XPRO CONSULTING

Privacy Notice

Effective date: 29 September 2026

Xpro Consulting respects your privacy. This Privacy Notice explains how personal data is processed when you visit the website, contact Xpro Consulting, submit an enquiry or interact with Xpro Consulting in a business context.

1. Controller and contact details

For the processing described in this Privacy Notice, Xpro Consulting acts as controller where it determines the purposes and means of processing.

Xpro Consulting

Hofplein 20

3032 AC Rotterdam

The Netherlands

Email: info@xpro-consulting.nl

Registered legal name: Xpro Consulting VOF

KvK number: 76535231

2. Personal data we may process

Depending on how you interact with Xpro Consulting, we may process:

• identification and contact details, such as name, business email address, telephone number, job title and organisation;

• information you provide in an enquiry, correspondence, meeting or other business communication;

• client, prospect, supplier and professional-contact information;

• information required to prepare, enter into and administer an engagement or contract;

• billing, payment and transaction-administration information where relevant;

• technical and security information generated through normal website operation, such as IP address, browser/device information and server logs, where collected by our hosting or security infrastructure;

• other personal data you voluntarily provide and that is relevant to the purpose for which you contact us.

Please do not provide special-category or other highly sensitive personal data through the website unless this is necessary and has been specifically requested.

3. Purposes and legal bases

We may process personal data to:

• respond to enquiries and communicate with you;

• assess, prepare, enter into and perform advisory or consulting engagements;

• maintain professional and business relationships;

• administer contracts, invoices and records;

• protect the security and proper functioning of our website and systems;

• establish, exercise or defend legal claims;

• comply with legal, regulatory, tax, accounting or other obligations.

Depending on the circumstances, processing is based on taking steps at your request before entering into a contract or performance of a contract, compliance with a legal obligation, our legitimate interests in operating and protecting our business and maintaining professional relationships, or consent where consent is the appropriate legal basis.

4. Website enquiries

The current Xpro Consulting website uses an email-based enquiry form. When you use it, the information you enter is used to prepare an email addressed to info@xpro-consulting.nl through your email application. We use the information received to respond to your enquiry and, where relevant, to take steps towards a possible engagement.

5. Sources of personal data

We normally receive personal data directly from you. In a business context, we may also receive relevant professional contact information from your employer or organisation, business partners, advisers, counterparties, public professional sources or other legitimate sources. Where the GDPR requires additional information because data was obtained indirectly, we will provide that information as required.

6. Sharing personal data

We do not sell personal data. We may share personal data where reasonably necessary with service providers that support our IT, hosting, communications, administration or professional operations; professional advisers such as lawyers, accountants or auditors; counterparties or other parties involved in an engagement where appropriate; and public authorities or regulators where disclosure is required by law. Where a processor acts on our behalf, we seek to use appropriate contractual and organisational safeguards.

7. International transfers

If personal data is transferred outside the European Economic Area, Xpro Consulting will use an appropriate transfer mechanism where required by the GDPR, such as an adequacy decision or approved contractual safeguards. The actual transfer arrangements depend on the service providers and systems used by Xpro Consulting and should be reviewed whenever those providers change.

8. Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting, tax, contractual and evidentiary requirements. Retention periods therefore vary by category of data and relationship. Enquiries that do not lead to an engagement will not be kept longer than reasonably necessary for follow-up and legitimate business administration, unless a longer period is required by law or necessary for legal claims.

9. Security

Xpro Consulting takes appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. No internet or email transmission can, however, be guaranteed to be completely secure.

10. Your privacy rights

Subject to the conditions and exceptions in the GDPR, you may have the right to request access to your personal data, rectification, erasure, restriction of processing, data portability and objection to certain processing. Where processing is based on consent, you may withdraw that consent for the future.

To exercise a privacy right, contact info@xpro-consulting.nl. We may request information reasonably necessary to verify your identity before acting on a request.

11. Complaints

If you have concerns about our processing of personal data, please contact us first so that we can address them. You also have the right to lodge a complaint with the competent supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.

12. Automated decision-making

Xpro Consulting does not currently use the website to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. If this changes, this Privacy Notice will be updated as required.

13. Cookies and similar technologies

This Privacy Notice does not state that Xpro Consulting uses analytics, advertising or tracking cookies because that should only be stated after confirming the technologies actually deployed on the live website. If non-essential cookies, analytics or tracking technologies are introduced, Xpro Consulting should implement an appropriate cookie notice/consent mechanism and update this Privacy Notice accordingly.

14. Changes to this Privacy Notice

We may update this Privacy Notice when our services, website, data processing or legal obligations change. The current version should be published on the website with its effective or last-updated date.