Privacy Policy

At XRT Group LLC, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you interact with our website, services, and communications.

1. Who We Are

XRT Group LLC(“XRT,” “we,” “us,” or “our”) is a Houston, Texas-based commodity procurement and trading company operating across energy, edible and seed oils, proteins, and Colombian coffee, with hubs in Houston (USA) and Medellín (Colombia).

For purposes of data protection laws, XRT Group LLC acts as the data controller for personal data collected through this website (xrtgroup.com) and related business operations.

2. Scope & Applicable Law

This policy applies globally to all users of our website and services. We design our data practices to comply with applicable data protection frameworks including, but not limited to:

• GDPR (EU General Data Protection Regulation 2016/679) — for individuals in the European Economic Area (EEA)
• UK GDPR (UK General Data Protection Regulation) — for individuals in the United Kingdom
• CCPA/CPRA (California Consumer Privacy Act, as amended) — for California residents
• LGPD (Lei Geral de Proteção de Dados, Brazil) — for individuals in Brazil
• Colombian Law 1581 of 2012 (Ley Estatutaria 1581 de 2012, habeas data) — for personal data processed in Colombia
• PIPEDA (Personal Information Protection and Electronic Documents Act, Canada)

3. Data We Collect

3.1 Information You Provide Directly

We collect personal data you voluntarily submit through our website, including:

• Contact forms & RFQ submissions: Full name, company name, job title, email address, phone number, country/region, and any commodity or transaction details you include in your inquiry.
• Schedule requests: Name, email, company, preferred meeting times, and any notes you provide.
• Blog subscriptions: Email address and subscription preferences.
• Direct communications: Any information you share when emailing us directly or communicating through our chat or support channels.

3.2 Information Collected Automatically

When you visit our website, we automatically collect certain information through server logs and analytics tools:

• Technical data: IP address, browser type and version, operating system, device type, screen resolution, and time zone setting.
• Usage data: Pages visited, time spent on pages, referrer URLs, click patterns, scroll depth, and navigation paths.
• Geolocation data: Country and city inferred from your IP address (we do not collect precise GPS-based location data).

3.3 Information From Third Parties

We may receive information about you from:

• Service providers: Analytics platforms (Google Analytics), security services (Cloudflare Turnstile), and email delivery providers.
• Publicly available sources: Trade registries, sanctions lists, and compliance databases used for KYC/AML screening in the course of business relationships.

4. Cookies & Tracking Technologies

We use cookies and similar technologies to improve your experience and analyze website usage. Our cookie usage is categorized as follows:

We do not use advertising cookies, third-party tracking cookies for behavioral advertising, or social media tracking pixels. You can manage your cookie preferences through our consent banner visible on your first visit.

5. Legal Basis for Processing (EEA/UK)

For individuals in the EEA and UK, we process personal data under the following legal bases:

• Consent — When you explicitly agree to specific processing (e.g., marketing emails, analytics cookies). You may withdraw consent at any time.
• Legitimate interest — For business operations such as responding to inquiries, improving our services, fraud prevention, and ensuring network security, where these interests are not overridden by your data protection rights.
• Contractual necessity — When processing is necessary to perform a contract with you or to take steps at your request before entering into a contract (e.g., processing RFQ submissions).
• Legal obligation — When we must comply with applicable laws, regulations, or lawful requests (e.g., AML/KYC obligations, sanctions screening).

6. How We Use Your Data

We use your personal data for the following purposes:

• Responding to inquiries, RFQ submissions, and contact form messages
• Providing information about our products, services, and market intelligence
• Managing business relationships and commercial communications
• Conducting AML/KYC compliance screening and sanctions checks
• Analyzing website usage to improve user experience and content
• Protecting our website and infrastructure against fraud, abuse, and cyber threats
• Complying with applicable laws, regulations, and legal processes

7. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data to third parties for their marketing purposes. We may share your data with:

• Service providers: Cloud hosting (Hostinger), database services (Supabase), email delivery platforms, analytics providers (Google), and security/anti-spam services (Cloudflare). These providers are contractually bound to process data only on our instructions and under equivalent data protection standards.
• Professional advisors: Legal counsel, auditors, and compliance consultants, where necessary and under confidentiality obligations.
• Regulatory authorities & law enforcement: When required by applicable law, regulation, court order, or lawful government request.
• Business transferees: In the event of a merger, acquisition, restructuring, or sale of assets, your data may be transferred as part of the transaction, subject to standard confidentiality protections.

7.1 International Data Transfers

XRT operates hubs in Houston (USA) and Medellín (Colombia). Your personal data may be transferred to and processed in countries outside your country of residence where data protection laws may differ. When we transfer data internationally, we implement appropriate safeguards, including:

• EU Standard Contractual Clauses (SCCs) for transfers from the EEA/UK
• For personal data transferred from Colombia, the safeguards required under Law 1581 of 2012 and the standards set by the Superintendencia de Industria y Comercio (SIC)
• Data processing agreements with all service providers that include equivalent protections
• Technical and organizational measures to protect data during transfer and at rest

8. Data Retention

We retain personal data only as long as necessary to fulfill the purposes described in this policy:

• Contact & RFQ submissions: Retained for the duration of the business relationship plus 5 years for compliance and legal purposes.
• Blog subscriptions: Retained until you unsubscribe or the subscription becomes inactive (no engagement for 24+ months).
• Analytics data: Pseudonymized and retained for up to 26 months via Google Analytics.
• Server logs: Retained for up to 90 days for security and debugging purposes.
• Consent records: Retained for the life of the consent plus 5 years as evidence of compliance.

When data is no longer needed, we securely delete or anonymize it in accordance with industry standards.

9. Your Data Protection Rights

Depending on your jurisdiction, you may have the following rights:

To exercise any of these rights, contact us at compliance [at] xrtgroup.comwith “Data Subject Request” in the subject line. We will verify your identity before processing your request and respond within the legally required timeframe (typically 30 days, extendable for complex requests). You also have the right to lodge a complaint with your local data protection supervisory authority.

10. Security Measures

We implement and maintain technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

• TLS/SSL encryption for all data in transit
• Encryption at rest for stored personal data
• Cloudflare Turnstile anti-bot protection on all forms
• Rate limiting and anti-spam filtering on API endpoints
• Access controls and authentication for internal systems
• Regular security assessments and vulnerability monitoring
• Data minimization principles in system design

11. Children's Privacy

Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently received personal data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Material changes will be communicated via a notice on our website. The “Last updated” date at the top of this page indicates when this policy was last revised. Continued use of our website after changes constitutes acceptance of the updated policy.

13. Supervisory Authority & Complaints

If you believe our processing of your personal data violates applicable data protection law, you have the right to file a complaint with a supervisory authority:

• EEA: Your local Data Protection Authority (DPA) in your EU member state
• UK: Information Commissioner's Office (ICO) — ico.org.uk
• California: California Privacy Protection Agency (CPPA) — cppa.ca.gov
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
• Canada: Office of the Privacy Commissioner of Canada (OPC)
• Colombia: Superintendencia de Industria y Comercio (SIC), Delegatura para la Protección de Datos Personales

Contact Us

For any questions, concerns, or to exercise your data protection rights, please contact us: