Privacy Policy

The controller responsible for the processing of your personal data on xpandable-spaces.com is:

eventX LLC
Limited Liability Company (LLC), Florida, USA
18117 Biscayne Blvd, Suite #4818
33160 Miami, FL
USA
E-mail: info@xpandable-spaces.com

EU Representative (Art. 27 GDPR). As a U.S. company offering services in the European Union, we are required to designate a representative established in the Union. This representative has not yet been designated; details will be published here as soon as the designation is complete. In the meantime, EU/EEA data subjects can exercise their rights directly via the contact address above.

This policy explains how we collect, use, share, and protect personal information when you visit the Site, submit an inquiry, or enter into a rental or purchase contract with us. It is intended to meet the transparency requirements of both the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA. Section 8 sets out GDPR-specific rights; Section 9 sets out California-specific rights.

We collect only what is necessary. In particular:

• Contact and inquiry data you submit through our contact form, by e-mail, phone, or WhatsApp — such as name, e-mail address, phone number, company, event details, and the content of your message.
• Contract data generated in connection with a rental or purchase — offer number, event date, site address, invoice details, and payment status.
• Technical log data automatically transmitted by your browser when you visit the Site — browser type and version, operating system, referring URL, timestamp, and the IP address (truncated where technically possible). This is used to operate and secure the Site.
• Aggregated analytics such as page views, device type, approximate country-level region, browser, and Core Web Vitals via Vercel Analytics and Vercel Speed Insights. These are aggregated and anonymous — no personal-identifying cookies, no IP storage, no browser fingerprinting.

We do not knowingly collect information from children under 13, and the Site is not directed to children (see Section 11 on COPPA).

We process personal data for the following purposes:

• To respond to your inquiry and to prepare an individual offer — GDPR Art. 6(1)(b) (pre-contractual measures) / GDPR Art. 6(1)(f) (legitimate interest in answering inquiries directed at us).
• To perform a rental or purchase contract — GDPR Art. 6(1)(b).
• To meet legal obligations (tax, accounting, retention) — GDPR Art. 6(1)(c) and applicable local law.
• To operate and secure the Site and to improve performance via aggregated analytics — GDPR Art. 6(1)(f) (legitimate interest); consent (GDPR Art. 6(1)(a), § 25(1) TTDSG) where required by law for non-essential cookies.

We use strictly necessary cookies to operate the Site (for example, to remember your language preference and cookie choice). We do not set advertising cookies. Where a non-essential cookie would be used, we obtain your consent via a cookie banner and you may withdraw consent at any time.

We do not sell personal information and we do not share it for cross-context behavioral advertising (see Section 9). We disclose personal data only to the following categories of recipient, each bound by written contract and appropriate safeguards:

• Hosting — Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The Site is served from an EU edge location (Frankfurt). We have a Data Processing Agreement with Vercel. Transfers to the United States take place under the EU Standard Contractual Clauses.
• Payment and banking partners processing invoices and bank transfers.
• Professional advisors (tax, legal, accounting) where necessary to establish, exercise, or defend legal claims.
• Authorities, where required by binding legal request.

If you contact us via WhatsApp, the transmission and message-storage are governed by WhatsApp’s / Meta’s own privacy notices. Please use e-mail for sensitive information.

We retain personal data only as long as necessary for the purpose for which it was collected, or as required by law. Inquiry data without follow-up is deleted after a reasonable period of typically up to six months. Contract-related data is retained for the statutory retention periods that apply to us (typically up to ten years under commercial and tax law).

If the GDPR (or the UK GDPR) applies to the processing of your personal data, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR) — with effect for the future
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — for EU data subjects, this is typically the authority of your country of residence.

To exercise these rights, contact us at info@xpandable-spaces.com. We respond within one month of receipt, extendable by up to two further months where necessary due to complexity.

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you the following rights with respect to personal information we collect about you:

• Right to know the categories and specific pieces of personal information we collect, the sources, purposes, and categories of recipients.
• Right to delete personal information we collected from you, subject to exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of “sale” or “sharing” of personal information for cross-context behavioral advertising.
  We do not sell or share personal information in the sense of the CCPA/CPRA. We have not knowingly done so in the preceding twelve months.
• Right to limit use of sensitive personal information. We do not use sensitive personal information for any purpose beyond what is reasonably necessary to provide the services you request.
• Right to non-discrimination for exercising any of these rights.

To exercise these rights, e-mail us at info@xpandable-spaces.com. We may need to verify your identity before responding. You may also designate an authorized agent to submit a request on your behalf.

eventX LLC is established in the United States. When personal data is transferred from the EU/EEA/UK to the United States, we rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) — and, where a processor participates in the EU-U.S. Data Privacy Framework, on that adequacy mechanism — together with supplementary measures such as encryption in transit and at rest and contractual audit rights.

The Site is not directed to children under the age of 13 and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at info@xpandable-spaces.com and we will delete it.

We apply current technical and organizational measures to protect personal data against unauthorized access, alteration, loss, or destruction — including TLS/HTTPS encryption in transit, encrypted storage at rest with our hosting provider, restricted internal access, and prompt patching of platform components.

We may update this Policy from time to time. The current version is always posted on this page with an updated “Last updated” date. Material changes will be communicated where reasonably appropriate — for example, by e-mail to active customers.

For any privacy-related question, request, or complaint, contact us at info@xpandable-spaces.com or by post at the address in Section 1.