Skip to content

Privacy Policy

Última actualización: October 1, 2026

This Privacy Policy explains how XKEMA collects, uses, stores, shares and protects personal data when you access or use our website, platform, applications and related services.

1. Data controller

The data controller responsible for the processing of personal data described in this Privacy Policy is XKEMA.

If XKEMA operates through a legal entity, the corresponding corporate identification details may be added or updated in this Privacy Policy.

2. This website: xkema.com

Sections 3 to 18 describe XKEMA as a whole, including the XKEMA platform. This section describes only this website, xkema.com, and it is the one that applies if all you do here is read these pages, leave your email or send a message.

2.1 Requesting access, and the contact form

When you submit the Request access form, we store the email address you type, together with the following acquisition data:

  • Source path: the page of this website you submitted the form from, as a path and without the query string, for example /en/features/.
  • Referrer: the address of the page that linked you here, when your browser sends it and it is external to this website.
  • UTM source, UTM medium and UTM campaign: the utm_source, utm_medium and utm_campaign parameters, when the link you arrived through carried them.
  • The date and time of the submission.

That acquisition data tells us which page and which campaign a request came from. It is not used to build a profile of you, and it is not shared with anyone for advertising.

Submitting the form does not create a user account. This website cannot create accounts: there is no registration here. Your email address is added to a list of people who have asked for access, and granting access is a separate, manual step that happens on the platform.

We use the email address to contact you about XKEMA: to reply to you, to answer what you asked, and to let you know when access is available for your team. There is no newsletter and no third-party advertising.

The Contact form additionally stores the name, the company and the reason you select, and the message you write. Each submission also generates an internal notification email to XKEMA, sent through the email provider configured on our server.

No IP address, browser user-agent or device fingerprint is stored with a request submitted through either form.

2.2 Analytics on this website

This website measures its own traffic, with its own code and its own database. It does not load Google Analytics, Google Tag Manager, advertising pixels, CAPTCHA services or any other third-party script. For each page load it records the path, the language the page was served in, the domain that linked to it, the same three UTM parameters described above, and the date and time. It does not record your IP address, and it does not record page loads in the internal panel, in the Django admin, or by programs that identify themselves as crawlers.

To count a visit as one visit rather than five, a random value is stored in a first-party cookie named xk_v. It is HttpOnly, it expires after 30 minutes without activity, and it identifies nothing beyond that sequence of page loads. The choice you make in the cookie banner is stored in a cookie named xk_analytics, for up to 180 days; if you decline, no page loads are recorded. The same applies if your browser sends a Do Not Track or Sec-GPC signal, which this website honours. See the Cookies Policy.

2.3 Booking a demo

Our demo page shows the times we have open and the booking is completed on this website: no third-party scheduling service is involved, and nothing is loaded from one. When you book a demo we store:

  • the name, company and work email address you enter, and the role if you give one;
  • whatever you write in the optional field about what you would like to solve;
  • the date, time, duration and time zone of the appointment.

We use it to hold the appointment and to contact you about that demo — to send you the video-call link, or to agree another time. You receive a confirmation email at the address you entered, and an internal notification is sent to XKEMA through the email provider configured on our server. Booking a demo does not create a user account either.

The confirmation page is identified only by a random reference, and because a reference in a link is not an access control, it shows your email address partly hidden.

2.4 How long this data is kept

Access requests, contact messages and demo bookings are kept until we delete them. There is no automatic deletion: no retention period is enforced by this website's code for these records. We delete them when they are no longer needed for the purpose described in section 2.1, and you can ask us to delete yours at any time by writing to info@xkema.com, as described in section 13.

Page-view records are deleted 400 days after they are recorded, by a scheduled maintenance task on our server. The aggregate figures shown in our internal panel look back at most 30 days; the longer window exists only to allow comparison with the same month of the previous year.

3. Personal data we may collect

Depending on how you interact with XKEMA, we may collect and process the following categories of personal data:

  • Identification and contact data: name, surname, company, professional role, email address and other contact details provided by you.
  • Account data: username, authentication credentials, account settings, team memberships, permissions, subscription or licence information.
  • Technical data: IP address, browser type, device information, operating system, language, access logs, timestamps, security events and diagnostic information.
  • Usage data: pages visited, actions performed, features used, interaction data, analytics events and performance metrics.
  • User content and project data: files, documents, component data, BOMs, requirements, comments, engineering documentation, metadata and other information uploaded or generated within the platform.
  • Communications data: messages, contact form submissions, support requests, feedback, demo requests and related correspondence.
  • Billing and commercial data: where applicable, subscription status, invoicing details, payment status, plan information, purchase history and related commercial records.

4. How we collect personal data

We collect personal data directly from you, automatically through your use of the website or platform, and from third-party service providers where necessary for the operation of XKEMA.

  • When you create an account or log in.
  • When you complete a contact, demo or support form.
  • When you upload, create or manage content within the platform.
  • When you interact with our website, emails or services.
  • When cookies or similar technologies are used in accordance with our Cookies Policy.

5. Purposes of processing

XKEMA processes personal data for the following purposes:

  • To provide, operate, maintain and secure the XKEMA platform.
  • To create and manage user accounts, teams, roles, permissions and licences.
  • To store, process and display user content and project documentation.
  • To provide technical support, respond to enquiries and manage communications.
  • To improve usability, performance, reliability and product functionality.
  • To detect, prevent and respond to abuse, fraud, unauthorised access or security incidents.
  • To comply with legal, tax, accounting and regulatory obligations.
  • To manage subscriptions, billing, payments and commercial relationships where applicable.
  • To send service-related notices and essential communications.
  • To send optional marketing communications only where legally permitted or with your consent.

6. Legal basis for processing

We process personal data on the following legal bases, depending on the context:

Purpose Legal basis
Providing access to the platform and services Performance of a contract or pre-contractual measures
Account, licence, team and permission management Performance of a contract / legitimate interest
Security, abuse prevention and access logs Legitimate interest / legal obligation
Contact forms, demo requests and support communications Consent / pre-contractual measures / legitimate interest
Analytics and non-essential cookies Consent
Billing, accounting and tax records Legal obligation / performance of a contract
Service updates and essential notices Legitimate interest / performance of a contract
Optional marketing communications Consent or legitimate interest where legally permitted

7. User content and engineering data

XKEMA is designed for hardware engineering workflows. Users may upload or generate technical documentation, BOMs, component information, files, requirements, comments, project metadata and other engineering-related content.

Users remain responsible for ensuring that they have the necessary rights, permissions, confidentiality authorisations and legal basis to upload and process such content through XKEMA.

XKEMA processes user content only to provide, maintain, secure and improve the services, subject to the applicable Terms of Service and any contractual agreements in place.

8. Data recipients and service providers

We do not sell personal data.

Personal data may be shared with or processed by trusted service providers when necessary for the operation of XKEMA, including:

  • Cloud hosting and infrastructure providers.
  • Database, storage and backup providers.
  • Email and transactional communication providers.
  • Security, monitoring and logging providers.
  • Analytics providers, where consent has been granted.
  • Payment and billing providers, where applicable.
  • Professional advisers, legal or accounting providers where necessary.
  • Public authorities, courts or regulators where legally required.

Such providers process data under appropriate contractual, confidentiality and data protection obligations where required.

9. Third-party services

XKEMA may use third-party services necessary for platform operation, security, communications, analytics or infrastructure.

These may include, depending on the active configuration:

This website uses first-party analytics only. It does not load Google Analytics, advertising pixels, CAPTCHA services or any other third-party script, and it does not store visitors' IP addresses.

  • Cloud hosting providers.
  • Object storage providers.
  • Email delivery providers.
  • Payment processors, where paid plans are available.

10. International data transfers

Some service providers may process personal data outside the European Economic Area.

Where international transfers occur, XKEMA endeavours to ensure that appropriate safeguards are implemented in accordance with applicable data protection laws, such as European Commission adequacy decisions, Standard Contractual Clauses or equivalent lawful mechanisms.

11. Data retention

XKEMA retains personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, enforce agreements and maintain platform security.

The retention periods that apply to data collected through this website are the ones stated in section 2.4, which prevail over the general descriptions below.

Retention periods may vary depending on the type of data:

  • Account data: retained while the account remains active and for a reasonable period thereafter.
  • User content: retained according to the account, workspace, subscription or contractual settings.
  • Security logs: retained for a limited period necessary for security and abuse prevention.
  • Billing and tax records: retained for the legally required period.
  • Analytics data: retained according to the applicable analytics configuration and consent settings.
  • Cookie consent records: generally retained for up to 180 days unless withdrawn earlier.

12. Security measures

XKEMA applies reasonable technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include access controls, authentication, encryption in transit where applicable, logging, monitoring, infrastructure protections and role-based permissions.

However, no internet-based service can guarantee absolute security. Users must also take appropriate measures to protect their accounts, credentials and uploaded information.

13. Your data protection rights

Subject to applicable law, you may exercise the following rights:

  • Access: to know whether we process your personal data and obtain a copy of it.
  • Rectification: to request correction of inaccurate or incomplete data.
  • Erasure: to request deletion of your personal data where legally applicable.
  • Restriction: to request limitation of processing in certain circumstances.
  • Objection: to object to processing based on legitimate interests.
  • Portability: to receive personal data in a structured, commonly used and machine-readable format where applicable.
  • Withdraw consent: to withdraw consent at any time where processing is based on consent.

You may exercise your rights by contacting us at: info@xkema.com.

We may request additional information to verify your identity before responding to a rights request.

14. Right to lodge a complaint

If you believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.

In Spain, the competent authority is the Spanish Data Protection Agency, Agencia Española de Protección de Datos, AEPD.

15. Children

XKEMA is intended for professional and business use. It is not directed to children or minors, and we do not knowingly collect personal data from children.

16. Cookies and similar technologies

XKEMA uses cookies and similar technologies as described in our Cookies Policy.

You can manage your cookie preferences through the cookie settings available on the website.

17. Changes to this Privacy Policy

XKEMA may update this Privacy Policy from time to time to reflect legal, technical, operational or business changes.

Material changes may be notified through the website, platform notifications or other appropriate means.

18. Contact

For privacy-related questions, requests or communications, you may contact XKEMA at: