This is a translation. In case of discrepancy, the Spanish version prevails.

Privacy policy

Last updated: 13 November 2026

Data controller

We have not appointed a Data Protection Officer (it is not required for our activity).

What data we process and why

Sample requests. If you fill in the sample form, we process the data you give us (company, name, job title, email, phone, province, sector, type and size of business and your message), the date, the language and the page you send it from and, if you arrive through an advert, the campaign (utm parameters). We use them to review your request, send you the samples and the information for your sector and contact you about it. Legal basis: steps taken at your request before entering into a contract (art. 6.1.b GDPR).

Distribution enquiries. If you fill in the distributor form, we process the data you give us (company, tax ID, name, job title, email, phone, provinces covered, type of company, sectors, number of outlets or sales reps and your message) to assess a possible business partnership and reply to you. Legal basis: steps taken at your request before entering into a contract (art. 6.1.b GDPR).

Fields marked * are needed to process your request; without them we cannot send you samples or answer your distribution enquiry. The other fields are optional.

Marketing emails. Only if you tick the box will we send you X-1R marketing emails (news, offers and data sheets). Legal basis: your consent (art. 6.1.a GDPR and art. 21 LSSI). You can withdraw it at any time with the unsubscribe link in each email or by writing to [email protected], without affecting earlier emails.

Security and abuse prevention. When you visit the site, your browser sends your IP address and basic technical data to our hosting and network providers, who use them to serve and protect the page. To prevent form abuse we count submissions per visitor with an encrypted code derived from the IP address, which cannot be turned back into the IP and is deleted after one hour. Legal basis: legitimate interest in keeping the site secure (art. 6.1.f GDPR).

Visitor statistics. We count visits with Matomo, an open-source tool hosted on our own server, without cookies. Before storing anything we remove the last two blocks of your IP address, so we cannot identify you. Legal basis: legitimate interest in knowing how the site is used and which adverts work (art. 6.1.f GDPR).

We do not make automated decisions or create profiles.

Cookies and local storage

This site does not set its own or third-party cookies for analytics or advertising. Our network provider, Cloudflare, may set a strictly necessary security cookie to tell people from bots, which does not require consent. If you choose a language or close the language notice, your browser remembers it in its own local storage; this is not a cookie and is not sent to us.

How long we keep data

• Sample requests and distribution enquiries: up to 24 months from the last contact, unless you become a customer or distributor (then for the duration of the relationship and the legal periods).
• Consent to marketing emails: until you withdraw it.
• Visitor statistics: detailed records are deleted after 13 months; only totals are kept.

Recipients

We do not sell your data. We only share it with:

• AS Baltoil (Estonia), our parent company, which manages X-1R sales in Europe. It receives requests to handle them and, where appropriate, to sell you the products directly, and processes the data as an independent controller for the same purpose and on the same legal basis.
• The official X-1R distributor for your area, if there is one: we pass on your contact details and your request so they can serve you directly. The distributor processes them as an independent controller for that purpose.

In addition, the following process data on our behalf under a data processing agreement:

• Namecheap, Inc. (USA): hosting of the site, the requests and email.
• Cloudflare, Inc. (USA): DNS, delivery and protection of the site.

Transfers to the USA are based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. You can ask for a copy of the safeguards by writing to [email protected].

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to [email protected]. We will reply within one month. You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es) or the Estonian data protection authority (aki.ee).