Privacy Policy

How we handle your personal data

Data controller

The controller of your personal data is XPECTATIONS21, S.L.U. (“X21”), Tax ID (CIF) B44874667, registered at C/ Costa Brava, 35, 1ºB, Esc. Dcha, 28034 Madrid (Spain). For any question about this policy or your data, write to info@x21.consulting.

What data we process

We only process the data you provide through our forms and the data generated when you use them:

  • Contact and identification data: name, work email, company and, where applicable, phone.
  • Content of your enquiry: the message, challenge or project details you choose to share.
  • Reputation self-diagnostic: your answers (1–5 ratings) and the resulting indices and profile, which concern your organization.
  • Technical data: the minimum strictly necessary to serve the website. We do not use tracking or advertising cookies.
  • Visit measurement: with Vercel Web Analytics we record, in aggregate, the page visited, the referring site, the country, the device type, the operating system and the browser. It uses no cookies and does not store your IP address, and it tells visitors apart with an identifier that changes every day, so it cannot identify you.

Fields marked with “*” are mandatory; without them we cannot handle your request.

Purposes and legal basis

  • Respond to your enquiry and prepare a proposal — legal basis: your consent and the pre-contractual steps taken at your request.
  • Deliver your self-diagnostic report and contact you about it — legal basis: your consent.
  • Send you the X21 Briefing, if you subscribe — legal basis: your consent, which you may withdraw at any time.
  • Manage the commercial relationship and keep you informed about our services — legal basis: our legitimate interest and, where required, your consent.
  • Understand, in aggregate, how many people visit the website and which pages they use, so we can improve it — legal basis: our legitimate interest.

How long we keep your data

We keep your data for as long as the commercial relationship lasts and, afterwards, for the periods legally required to meet our obligations and defend against potential claims. Data used for communications is kept until you withdraw your consent or object.

Who we share your data with

We do not sell your data. We only share it with service providers that process it on our behalf, under a data-processing agreement and strictly to deliver the service:

  • Website hosting and anonymous visit measurement (Vercel).
  • CRM / ERP and database, where we manage leads and diagnostics (hosted on Supabase).
  • AI-assisted drafting of your report (Anthropic), which processes your diagnostic answers to help prepare your analysis.
  • Email delivery (Resend).

Some of these providers are located outside the European Economic Area (e.g. in the United States). In those cases, transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses. We may also disclose data to public authorities where legally required.

Your rights

You may exercise your rights of access, rectification, erasure, restriction, objection and portability, and withdraw your consent at any time, by writing to info@x21.consulting and stating the right you wish to exercise. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if you consider your data has not been handled properly.

Security

We have implemented the technical and organizational measures appropriate to the nature of the data to protect it against loss, misuse, alteration or unauthorized access.

Cookies and local storage

This website does not use advertising or tracking cookies, and visit measurement works without cookies. It only uses your browser’s local storage for functional purposes — for example, to remember your language choice and to prevent the self-diagnostic from being submitted more than once from the same browser. That information stays on your device and is not shared with us.

Minors

Our services are addressed to professionals and organizations. We do not knowingly collect data from minors.

Changes to this policy

We may update this policy to reflect changes in our processing or in applicable law. Any changes will be published on this page.

Last updated: October 2026.