Privacy

Privacy Policy

Effective date: October 8, 2026

1. Who we are

This website (thexmg.com) is operated by XMG Inc. ("XMG", "we", "us" or "our"), One World Trade Center, 85th Floor, New York, NY 10007, United States. XMG is responsible for the personal information described in this policy and, for visitors from the European Economic Area, the United Kingdom or Switzerland, acts as the data controller.

If you have any questions about this policy or how we handle your information, contact us at info@thexmg.com.

2. Information we collect

We keep the information we collect to a minimum. This website has no user accounts, contact forms, analytics or advertising tools.

• Information you send us. If you email us, for example to apply for a role or make a general enquiry, we receive your name, email address, the content of your message and any attachments, such as your CV, cover letter and the professional and educational details they contain.
• Technical information. When you visit the website, the servers that host it automatically record standard technical data, such as your IP address, browser type, device type, pages requested, the referring page and the date and time of the request. This is needed to deliver the website and keep it secure.

We do not ask for, and ask that you do not send us, sensitive information such as health data, government identification numbers or financial account details, unless we specifically request it later in a recruitment process and the law allows it.

3. How we use your information

• To respond to your enquiries and correspond with you.
• To assess your application, contact you about current or future opportunities and manage our recruitment process.
• To operate, maintain and secure the website, including detecting and preventing abuse, fraud and security incidents.
• To comply with legal and regulatory obligations and to establish, exercise or defend legal claims.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use it for automated decision-making that produces legal or similarly significant effects.

4. Legal bases (EEA, UK and Swiss visitors)

Where data protection laws such as the GDPR or the UK GDPR apply, we rely on the following legal bases:

• Legitimate interests, to answer enquiries, run our recruitment process and keep the website secure.
• Steps prior to entering into a contract, when you apply for a position with us.
• Legal obligation, where we must keep or disclose information by law.
• Consent, where we ask for it, for example to keep your CV on file for future roles. You can withdraw consent at any time.

5. How we share your information

We only share personal information where necessary:

• Service providers who process information on our behalf, such as website hosting and email providers, under contracts that require them to protect it and use it only for the services they provide to us.
• Professional advisers, such as lawyers, auditors and insurers, where needed.
• Authorities and regulators, where required by law, regulation or legal process, or to protect our rights, property or safety and those of others.
• Corporate transactions, such as a merger, acquisition or reorganisation, subject to appropriate confidentiality protections.

6. International transfers

XMG is based in the United States and your information may be processed in the United States and in other countries where we or our service providers operate. Where we transfer personal information from the EEA, UK or Switzerland, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK addendum.

7. How long we keep it

• Applications and CVs: up to 24 months after we receive them, so that we can consider you for future roles, unless you ask us to delete them sooner. If you join XMG, your information becomes part of your employee record.
• General correspondence: for as long as needed to deal with your enquiry and any follow-up.
• Server logs: for a limited period, normally no longer than 90 days, unless needed to investigate a security incident.

We may keep information longer where required by law or to establish, exercise or defend legal claims.

8. How we protect it

We use administrative, technical and organisational measures designed to protect personal information, including encrypted connections (HTTPS), access controls and restricting access to the people who need it. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and obtain a copy;
• correct inaccurate or incomplete information;
• delete your information;
• restrict or object to certain processing;
• receive your information in a portable format;
• withdraw consent where we rely on it;
• lodge a complaint with your local data protection authority.

California residents. Under the California Consumer Privacy Act, as amended, you have the right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and not to be discriminated against for exercising these rights. In the past 12 months we have collected the categories of information described in section 2 (identifiers, professional or employment-related information and internet activity information) for the purposes in section 3. We have not sold or shared personal information, and we do not use or disclose sensitive personal information for purposes that would require offering a right to limit.

To exercise any of these rights, email info@thexmg.com. We may need to verify your identity before responding, and you may use an authorised agent. We will respond within the time required by applicable law.

10. Children

This website is not directed at children under 16 and we do not knowingly collect their personal information. If you believe a child has sent us personal information, please contact us and we will delete it.

11. Cookies

This website does not use cookies or similar tracking technologies. See our Cookie Policy for details.

12. Third-party links

The website links to third-party sites, such as LinkedIn. Those sites have their own privacy policies and we are not responsible for how they handle your information.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the effective date above. Where changes are significant, we will take reasonable steps to let you know.

14. Contact us