Privacy Policy

The data controller for your personal data is X4JX LAB SL, with registered office at Calle Emilio Tuya 37, 4th Floor, Unit C, 33202 Gijón (Asturias), Spain, registered with the Mercantile Registry of Asturias under Spanish Tax ID (NIF) B27582790. You can contact the privacy team and Data Protection Officer (DPO) by email at privacy@4jlab.com, or by post to the address above, marked 'For the attention of: Data Protection Officer'.

X4JX LAB SL acts as data controller in respect of data collected through the website and audit request form. In the context of providing advisory services to client companies (including coordination of EU Responsible Person, IOR or fiscal representative in other member states), X4JX LAB SL may act as data processor, in which case the relationship is governed by the data processing agreement signed between the parties under Article 28 of the GDPR.

We collect the following categories of personal data: (a) Professional identification and contact data: name, job title, company, corporate email address; (b) Business activity data: estimated import volume, target markets, areas of interest; (c) Technical data: IP address, browser type, pages visited, session duration; (d) Communications: content of messages submitted through the contact form.

The legal bases for processing are: (i) Performance of pre-contractual measures (Art. 6.1.b GDPR) for handling audit requests; (ii) Legitimate interest (Art. 6.1.f GDPR) for statistical analysis of site traffic; (iii) Legal obligation (Art. 6.1.c GDPR) for compliance with applicable tax and customs regulations.

Your data is processed for the following purposes: (1) Management of and response to audit requests and commercial enquiries; (2) Sending commercial communications related to 4J Lab services, subject to obtaining explicit consent where required; (3) Statistical analysis of Site usage for functional optimisation; (4) Compliance with legal, tax and commercial obligations under Spanish and EU law applicable to X4JX LAB SL.

Your data will not be used for automated decision-making or profiling with significant legal effects.

Your data may be shared with: (a) Technology service providers (CRM, cloud hosting) acting as data processors under corresponding data processing agreements; (b) Spanish tax authorities (AEAT) and, where applicable in the context of advisory services delivered to the client, tax and customs authorities of other member states (Belastingdienst, Douane, etc.) under express client instructions; (c) Legal and tax advisors and certified partners within the 4J Lab network under professional confidentiality obligations.

For transfers outside the EEA, in particular to China in the context of our sourcing coordination services, we apply appropriate safeguards through standard contractual clauses approved by the European Commission (Implementing Decision 2021/914).

As a data subject, you have the following rights regarding your personal data: Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability (Art. 20) and objection (Art. 21). Where processing is based on your consent, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, send a written request to privacy@4jlab.com stating the right you wish to exercise and attaching a copy of your identity document. We will respond within one month of receipt.

X4JX LAB SL applies appropriate technical and organisational measures to ensure data security, including encryption in transit (TLS 1.3) and at rest (AES-256), role-based access control (RBAC) and incident response procedures compliant with Articles 33 and 34 of the GDPR.

Contact and commercial data is retained for as long as necessary for service delivery and, after the relationship ends, for the period required by applicable Spanish tax and commercial law (generally 6 years under Article 30 of the Spanish Commercial Code). Web traffic data is anonymised after 26 months.