Privacy Policy
1. Who we are
XBMS BV (“XBMS”, “we”, “our”) is a private limited company incorporated under Dutch law, registered with the Dutch Chamber of Commerce (KVK). We operate xbms.io and provide pharmaceutical equipment procurement services to CDMOs and pharmaceutical manufacturers across Europe.
Data controller contact:
XBMS BV, the Netherlands
[email protected] | +31 53 234 0051
2. Personal data we collect
- Contact details — full name, business email address, company name, phone number, country.
- Equipment request data — equipment category, quantity, make/model, specifications, GMP requirements, budget range, and timeline.
- Technical data — IP address, browser type, and pages visited, recorded in standard server access logs.
- Communications — emails, messages, and records of correspondence with XBMS.
We do not collect special categories of personal data (as defined in Art. 9 GDPR).
3. Legal basis for processing
- Art. 6(1)(b) GDPR — processing is necessary to carry out the procurement service you requested.
- Art. 6(1)(f) GDPR — our legitimate interest in responding to enquiries, maintaining business records, and improving our services.
- Art. 6(1)(c) GDPR — compliance with applicable Dutch and EU legal obligations (e.g., tax record-keeping).
4. How we use your data
- To evaluate and fulfil pharmaceutical equipment sourcing requests submitted via our website.
- To communicate sourcing updates, quotes, and service-related information.
- To maintain accurate records of our business relationship.
- To comply with Dutch tax, accounting, and regulatory obligations.
5. Data sharing
We do not sell, rent, or trade your personal data. We may share data with:
- Transaction parties — equipment vendors, auction houses, or logistics partners directly involved in fulfilling your specific request, on a need-to-know basis.
- IT service providers — hosting and email infrastructure providers acting as data processors under appropriate data processing agreements.
- Competent authorities — where required by Dutch or EU law.
All third-party processors are bound by contractual confidentiality and data protection obligations.
6. Retention
Contact and enquiry data is retained for 2 years after the last interaction. Financial and invoicing records are retained for 7 years in accordance with Dutch fiscal law (Belastingdienst). Server logs are retained for up to 90 days.
7. Your rights under GDPR / AVG
You have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — request correction of inaccurate or incomplete data.
- Erasure — request deletion of your data where no overriding legal basis exists.
- Restriction — request that we limit processing in certain circumstances.
- Data portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest (Art. 6(1)(f)).
To exercise any right, email [email protected]. We will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Dutch Data Protection Authority: Autoriteit Persoonsgegevens .
8. Security
All data in transit is protected by TLS (HTTPS). Our infrastructure uses access controls, encrypted storage, and is hosted within the EU. We review our security measures regularly.
9. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be indicated by an updated “Last updated” date above. We encourage you to review this page periodically.