Data Protection & GDPR Policy
Data-protection rights and procedures for individuals whose personal data is processed by X2.
1. Purpose
This Policy explains how individuals can exercise data-protection rights and how X2 handles controller and processor responsibilities under applicable data-protection law, including the GDPR where it applies.
2. Controller and Processor Roles
X2 acts as controller for its own account, security, billing, fraud-prevention, compliance and service operations. X2 may act as processor when a business customer determines the purposes and means of processing and X2 processes data on documented instructions.
3. Access and Rectification
Eligible individuals may request access to personal data concerning them and correction of inaccurate or incomplete information, subject to identity verification and lawful limitations.
4. Erasure
Individuals may request deletion where applicable. X2 may retain information where required for tax, accounting, fraud prevention, rights history, security, legal claims or other lawful purposes.
5. Restriction, Portability and Objection
Where the applicable legal conditions are met, individuals may request restriction, receive portable data or object to certain processing.
6. Consent Withdrawal
Where processing is based on consent, consent may be withdrawn for future processing. Withdrawal does not affect processing lawfully carried out before withdrawal.
7. Automated Decision-Making
Where applicable law grants rights regarding solely automated decisions producing legal or similarly significant effects, X2 will provide the required safeguards. Detection systems may generate review flags without automatically constituting final enforcement findings.
8. Connected Platforms
Data received from connected platforms is processed according to the user's authorization, X2's role and applicable provider rules. Revoking a connection stops future authorized access but does not automatically require deletion of records X2 must lawfully retain.
9. Verification of Requests
X2 may request information necessary to verify the identity and authority of a person making a data-rights request and may reject manifestly unfounded, excessive or unauthorized requests to the extent permitted by law.
10. Representatives
A representative may act for an individual where valid authority is established.
11. Other Rights Holders
A privacy request does not automatically override the rights, records or legitimate interests of other people. X2 may redact or limit disclosure where necessary to protect others.
12. Rights and Financial History
Historical rights, royalty, fraud, tax and payment records may need to be retained even when other account data is deleted, where there is a lawful basis for retention.
13. International Transfers and Security
X2 applies appropriate transfer safeguards where required and uses reasonable technical and organizational security measures.
14. Complaints
Individuals may contact privacy@x2records.com and, where applicable, lodge a complaint with a competent data-protection authority.