Privacy Policy

1. Introduction

X-Square Re I.I. ("X-Square Re," "we," "our," or "us") respects your privacy and is committed to protecting personal information collected through our website, contact forms, business communications, and related digital services.

This Privacy Policy explains how we collect, use, disclose, store, protect, and process personal information when users visit or interact with our website: www.xsquarere.com

This policy is intended to support transparency and compliance expectations under applicable privacy and advertising standards, including UK GDPR, EU GDPR, applicable U.S. privacy principles, Google Ads requirements, and Google EU User Consent Policy obligations for users located in the United Kingdom, European Economic Area, or Switzerland.

2. Company Information

X-Square Re I.I.
Centro Internacional de Mercadeo II, 90 PR-165 Ste 803, Guaynabo, Puerto Rico 00968
Privacy Contact: info@xsquarecapital.com

3. Scope of This Policy

This Privacy Policy applies to personal information collected through our website, contact form page, digital advertising interactions, analytics tools, and direct business inquiries. It does not apply to third-party websites, platforms, or services that we do not own or control.

4. Information We Collect

4.1 Information You Voluntarily Provide

• Name
• Business or company name
• Email address
• Phone number
• Job title or professional role, if provided
• Business inquiry details
• Underwriting or reinsurance-related inquiry information voluntarily submitted
• Any other information submitted through the contact form or direct communication

4.2 Information Automatically Collected

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent on the website
• Referring website or campaign source
• Approximate location derived from IP address
• Cookie identifiers and consent preferences
• Website interaction and analytics data

5. How We Use Personal Information

• Respond to contact form submissions and business inquiries
• Evaluate underwriting, reinsurance, or commercial opportunities submitted to us
• Conduct CRM and sales follow-up communications
• Maintain internal business records
• Improve website performance, usability, security, and user experience
• Measure digital marketing, advertising, and campaign performance
• Operate Google Analytics, Google Ads, Google Tag Manager, and reCAPTCHA where permitted
• Prevent spam, fraud, abuse, unauthorized activity, and website misuse
• Comply with legal, regulatory, contractual, and risk-management obligations

6. Legal Bases for Processing for UK and EEA Users

For users located in the United Kingdom or European Economic Area, we process personal information under one or more of the following legal bases:

• Consent: where users agree to receive communications or allow non-essential cookies, analytics, advertising, or remarketing technologies.
• Legitimate interests: where processing is necessary for normal business operations, responding to inquiries, securing the website, improving services, and maintaining business relationships, provided those interests are not overridden by individual rights.
• Contractual necessity: where processing is needed to take steps requested by a user before entering into a business relationship or to perform a contract.
• Legal obligation: where processing is required to comply with applicable laws, regulations, court orders, or regulatory requests.

7. Cookies, Analytics, Advertising, and Consent

Our website may use cookies, pixels, tags, local storage, and similar technologies to operate the website, protect against spam, measure performance, and support advertising or remarketing activities.

For visitors located in the UK, EEA, or Switzerland, non-essential cookies and advertising/analytics technologies should not be activated unless legally valid consent has been obtained, except where a technology is strictly necessary for website functionality or security.

Our cookie and consent tools should allow users to accept, reject, or customize non-essential cookies and should provide an option to withdraw or modify consent after the initial choice.

8. Google Analytics, Google Ads, and Google Tag Manager

We may use Google Analytics 4 (GA4), Google Ads, and Google Tag Manager to understand website activity, measure advertising performance, support conversion tracking, and improve marketing effectiveness.

Where required, Google tags should operate in accordance with user consent choices through Google Consent Mode v2. Consent signals may include:

• analytics_storage — consent for analytics-related storage, such as measurement cookies
• ad_storage — consent for advertising-related storage
• ad_user_data — consent for sending user data to Google for advertising measurement
• ad_personalization — consent for personalized advertising and remarketing

Google may process data in accordance with its own privacy policies and terms. Users can learn more about Google data practices at policies.google.com/privacy and may use Google's available opt-out tools where applicable.

9. Google reCAPTCHA

We use Google reCAPTCHA to help protect our website and contact forms from spam, abuse, and automated misuse. reCAPTCHA may collect hardware, software, browser, device, and interaction information to determine whether a visitor is human and to protect the security of the website.

Use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.

10. Disclosure of Information

We may share personal information with limited categories of recipients where necessary and appropriate, including:

• Technology providers that host, operate, secure, or support our website
• CRM or business operations providers used for inquiry management and follow-up
• Analytics, advertising, and tag-management providers such as Google, where consent and applicable law allow
• Professional advisors, auditors, legal counsel, and compliance consultants
• Regulators, courts, law enforcement, or government authorities when required by law or to protect legal rights
• Successors or counterparties in connection with a merger, acquisition, restructuring, or similar corporate transaction

We do not sell personal information as a core business activity.

11. International Data Transfers

X-Square Re operates from Puerto Rico. Personal information submitted through the website may be processed in Puerto Rico, the United States, the United Kingdom, the European Economic Area, or other jurisdictions where our service providers operate.

Where required, we use reasonable safeguards designed to protect personal information transferred internationally, which may include contractual protections, vendor due diligence, and privacy/security controls.

12. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including business follow-up, underwriting or inquiry review, legal compliance, dispute resolution, security, and recordkeeping. Retention periods may vary depending on the type of information and applicable legal or business requirements.

13. Data Security

We use commercially reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. However, no online transmission, website, or electronic storage system can be guaranteed to be completely secure.

14. Your Privacy Rights

Depending on your jurisdiction, you may have rights to request:

• Access to the personal information we hold about you
• Correction of inaccurate or incomplete personal information
• Deletion of personal information, subject to legal and business retention requirements
• Restriction or objection to certain processing activities
• Withdrawal of consent where processing is based on consent
• A copy of your personal information in a portable format, where applicable
• Information about the safeguards used for international data transfers

To exercise privacy rights, contact us at info@xsquarecapital.com. We may need to verify your identity before fulfilling a request.

15. UK and EEA Specific Rights

If you are located in the United Kingdom or European Economic Area, you may have additional rights under UK GDPR or EU GDPR. You may also have the right to lodge a complaint with your local data protection authority.

For UK users, the relevant supervisory authority is the UK Information Commissioner's Office (ICO).

16. Children's Privacy

Our website, services, and business activities are not directed to children or individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected personal information from a minor, we will take reasonable steps to delete it.

17. Third-Party Links

Our website may contain links to third-party websites or resources. We are not responsible for the privacy practices, content, or security of third-party websites. Users should review the privacy policies of those third parties independently.

18. Updates to This Privacy Policy

We may update this Privacy Policy periodically. Updates will be posted with a revised "Last Updated" date. Continued use of the website after updates are posted indicates acknowledgment of the updated policy.

19. Contact Us

For questions, requests, or concerns regarding this Privacy Policy or our privacy practices, contact:

X-Square Re I.I.
Centro Internacional de Mercadeo II, 90 PR-165 Ste 803
Guaynabo, Puerto Rico 00968
Email: info@xsquarecapital.com