Skip to content

Privacy policy

Responsible in the sense of the data protection laws, in particular the EU Data Protection Basic Regulation (DSGVO), is

XPAY Solutions GmbH
Stuntzstraße 16
81677 Munich

Data Protection Officer:
XPAY Holding AG
Stuntzstraße 16
81677 Munich
+49 89 4613442244


1.   The content of this privacy statement and definitions

Thank you for your interest in our website. The protection of your privacy is very important to us. In the following document we will inform you in detail about how we handle your data and which personal data we collect, process and use when you visit our website. Additionally, this data protection declaration will inform you about the options and objections you have with regard to your data.

For the purposes of the basic data protection regulation (DSGVO), the following definitions apply

  • "personal data" shall mean any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
  • “processing" means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, arranging, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
  • “profiling” means any automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular with a view to analysing or predicting aspects relating to the performance of work, economic situation, health, personal preferences, interests, reliability, conduct, location or movement of that natural person.

Further official definitions are explained in Art. 4 DSGVO.


2.   Rights of data subjects

You can exercise the following rights at any time by contacting our data protection officer:

  • Information about your data stored with us and their processing (Art. 15 DSGVO),
  • Correcting incorrect personal data (Art. 16 DPA),
  • Deletion of your data stored with us (Art. 17 DSGVO),
  • Restriction of data processing, insofar as we are not yet allowed to delete your data due to legal obligations (Art. 18 DSGVO),
  • Objection to the processing of your data by us (Art. 21 DSGVO) and
  • Data transferability, provided you have consented to data processing or have concluded a contract with us (Art. 20 DSGVO).

If you have given us your consent, you can revoke it at any time with effect for the future.

You also have the right to complain to a supervisory authority (Art. 77 DSGVO). As a rule, you can contact the supervisory authority at your usual place of residence or workplace or at our registered office for this purpose. The following supervisory authority is responsible for us:

Landesamt für Datenschutzaufsicht
Promenade 27 (Schloss)
91522 Ansbach

Right of objection

Insofar as we process personal data as explained in this data protection declaration in order to safeguard our legitimate interests which outweigh any other interests, you can object to this processing with effect for the future. If the processing is for direct marketing purposes, you may exercise this right at any time as described above. If processing is carried out for other purposes, you only have the right to object if there are reasons arising from your particular situation.

After exercising your right of objection, we will not further process your personal data for these purposes, unless we can prove compelling reasons for processing worthy of protection that outweigh your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims.

This does not apply if the processing is for direct marketing purposes. In this case we will not process your personal data further for this purpose.

If you wish to exercise your right of objection, please inform us by e-mail.

Profiling (automated decision making)

According to Art. 22 DSGVO, you have the right not to be subjected to a decision based solely on automated processing - including profiling - which has legal effect on you, or which significantly affects you in a similar way. As a matter of principle, we do not carry out automated decision making unless this serves to comply with overriding legal provisions (e.g. prevention of money laundering and terrorist financing).


3.   Visit of our website

Our website uses HubSpot, a software of HubSpot Inc, USA. This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analyses and evaluation of logged user behavior, to better coordinate and optimize our marketing strategy. The data collected by HubSpot may be stored on US servers. Cookies (see below) are used. You can prevent the storage of cookies at any time by setting your browser software accordingly or delete the cookies already stored. Please note that if cookies are blocked, you may not be able to use the full range of services provided on our website. For more information, please refer to the Terms of Use and Privacy Policy of HubSpot Inc. accordingly at,,, and

If you do not want the information about your visit to be used for the purposes described, you are also welcome to notify us by email or by mail at any time. All information we collect is subject to this Privacy Policy. HubSpot is subject to TRUSTe 's Privacy Seal and the U.S. - EU Safe Harbor Framework and the U.S. - Swiss Safe Harbor Framework.

Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500.

The following data is stored:
This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior (reporting by traffic sources, accesses, etc. ...) to better coordinate and optimize our marketing strategy. Furthermore, HubSpot covers various aspects of our inbound marketing:

  • email marketing (newsletters as well as automated mailings, e.g. to provide downloads);
  • contact management (e.g. user segmentation & CRM);
  • landing pages and contact forms

Furthermore, we collect personal data that you voluntarily provide to us. This includes, but is not limited to, contact information such as your name, email address, business name, address and phone number, and other data about you or your business. For more information about HubSpot's privacy policy, please click here:

Storage Period / Data Deletion:
We retain personal data that you provide to us for as long as there is a legitimate business interest on our part (such as to comply with our legal obligations, resolve disputes, and enforce our contractual claims). If we do not have a legitimate business interest in processing your personal data, we will securely delete or anonymize it. If neither is possible, we will store your personal data in a secure manner and exclude it from any further data processing until erasure is possible.

Legal basis for processing
The legal basis for the use of Hubspot's services is Art. 6 I f DS-GVO - legitimate interest. Our legitimate interest in using this service is to optimize our marketing measures and improve our service quality on the website. HubSpot processes personal data to the extent necessary to provide the subscription services in accordance with the contract, the information provided in the order form and the instructions of the customer in the context of his use of the subscription services. If you generally do not want HubSpot to collect your personal data, you can prevent the storage of cookies at any time by changing your browser settings accordingly or by using the following opt-out link:




4.   E-mail advertising and newsletter subscription

Nature and purpose of the processing

If you subscribe to our newsletter, we will use the data required for this purpose or provided separately by you to regularly send you our e-mail newsletter.

You can revoke your consent to the storage of your personal data and its use for sending the newsletter at any time with effect for the future. You can do this either by sending a message to the contact option described above or via a link provided for this purpose in the newsletter. After cancellation we will delete your e-mail address, unless you have expressly agreed to a further use of your data or we reserve the right to use your data for other purposes which are legally permitted and about which we inform you in this declaration.

Legal basis

On the basis of your expressly given consent (Art. 6 para. 1 lit. a DSGVO), we will send you our newsletter or comparable information regularly by e-mail to the e-mail address you have provided.

Storage duration

The data will only be processed in this context as long as the corresponding consent has been obtained. Afterwards they will be deleted.

Provision prescribed or necessary

The provision of your personal data is voluntary, solely based on your consent. Unfortunately, we cannot send you our newsletter without existing consent.


5.   Cookies

Nature and purpose of the processing

To make visiting our website attractive and to enable the use of certain functions, to display suitable products or for market research, we use so-called cookies on various pages. This serves to protect our legitimate interests, which outweigh any other interests, in an optimised presentation of our offer in accordance with Art. 6 Para. 1 S. 1 lit. f DSGVO. Cookies are small text files that are automatically stored on your end device. They are not able to execute programs or transmit viruses.

Legal basis

The use of cookies serves to safeguard our predominantly legitimate interests in an optimised presentation of our offer in accordance with Art. 6 Para. 1 S. 1 lit. f DSGVO.

Storage duration of the cookies used

This website uses the following types of cookies, the scope and function of which are explained below:

  • Transient cookies
  • Persistent cookies

Transient cookies are automatically deleted when you close the browser. This includes in particular the session cookies. These store a so-called session ID, with which various requests from your browser can be assigned to the shared session. This allows your computer to be recognised when you return to our website. The session cookies are deleted when you log out or close the browser.

Persistent cookies are automatically deleted after a specified period of time, which may vary depending on the cookie. You can delete the cookies in the security settings of your browser at any time.

You can see the duration of the storage in the cookie settings of your web browser.

You can set your browser so that you are informed about the setting of cookies and decide individually about their acceptance or exclude the acceptance of cookies for certain cases or generally. Each browser differs in the way it manages the cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings.

You will find these for the respective browsers under the following links:

Internet Explorer™:

If cookies are not accepted, the functionality of our website may be limited.


6.   Social Media Plugins

Nature and Purpose of the Processing

Our presence on social networks and platforms serves a better, active communication with our customers and interested parties. There we inform about our products and current special offers.

When you visit our online presence in social media, your data may be automatically collected and stored for market research and advertising purposes. So-called user profiles are created from this data using pseudonyms. These can be used, for example, to place advertisements inside and outside the platforms that presumably correspond to your interests. For this purpose, cookies are usually used on your end device. The visitor behaviour and interests of the users are stored in these cookies.

Legal Basis

The use of your personal data is in accordance with Art. 6 para. 1 lit. f. DSGVO, the use of your personal data serves to safeguard our predominantly legitimate interests in an optimised presentation of our offer and effective communication with customers and interested parties. If you are asked by the respective social media platform operators for consent (permission) to data processing, e.g. by means of a checkbox, the legal basis for data processing is Art. 6 para. 1 lit. a DSGVO.

Data Processor

The data processing is based on an agreement between jointly responsible parties in accordance with Art. 26 DSGVO, which you can view here:


Storage Duration

For detailed information on the processing and use of data by the providers on their sites as well as a contact option and your rights and settings options for the protection of your privacy, in particular opt-out options, please refer to the linked data protection information of the providers. Should you nevertheless require assistance in this regard, please contact us.

Transfer to Third Countries

Insofar as the aforementioned social media platforms have their headquarters in the USA, a third country transfer of your data to the USA may occur. By using the respective social media platform, you have given your consent for the respective data transfer.

Provision Required or Necessary

The provision of your personal data is voluntary, solely based on your consent. If you prevent access, this may result in functional restrictions on the website.

Revocation of Consent

Opt-Out possibilities:


7. Processors Used

In some cases we use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are checked regularly. We have concluded an order processing contract with all the companies we have commissioned to collect, process, analyse and delete your data and fully implement the requirements of the data protection authorities.


8. Changes to our Data Protection Regulations

We reserve the right to adapt this data protection declaration so that it always meets the current legal requirements or to implement changes to our services in the data protection declaration, e.g. when introducing new services. The new data protection declaration then applies to your next visit.


9. Questions to the Data Protection Officer

If you have any questions regarding the collection, processing or use of your personal data, for information, correction, restriction or deletion of data as well as revocation of any consents granted or objection to a specific use of data, please contact our company data protection officer.

Data Protection Officer:

XPAY Holding AG
Stuntzstraße 16
81677 Munich
+49 89 46 13 44 22 44