Privacy

1. Introduction, Controller and Scope

1.1 Who operates XValue

XValue is a marketplace for the listing, discovery and potential sale of digital assets. XValue is a product of XOSPACE. For the purposes of this Privacy Policy, the operator is شركة فضاء اكسو لتقنية المعلومات (XOSPACE), registered in the Kingdom of Saudi Arabia under Commercial Registration No. 7031231322, with its registered address in Riyadh, Saudi Arabia (the “Operator”, “XOSPACE”, “we”, “us” or “our”). Official registration and legal-name details are subject to verification before publication.

1.2 What this Policy covers

This Policy describes the personal data we collect, how and why we use it, when it is shared, how it is protected and retained, and how individuals may exercise privacy rights. It covers the XValue website, accounts, listings, marketplace communications, support requests, and other XValue services that link to this Policy. It also covers communications with XOSPACE about XValue and interactions with XValue advertising where we collect personal data.

1.3 Independent services and other users

Some payment, escrow, verification, hosting or other services may be operated by independent providers with their own privacy notices. Buyers and Sellers may also process information they receive from one another for their own transaction purposes. This Policy covers XOSPACE’s own processing; it does not replace another party’s privacy notice or responsibility under applicable law. Where third parties process information on our behalf, we remain responsible for our own obligations under applicable data-protection law.

1.4 Applicable law

We process personal data in accordance with applicable law, including the Saudi Personal Data Protection Law (PDPL) and its implementing regulations, and other data-protection laws where they apply, including the EU/EEA General Data Protection Regulation (GDPR). The rights and lawful grounds described below apply according to the relevant jurisdiction and processing activity. This Policy is provided as a privacy notice and does not waive mandatory legal rights.

2. Personal Data We Collect and How We Collect It

2.1 Categories of personal data

2.2 Where the data comes from

We collect information (a) directly from you when you register, create listings, message other users, initiate or complete transactions, or contact support; (b) automatically from your device or interactions with the Platform; (c) from other users who communicate with you or identify you in transaction materials; and (d) from payment, escrow, analytics, security or other business partners only when relevant, lawfully supplied and needed for a stated purpose.

2.3 Required and optional information

Certain information, such as an email address and basic registration details, is required to create an account. Sellers must provide enough information to describe the asset offered and demonstrate their authority where requested; Buyers must provide the details necessary for inquiries and the relevant transaction. Optional profile details, extra supporting documents, marketing subscriptions and any optional integrations may be declined, although related features may then be unavailable. Where a specific field is legally or contractually required, we will identify that requirement at collection.

2.4 Personal data in listings and messages

Information posted in public listings may be visible to Platform visitors. Information sent through marketplace communications may be seen by intended recipients and authorized Platform personnel as needed for support, safety and lawful operations. Before sharing customer records, source materials, financial documents or personal data relating to others, users must assess whether they have a lawful basis and appropriate safeguards. Do not upload passwords, full payment-card numbers, sensitive credentials or unnecessary third-party personal data.

2.5 Payment information and optional integrations

Payments and escrow may be handled by independent providers made available for a particular transaction. Those providers may collect payment details directly under their own terms and privacy notices. XOSPACE may receive transaction confirmations, status and reference information needed to administer a deal. XValue does not claim that every integration described in earlier materials is currently active. If an optional external-account integration becomes available, its data categories, permissions, provider identity, purpose and withdrawal method will be explained before activation.

3. Purposes of Processing and Legal Bases

We collect and use personal data for the specific purposes below. The relevant lawful basis depends on the data, the service used, applicable law, and whether the individual has agreed to an optional activity.

Where processing relies on consent, you may withdraw that consent using the method offered for the relevant activity or by contacting [email protected]. Withdrawal does not affect processing carried out lawfully before withdrawal and does not prevent processing required under another lawful ground.

We do not rely on your continued use of the Platform alone as consent to optional marketing or non-essential tracking. We will provide relevant choices and notices where required by applicable law.

4. Disclosure of Personal Data and Third Parties

4.1 Who may receive data

Other marketplace users: public listing information, and information you choose to disclose to Buyers, Sellers or other authorized participants during negotiations and transfer.

Authorized Brokers: relevant contact, listing and transaction information only when a Broker is engaged or authorized to assist with a specified activity, subject to appropriate obligations.

Payment, escrow and verification providers: information needed for a transaction, provider eligibility and lawful processing, according to the provider’s terms and responsibilities.

XOSPACE vendors and contractors: services such as hosting, security, support, communications and analytics, subject to relevant confidentiality, security and contractual safeguards.

Regulators, courts and competent authorities: information when legally required or otherwise lawfully justified for investigations, compliance, claims and safety.

Corporate successors: data needed for a lawful merger, restructuring or transfer of a relevant business, subject to applicable notices, confidentiality and legal obligations.

4.2 User-directed disclosure and public content

If you publish information in a listing or intentionally share information with another user, that recipient may make independent decisions about its use. Do not disclose information you are not entitled to share. XOSPACE will limit its own disclosure to purposes and circumstances permitted by applicable law.

4.3 Independent provider privacy notices

Third-party websites, applications and providers linked from XValue have their own privacy policies. We encourage you to review those notices before providing information or authorizing a connection. The presence of a provider’s name in historical policies does not mean that an integration or identity verification process is currently offered.

5. Cookies, Analytics, Advertising and Your Choices

5.1 Cookies and similar technologies

We may use essential cookies or comparable storage technologies for account sessions, security, preferences and service operation. If analytics, campaign measurement or advertising technologies are enabled, they may process device details, cookie identifiers, page interactions, referral information or conversion events. Applicable cookie notices and consent controls must identify non-essential technologies and provide required choices before they are activated.

5.2 Campaign measurement

Where XValue measures the effectiveness of social-media posts, influencer referrals or advertising, we may use tagged links, campaign identifiers and aggregated or account-linked conversion records as permitted by law. We will not represent a future measurement integration as active until implemented and disclosed in the applicable notice.

5.3 Controls

You can manage cookies through browser controls, use any consent controls made available on the Platform and adjust marketing choices or unsubscribe from promotional emails. Restricting essential cookies may affect service functions. Privacy requests and marketing objections may also be sent to [email protected].

6. Retention, Storage, International Transfers and Deletion

6.1 Retention principles

We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, including account operation, active listings, transaction completion, support, security, records required by law and the handling of claims or disputes. Different data categories may have different retention periods. When data is no longer required, we delete, anonymize or otherwise securely dispose of it, subject to legally required preservation and technical backup cycles.

6.2 Account closure

You may request account closure or deletion of eligible personal data. Some information may need to be retained after closure, such as completed transaction documentation, accounting records, fraud-prevention records or evidence relevant to an unresolved claim, to the extent allowed or required by law. Removal of a listing does not necessarily delete messages already received by another participant.

6.3 Storage location and cross-border handling

XOSPACE may use secure infrastructure and service providers located in Saudi Arabia or other jurisdictions relevant to operating the Platform. Before publication, XOSPACE must confirm the actual hosting and processing locations and disclose them with appropriate specificity. Any international transfer will be subject to applicable legal conditions and safeguards, including those required by the Saudi PDPL and, where relevant, the GDPR. You may request further information on relevant transfer arrangements at [email protected].

7. Security and Data Incidents

We use administrative, technical and organizational safeguards intended to protect personal data against accidental loss, unauthorized access, unlawful disclosure and alteration. These may include access controls, appropriate security procedures, monitoring and measures proportionate to the nature and risk of processing. No internet transmission or storage system can be guaranteed to be completely secure.

You are responsible for safeguarding your credentials and choosing carefully what to share through public listings or messages. If you suspect unauthorized account access or a privacy incident, notify us promptly at [email protected]. We will assess incidents and make notifications to individuals or authorities when required by applicable law.

8. Your Privacy Rights and How to Exercise Them

8.1 Rights under applicable law

Depending on your jurisdiction and the applicable law, you may have the right to be informed about processing; obtain access to and a copy of your personal data; request correction or completion; request deletion or destruction where lawful; withdraw consent; and exercise other rights available under the Saudi PDPL or other applicable law. Where the GDPR applies, additional rights may include restriction, objection, portability and safeguards against certain solely automated decisions. Rights are not absolute and may be subject to statutory conditions or exceptions.

8.2 How to submit a request

Email [email protected] with the subject “XValue Privacy Request”, identify the account or data concerned, and explain the right you wish to exercise. We may take proportionate steps to verify your identity before disclosing or changing account information. We will respond within the period required by applicable law and explain any lawful limitation or refusal. We will not ask you to email your password.

8.3 Complaints and regulatory authorities

Please contact us first if you have a concern about our handling of personal data. You may also have the right to complain to a competent data-protection regulator, including the authority responsible for Saudi PDPL oversight or, where the GDPR applies, the relevant EU/EEA supervisory authority.

9. Age Requirements and Changes to this Policy

9.1 Adults only

XValue accounts and marketplace services are intended for individuals aged 18 or older, consistently with the XValue Terms of Use. We do not knowingly solicit or allow minors to open marketplace accounts. If you believe a minor has provided personal data contrary to this requirement, please contact [email protected] so that we may assess and take appropriate action in accordance with law.

9.2 Policy updates

We may amend this Policy to reflect changes in law, service features, technologies or data-handling practices. The current version and effective date will be posted through the Platform. Where material changes require notice or consent, we will provide them in the manner required by applicable law. A new policy will not by itself convert optional processing into consent.

10. Contact and Operator Details

Operator: شركة فضاء اكسو لتقنية المعلومات (XOSPACE) — operator of XValue.
Commercial Registration: 7031231322.
Registered location: Riyadh, Kingdom of Saudi Arabia.
Privacy, customer support and other platform inquiries: [email protected].