Privacy Policy

1. Who we are

XDanu Ltd is the data controller for personal data collected through this website. XDanu Ltd is a company registered in Ireland (Company No. 764461).

Address

The Freight Building, 63 Sheriff Street Upper, North Wall, Dublin 1 (D01 P3F4)

Email

contact@xdanu.com

Phone

(01) 482 1091

Please use the email address above for any privacy question or request.

2. Personal data we collect

Information you give us through our forms. Depending on the form you use, this may include:

• Contact and Film Desk enquiries: enquiry type, name, email address, company and your message.
• Culture House registration: name, work email, company and your message.
• Partnership applications: name, email address, business name, area of interest and your message.
• Tour requests: name, email address, company, preferred space and your message.
• Updates and newsletter requests: your email address.

Please do not include sensitive information (such as health, financial or login details) in free-text messages.

Technical information. When you use the site, our hosting and security providers automatically process technical data needed to deliver the site and protect it from abuse, such as your IP address, browser and device type, and request details. We also measure aggregate visitor activity — see section 5.

Emails and calls. If you contact us directly, we process the information contained in your communication.

3. How we use your data and our legal bases

• To respond to enquiries, tour requests, registrations and partnership applications — necessary to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR), or our legitimate interest in responding to business enquiries (Art. 6(1)(f)).
• To send updates or newsletters you request — your consent (Art. 6(1)(a)). You can unsubscribe or withdraw consent at any time.
• To protect the website and our forms from spam and abuse — our legitimate interest in keeping our services secure (Art. 6(1)(f)).
• To measure aggregate visitor numbers, devices and page performance — our legitimate interest in understanding how the site is used and keeping it fast and reliable (Art. 6(1)(f)). See section 5.
• To meet legal obligations and establish or defend legal claims — legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)).

Where we rely on legitimate interests, you have the right to object (see section 9). We do not use your data for automated decision-making or profiling, and we do not sell your personal data.

4. How form submissions are handled

When you submit a form, your information is sent securely to our server, checked for validity and spam (using Cloudflare Turnstile), and then emailed directly to our team at contact@xdanu.com. Submissions are not saved in a website database. Your email address is set as the reply-to address so we can respond to you.

5. Visitor analytics

We use the aggregate, cookie-free visitor analytics provided with our website hosting to understand how the site is used and how well it performs — for example, how many people visit, which pages they read, roughly which country they are in, whether they are on a phone or a computer, which site linked to us, how long pages take to load and whether anything breaks.

This analytics sets no cookies, stores nothing in your browser and does not follow you across other websites. Each visit is given a random reference that is discarded when the visit ends, so we see overall patterns rather than individual visitor profiles. The measurement is delivered from our own domain and is not shared with advertising or social media platforms. We do not record your screen or keystrokes.

We do this under our legitimate interest in operating, securing and improving the website (Art. 6(1)(f) GDPR), and you can object as described in section 9. We can switch this measurement off if it is no longer needed.

5a. Staff accounts

Members of our team who write journal articles have a staff account. For these accounts we hold a username, a name, a job title, an optional author photo and short biography, and a log of actions taken in the staff area (for example creating, editing, publishing or deleting articles and account changes), with the time they happened. Passwords are stored only in hashed form by our sign-in provider; we cannot see them. Signing in also keeps a session token in the browser so the staff member stays signed in.

We use this data to give staff secure access, show author names on published articles, and keep the site secure and accountable, under our legitimate interest in running and protecting the website (Art. 6(1)(f) GDPR). Account details are kept while the person has a staff account and removed or anonymised once it is closed, except where published articles continue to credit them as the author. The activity log is kept for as long as needed for security and accountability.

6. Who we share data with

We share personal data only with service providers that help us run the website and handle your enquiry, under contracts that require them to protect it:

• Lovable — website hosting, server processing and email delivery of form submissions.
• Cloudflare — Turnstile bot and spam protection on our forms (Turnstile privacy addendum).
• Our email and IT service providers — to receive, store and manage our business correspondence.
• Professional advisers and authorities — where required by law or to protect our legal rights.

7. International transfers

Some of our providers may process data outside the European Economic Area. Where this happens, we ensure appropriate safeguards are in place, such as an EU adequacy decision (including the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses. You can contact us for more information.

8. How long we keep data

• Enquiries and related correspondence: up to 24 months after our last contact with you, unless they lead to a contract, in which case we keep them for up to 7 years after that contract ends.
• Update and newsletter requests: until you unsubscribe or withdraw consent.
• Technical and security logs: kept by our providers for short periods according to their own retention policies.

When data is no longer needed, we delete or anonymise it.

9. Your rights

Under GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to our processing, including direct marketing;
• data portability;
• withdraw consent at any time, without affecting earlier processing.

To exercise these rights, email contact@xdanu.com. We will respond within one month, and may ask you to verify your identity. You also have the right to complain to the Irish Data Protection Commission at dataprotection.ie.

10. Security

We use appropriate technical and organisational measures to protect personal data, including encrypted (HTTPS) connections, server-side validation and spam protection, and access controls. Private service credentials are kept on our servers and never sent to your browser. No method of transmission over the internet is completely secure, but we work to protect your information.

11. Cookies

We do not use advertising, marketing or analytics cookies. The aggregate visitor analytics described in section 5 does not use cookies or browser storage. For details of the limited technologies the site does use, see our Cookie Policy.

12. Children

Our website and services are intended for adults and businesses. We do not knowingly collect personal data from anyone under 18.

13. Changes to this policy

We may update this policy from time to time. The “Last updated” date above shows when it was last changed. Significant changes will be highlighted on this website.