your personal information is necessary to perform a contract or take steps to enter into a contract with you (e.g., to provide you with the services or customer or technical support).
- We need to use your personal information to comply with a relevant legal or regulatory obligation.
- We need to use your personal information for our legitimate interests as a business, provided that such use is at all times proportionate and respectful of your privacy rights.
We may share your information with our service providers to provide the expected services (e.g., storing information on third-party hosting services, providing technical support, sharing your phone and postal contact information for deliveries).
We may also disclose your information in the following circumstances: (i) to investigate, detect, prevent, or take action regarding illegal activities or other wrongdoing, suspicions of fraud, or security issues; (ii) to establish or exercise our rights of defense against legal claims; (iii) to protect our rights, property, or personal safety, as well as those of our users or the general public; (iv) if we or any of our affiliated companies undergo a change of control, including through a merger, acquisition, or purchase of all or substantially all of our assets; (v).
We will not share your email address or any other personal information with online advertising companies or advertising networks without your consent.
Under no circumstances do we disclose or share your information with third parties other than for legal reasons or at the request of competent and authorized authorities.
| Purpose | Detail | Data | Legal Basis | Retention Period | Data Recipients |
|---|---|---|---|---|---|
| Audience measurement | Measure site traffic and ensure its security (internal statistics). | IP address, pages viewed, referring page, visit duration, browser type and version. | Article 6(1)(f): processing is necessary for the legitimate interests pursued by the data controller. | 90 days | Data controller: Xexpress |
| Quick tariff consultation | Allow tariff consultation after registration on the Xexpress website. | Connection data (IP, type of device used). Functional cookies. Client status: professional or individual. Territorial location of the client (Country). |
Article 6(1)(f): processing is necessary for the legitimate interests pursued by the data controller (audience measurement, operation and security of the site). | 3 years | Data controller: Xexpress |
| Quotation | Allow the establishment of a quote for a customer taking into account their location. | First and last name. Connection data to the customer's account on the website and internal email address. Vehicle chassis number (optional). Phone number. Postal address and delivery address. |
Article 6(1)(f): The processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. | 3 years | Data controller: Xexpress / ABC Automotive / CGC Services |
| Order | Allow the customer to place an online order. | Article 6(1)(b): The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. | 10 years | Data controller: Xexpress | |
| Complaint and warranty | Allow the customer to exercise their rights of withdrawal, complaint, and warranty. | Customer's first and last name and postal address. Vehicle registration card. Repair invoices. |
Article 6(1)(b): The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Article 6(1)(c): The processing is necessary for compliance with a legal obligation to which the data controller is subject. | 1 year | Data controller: Xexpress |
| Communication | Inform the customer about the status of their order (from payment to delivery) via email, SMS, or phone. Inform the customer about Xexpress products. |
Order (first name, last name, postal address, delivery address, phone number, customer number) | Article 6(1)(f): The processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. | 10 years | Data controller: Xexpress / Mailjet |
| Delivery | Enable and track home delivery of customer orders | First and last name, delivery address, email, and phone number | Article 6(1)(b): The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. | 10 years | Data controller: Xexpress / Chronopost / Geodis France Express / DHL International / FedEx. |
LEGAL BASIS
Depending on the purpose, the processing of your data relies on one of the following legal bases: performance of the contract (orders, deliveries), compliance with a legal obligation, your consent where required, or our legitimate interest — in particular for audience measurement, operation and security of the site. The details for each purpose are set out in the table above. Where consent is required, it is obtained freely, clearly and unambiguously.
DATA RETENTION PERIOD
Please note that we retain the information we collect for as long as necessary to provide the services and to comply with our legal or contractual obligations to you, resolve disputes, and enforce our agreements, in accordance with our Terms and Conditions.
PROTECTION OF YOUR DATA
The hosting service of our website provides us with the online platform that allows us to provide you with access to our online store. Your data may be stored through data storage applications, databases, or general storage provided by our hosting provider. It stores your information on secure servers behind a firewall and offers secure HTTPS access.
All direct payment gateways offered by our service provider comply with the standards established by PCI-DSS, as managed by the PCI Security Standards Council, which is a joint effort of companies such as Visa, MasterCard, American Express, and Discover. PCI-DSS requirements help ensure the secure handling of credit card information by our online store and its service providers, including physical, electronic, and procedural measures.
Personal Information is retained, processed, and stored exclusively in Europe, in Belgium and France. We do not transfer any data outside the European Union.
We encourage you to set strong passwords and refrain from providing us or anyone with sensitive information that you believe may cause substantial or irreparable harm. Additionally, emails and instant messages are not recognized as secure forms of communication, so we ask and encourage you not to share sensitive information through these methods.
CHANGES OR UPDATES TO THE PRIVACY POLICY:
We may revise this privacy policy at any time, at our sole discretion, and the most current version will always be posted on our website (as indicated in the "Last Revised" section). We encourage you to regularly review this Privacy Policy to be informed of any changes. In case of significant changes, we will provide notice on our website to announce these changes. If you continue to use our services after being notified of modifications on our website, it will constitute your acknowledgment and consent to these changes in the Privacy Policy and your agreement to be bound by the terms of such modifications.
YOUR RIGHTS REGARDING YOUR PERSONAL DATA
You have the right to access, rectify, erase, object to, or be forgotten with respect to all your personal data. You can also withdraw your consent to the processing of your data.
This request can be made either:
- By email, from your customer account,
- By mail, to the following postal address: 510 Leuvensesteenweg Parc Horizon B3/19, 1930 ZAVENTEM - Belgium
- By directly accessing our online interface
Your request will be processed within the time limits imposed by the GDPR and the Data Protection Authority.
If, after contacting us, you believe that your "Information and Privacy" rights are not being respected, you can file a complaint with the Data Protection Authority by contacting the Data Protection Officer by phone: +32 2 274 48 00, by mail at the following address: Rue de la Presse 35 - 1000 Brussels, or by email:
commission@privacycommission.be