1. Who We Are
XOCO WEB SRL (CUI 45465782, Registration No. J20/46/2022, EUID ROONRC.J20/46/2022) operates xocothemes.com and acts as the data controller for the personal data described below, within the meaning of Article 4(7) GDPR. This policy is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679), applicable Romanian data protection law, and guidance from the Romanian supervisory authority (ANSPDCP).
For any privacy question or request, contact alba.andrei93@gmail.com. We aim to respond within 30 days.
2. Scope
This policy covers xocothemes.com, its theme demo pages, and the purchase links on this site. It does not cover Polar.sh's own checkout pages, or any other third-party site we link to, each of which is governed by its own privacy policy.
3. Data We Collect
Data you provide directly. If you email us, this includes your name, email address, and message content. We have no account system, contact forms, or newsletter signup on this site, so we do not otherwise collect data you type into it.
Purchase data. When you buy a theme, checkout happens entirely on Polar.sh. Polar collects and processes your billing details, payment instrument, and tax information as an independent data controller and merchant of record. We do not receive or store your full payment details. We may receive limited order information from Polar, such as your email address and the product purchased, to deliver license access and support.
Technical data. Our hosting provider, Cloudflare Pages, processes standard request metadata such as IP address, browser and device type, requested URL, timestamp, and referrer, to serve the site securely and reliably.
Cookies and browser storage. The site stores a consent preference in your browser's local storage. See the Cookie Policy for the full list and how to change your preference. Google analytics or advertising scripts only load after you opt in.
4. Why We Process Your Data
- Responding to enquiries and support emails — legitimate interest.
- Delivering theme purchases, licenses, and updates — performance of a contract.
- Keeping billing and accounting records — legal obligation under Romanian accounting law.
- Security monitoring and abuse prevention — legitimate interest.
- Optional analytics and marketing, including Google Analytics traffic measurement and Google remarketing or campaign measurement — consent, which you can withdraw at any time from the cookie banner.
5. Third-Party Processors
We use a small number of providers who process data on our behalf or as independent controllers:
- Cloudflare (hosting, security, and delivery) — serves xocothemes.com through Cloudflare Pages and may process data in the United States under appropriate safeguards. See cloudflare.com/privacypolicy.
- Google (analytics, ads, and remarketing, only with consent) — helps us understand site traffic, measure campaigns, improve pages, and show more relevant ads to people who have visited xoco. See policies.google.com/privacy.
- Polar.sh (payment processor and merchant of record) — processes all checkout, billing, and tax data for paid purchases under its own privacy policy. See polar.sh.
- GitHub (free theme distribution) — cloning or downloading a free theme repository is subject to GitHub's own terms and privacy policy.
We do not sell, rent, or trade your personal data. We use optional marketing data only to measure and improve our own campaigns and reach people who have shown interest in xoco.
6. Data Retention
Support and contact emails are kept only as long as needed to handle the conversation and maintain business records, then deleted or archived. Purchase and billing records held by Polar follow Polar's own retention policy; any order reference we keep for license support is retained no longer than necessary, or as required by Romanian accounting law.
7. Your Rights Under GDPR
You may have the right to access, correct, delete, restrict, or object to processing of your personal data, to receive your data in a portable format, and to withdraw consent for optional cookies at any time. To exercise any of these rights, email alba.andrei93@gmail.com. You can also change your cookie preferences from the footer at any time.
If you believe your data protection rights have been violated, you may lodge a complaint with the Romanian supervisory authority (ANSPDCP) at dataprotection.ro, or with the supervisory authority in your own EU/EEA country of residence.
8. International Transfers
Some of our providers, including Cloudflare, Google, and Polar, may process data outside Romania or the EEA, including in the United States. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.
9. Children's Data
This site and its themes are directed at adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact alba.andrei93@gmail.com and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Changes are posted on this page with an updated effective date.