Privacy Policy

1. Introduction

Xstature (“we”,“us”) values and respects the privacy of its candidates, clients, businesspartners, and other contacts. As an executive search and advisory firm, weprocess personal data in a discreet, careful, and confidential manner.

This Privacy Policy explains howpersonal data is collected, used, shared, and protected in connection with ourprofessional activities, in accordance with the EU General Data ProtectionRegulation (“GDPR”) and applicable national data protection laws.
‍

2. Data Controllers

Personal data is processed bythe following Xstature entities, each acting as a data controller withinthe meaning of Article 4(7) GDPR, depending on the context of the engagement:

• Xstature Search Group SIA. Registered office: Riga, Latvia
• Xstature. Registered office: Amsterdam, The Netherlands

Together, these entities mayjointly process personal data in the context of executive search, leadershipadvisory, and related professional services.

Contact email for allprivacy-related matters: info@xstature.com

3. Scope of This Privacy Policy

This Privacy Policy applies to personal data obtained through:

• Our website
• Email and other electronic communications
• Professional networking platforms (such as LinkedIn)
• Referrals and professional introductions
• Direct contact with representatives of Xstature in the Netherlands or Latvia

Personal data may becollected both via and outside the website as part of ourexecutive search, leadership advisory, and relationship-based professionalservices.

4. What Personal Data Do We Process?

4.1 Personal Data

Personal data means any information relating to an identified or identifiable natural person.

4.2 Categories of Personal Data

Depending on the context, we may process:

• Contact details (name, email address, telephone number)
• Professional information (CVs, career history, education, skills, experience)
• Interview notes, assessments, and professional evaluations
• Availability, preferences, and (where relevant) compensation-related information
• Communication records (email, telephone, meeting notes)
• Client and business contact information

We do not intentionally process special categories of personal data unless strictly necessary and permitted under applicable law.

5. Sources of Personal Data

Personal data is obtained:

• Directly from you
• Via professional networking platforms and publicly available sources
• Through referrals or professional introductions
• During direct contact in the context of executive search and advisory services

6. Purposes and Legal Bases of Processing

Personal data is processed for the following purposes:

• Executive search, leadership advisory, and related professional services
• Assessing suitability for specific roles or potential future opportunities
• Presenting candidates to clients in the context of specific assignments
• Relationship management and long-term talent pipelines
• Communication with candidates, clients, and business partners
• Marketing of Xstature’s own services in a professional context
• Compliance with legal and regulatory obligations
• Protection of legitimate business interests

Processing is based on one or more of the following legal grounds under Article 6 GDPR:

• Legitimate interest
• Performance or preparation of an agreement
• Consent, where required
• Legal obligation
• Legal claims

7. Website Use and Cookies

When visiting our website,limited technical information may be processed, such as IP address, browsertype, device information, and access times, for security, functionality, andperformance purposes.

Where cookies or similartechnologies are used, further information is provided in our Cookie Policy.

8. Data Sharing

Personal data is treated as strictly confidential and may be shared only:

• Internally between Xstature entities, on a need-to-know basis
• With clients in the context of a specific executive search assignment and with appropriate discretion
• With trusted service providers acting as processors on our behalf (e.g. IT or hosting providers)
• Where required by law or in connection with legal proceedings

Personal data is never sold to third parties.

9. International Data Transfers

Processing generally takes placewithin the European Union or the European Economic Area (EEA). Where personaldata is transferred outside the EEA, appropriate safeguards are implemented inaccordance with GDPR requirements.

10. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected, taking into account:

• Business needs
• The nature of the professional relationship
• Applicable legal and regulatory retention obligations

When personal data is no longer required, it is securely deleted or irreversibly anonymized.

11. Data Security

Appropriate technical and organizational measures are implemented to protect personal data against unauthorized access, loss, misuse, or alteration. Access to personal data is restricted to individuals who require such access for legitimate professional purposes and are bound by confidentiality obligations.

12. Your Rights

Under the GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate or incomplete data
• Request deletion of personal data
• Restrict or object to processing
• Data portability, where applicable
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with a supervisory authority

Requests can be submitted via info@xstature.com. We aim to respond within one month.

13. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time. The most current version will always be available on our website.

14. Contact

For questions regarding this Privacy Policy or the processing of personal data, please contact: info@xstature.com. (Please indicate “Privacy” or “Data Protection” in the subject line.)