Privacy Notice
This Privacy Notice (“Notice”) applies to personal information XChange Place, Inc. (“XChange Place,” “us,” “we,” or “our”) collects. This Notice also covers rights and choices related to your personal information, including the data handling practices of our website, and any subdomains thereof (collectively, our “Website”), the XChange Place mobile application (“Mobile App”), any other XChange Place owned or operated product or service that links to this Notice, and any associated products or services (collectively, “Services”).
This Notice will generally address:
- Personal Information We Collect
- How We Use Your Personal Information
- How We Share Your Personal Information
- Your Choices
- International Transfers
- Security
- Changes To This Privacy Notice
- Children
- Contact Us
1. Personal Information We Collect
We take your data privacy seriously and work with trusted partners to ensure your information is handled securely. We collect data about you in different ways when you use our Services. For example, we collect data:
- Directly from you. This includes when you make an account, sign up to get our emails, conduct a transaction on our Website, or contact us.
- Automatically. This includes through cookies, server logs, and other tools on our website or apps.
- From other sources. These can include our affiliates, vendors, social media, publicly available sources, and other companies.
The following are a few examples of our collection and use of data:
| Context | Examples of Personal Information | Primary Purpose and Legal Basis |
|---|---|---|
| Account Registration | We collect your name and contact information when you make an account to use our Services. We also collect data on the actions that you perform while logged in. | We have a legitimate interest in providing account related functionalities to users. Accounts are required to use our Services, save your preferences, and maintain your transaction history. |
| Client Information | We collect the name and contact information of our clients and their employees with whom we may interact. | We have a legitimate interest in contacting our clients and communicating with them about business activities such as projects, services, and billing. |
| Demographics | We collect personal information, such as your age or your region. | We have a legitimate interest in understanding our users and potential customers better. |
| Distance | Our apps may collect your location from the GPS, Wi-Fi, and/or cellular technology in your device. This lets us determine your location. | We have a legitimate interest in understanding our users and providing tailored services. In some contexts, our use is also based upon your consent to share location data. |
| Email Interactions | If you receive email from us, we use tools to capture when you open our message, click on links or banners in it, or make purchases after receiving an email. | We have a legitimate interest in understanding how you engage with our messages. |
| Feedback/Support | If you provide feedback or contact us for support, we collect your name and email, as well as other content that you send. | We have a legitimate interest in receiving and acting upon feedback. |
| Job Applicants | If you apply for a job or provide us with your personal information for purposes of employment, we collect information needed to process your application. This may include your social security number and any information on your resume. Providing this information is required for employment. | In some contexts, we are required by law to collect data about applicants. We also have a legitimate interest in using data to evaluate your application or consider you for other positions. If you become an employee, we will provide you with a separate privacy notice that explains how we collect, use, and share additional data about our employees. |
| Mailing Lists (SMS) | When you sign up for our text messaging lists, we collect your contact information. | Where required by law we will ask for your consent. We do not share your mobile number with our affiliates or with third parties for their own marketing purposes, unless you have consented to have your information shared for the purpose of receiving marketing from the third party. |
| Mailing List (Email or Mail) | When you sign up for our mailing lists, we collect your contact information. | We have a legitimate interest in sharing information about our products and services. Where required by law we will ask for your consent before communicating with you. |
| Mobile Devices | We collect information your device broadcasts when you visit our website or one of our stores. | We have a legitimate interest in identifying unique visitors and understanding how users engage with us on their mobile device. |
| Payment Information | To conduct transactions on our Services, we collect billing information (such as name, billing address, email, and phone number) and payment information (such as your bank account number, credit card number, or other financial information). | We use your information to perform our contract to provide our Services. |
| Partner Promotion | We collect data that you provide as part of co-branded promotions with other companies. | We have a legitimate interest in fulfilling our promotions. Note that many co-branded promotions involve the collection of information by us, and the other company identified in the promotion. Where data is jointly collected, your information may be submitted, or sent, to both companies. This Notice applies to our use of your data. You should review the privacy notice of the other company identified to understand their use of your data. |
| Surveys | We collect data you share through surveys. If a third-party offers a survey, the third party’s privacy notice also applies to the collection, use, and disclosure of your data. | We have a legitimate interest in understanding your opinions. |
| Use of our App or Services | We collect your username and password, as well as your interactions, when you use our App or Services. | We use your information to perform our contract to provide App-related services. We have a legitimate interest in understanding how you use our app. Where required by law, or by a mobile platform, we base the use of third-party tracking technologies upon consent. Users should go the settings menu in their mobile device for more information about changing App preferences. |
| Use of Our Website | We use technology (e.g., a cookie or a pixel) to learn how you engage with our websites. This may include which links you click or what you type into our online forms. We may also track your IP address, the website that referred you to us, and data about your device. | We have a legitimate interest in making our website operate. We also use it to understand how you interact with our websites, gather analytics, improve our websites, and learn your preferences. We may also use this data to help detect and prevent fraud. Where required by law, we base the use of technologies upon consent. |
| User Content | If you choose to engage in forums, blogs, or other similar features offered by us, we may maintain records about the content you post. This might include comments, reviews or questions as well as metadata associated with your content. | We use this data to understand your opinions and foster a safe environment on our websites. |
| Website Targeted Advertising Technology | We may let third parties place tracking technology on our websites (e.g., a cookie or a pixel). The third party might also collect data over time and across other websites. Among other things, they may use this data to serve ads tailored to your interests, which may include ads about our products or services. | Where required by law, we base the use of third-party tracking technologies upon consent. Users should see our Cookie Policy for more information. You can also find more information about your options with regard to this technology in the Your Choices section below. |
Sensitive Information Disclosure. We may collect the following categories of sensitive personal information (as defined under relevant laws): social security, driver’s license, state identification card, or passport number; account log-in, financial account, debit or credit card number in combination with any required security or access code, password, or credentials; precise geolocation; or racial or ethnic origin. We collect this data to process transactions, comply with laws, manage our business, or provide services. Note that we do not use such data for any purposes that are not identified within Cal. Civ. Code § 1798.121. We do not “sell” or “share” sensitive personal information for cross-context behavioral advertising, although we may transfer it to third parties when you instruct us to do so. When that occurs, third parties will use it for the purposes indicated in their privacy notices.
If you are in Canada, our lawful basis for processing your data is generally consent.
2. How We Use Your Personal Information
We will only use your personal information as described in this Notice or as disclosed to you prior to such processing taking place.
- To Provide Services to You. We process your personal information to provide you with the Services. For example, we process your personal information to open and verify your account and carry out your requested transactions.
- To Provide You with Service-Related Communications. We will send you important communications about your account and our Services. Such communications may include information about system updates, changes to terms or policies, and confirmations of account actions or transactions.
- To Provide Customer Support or Respond to Queries. If you contact customer support, we will collect any information that you provide to us, such as your contact information, concerns, feedback, disputes, or queries. We will use this information to respond to you and resolve your issues.
- To Enforce Compliance with Our Agreements, Terms, or Policies. We may process your personal information by actively investigating, preventing, and mitigating illegal activities on our Services. We also process your personal information to investigate, prevent, or mitigate violations of our agreements, terms, or policies.
- To Ensure the Security of the Services. We process your activity and device information to combat spam, malware, malicious activities or other security risks; improve and enforce our security measures; and to monitor and verify your identity so that unauthorized persons do not gain access to your information.
- To Maintain Legal and Regulatory Compliance. Our Services are subject to certain laws and regulations which may require us to process your personal information. For example, we process your personal information to pay our taxes, to fulfill our business obligations, and to manage risk as required under applicable law.
- To Conduct Research and Development. We may use information about how you access and use the Services for research and product development or conduct analytics. When we do so, we may take on additional security measures to protect your personal information, such as de-identifying, anonymizing or aggregating your information with other user information, limiting access to certain authorized personnel members, or applying other reasonable security measures.
- To Engage in Marketing Activities. We may use your personal information to inform you about new products and services which may interest you or to inform you about the products or services of our business partners.
- To establish or exercise our rights. We may use your personal information to enforce our policies, exercise our contractual or other rights, or defend against legal claims.
- For other reasons with your consent.
The sections above describe our main purposes in collecting your data, but often we have multiple purposes. For instance, if you conduct a transaction on our Services, we may collect your information to perform our contract with you. We also have a legitimate interest in maintaining that data so that we can easily address questions about an order. As a result, our collection and processing of your data is based in different contexts on your consent, our need to perform a contract, our legal obligations, and/or our legitimate interest in conducting our business.
To the extent we store and use deidentified personal information, we will not try to reidentify the information, except to test our deidentification methods. If we share deidentified data we will obligate the recipient not to try to reidentify the data.
3. How We Share Your Personal Information
We may disclose your personal information as described below.
- Affiliates and Acquisitions. We may share data with our affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If a company acquires or enters negotiations to acquire our company, business, or assets, we may share data with that company.
- Service Providers. We may share your data with service providers. Service providers may help us to run our website, conduct surveys, provide technical support, process payments, fulfill orders, and more.
- Other Disclosures without Your Consent. We may share data to cooperate with law enforcement, participate in a legal process, or for legal compliance. We may share your data to establish or exercise our rights, to defend against legal claims, to investigate, prevent, or act on possible illegal activities, threats to safety of person or property, or a violation of our policies. Your data may be shared to ship products to you.
- Public. Some of our websites may allow for comments or reviews in a public forum. If you post on these pages, what you share may be publicly available.
- Professional Services. We may share personal information with our professional service providers, such as auditors or lawyers.
- Other Disclosures with Your Consent. We may share your data with third parties when you consent or direct us to.
Some jurisdictions require us to disclose whether the following categories of personal information are collected, shared with third parties for a “business purpose,” or “sold,” or transferred for “valuable consideration.” The table below indicates the categories of personal information we collect and transfer in a variety of contexts. We do not “sell” your personal information for money. Because our services are not intended for children, we have no actual knowledge that we share for targeted advertising any personal information of individuals who are under 16 years of age.
| Category of Personal Information | Disclosures for a Business Purpose | Sharing for Targeted Advertising | Sales |
|---|---|---|---|
| Identifiers – this may include things like name, alias, postal address, unique personal identifier, online identifier, email address, or account name. |
|
| |
| Government Issued Identification – this may include things like social security number, driver’s license number, or state issued identification number. |
| ||
| Financial Information – this may include bank account number, credit card number, debit card number, and other financial information. |
| ||
| Health Related Information – this may include medical information, mental or physical condition or treatment, or health insurance information. |
| ||
| Characteristics of protected classifications – this may include age, sex, race, ethnicity, physical, or mental handicap, etc. |
| ||
| Commercial information – this may include information about products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. |
| ||
| Biometric information – this may include a biological or behavioral characteristic used to establish a person’s identity. |
| ||
| Internet or other electronic network activity information – this may include browsing history, search history, and information regarding an individual’s interaction with an internet website, app, or ad. |
| ||
| Geolocation data – this could include precise or non-precise geolocation information. |
| ||
| Audio, electronic, visual, thermal, olfactory, or similar information |
| ||
| Professional or employment-related information – this includes, for example, information submitted by job applicants. |
| ||
| Non-public education information (as defined in the Family Educational Rights and Privacy Act) |
| ||
| Inferences drawn from any of the information listed above |
| ||
| Additional categories of personal information described in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) – this may include signature, physical characteristics, or description, insurance policy number. |
|
4. Your Choices
Some jurisdictions give you a right to make the following choices:
- Access. You may request access to your personal information or confirmation that we have data about you. In certain limited cases, you may ask to receive access to your data in a portable, machine-readable form.
- List of Third-Party Recipients. You may request a list of specific third parties to which we have disclosed personal information. Some areas also allow you to obtain a list of the categories of third parties to which we have disclosed personal information. You can find that information in the table above under the “How We Share Data” section.
- Change. Most of our Websites allow you to change your account profile. If our website does not permit you to update or correct certain information, you can ask us to correct inaccurate or incomplete data by contacting us at the address below. We may keep historical data in our backup files as permitted by law.
- Deletion. You may ask us to delete your personal information. If required by law, we will grant such a request, but note that in many cases, we must keep your personal information to comply with legal obligations, resolve disputes, enforce agreements, or for other business purposes.
- Opt-out of Website Targeted Advertising. You may opt-out of online targeted advertising (e.g., cookies) by via your browser settings as described in our Cookie Policy. Note that if you change browsers or devices, or if you clear your browser’s cache, you may need to click the link again to apply your preference. You may opt-out of other forms of targeted advertising by submitting a request as described below. We recognize Global Privacy Control (GPC) signals broadcast from web browsers as a valid opt-out request where required by applicable law. Please note that the GPC will apply only to your current browser. We do not recognize the “Do Not Track Signal.” If there is a conflict between the GPC signal and a manual choice that you have made on our website regarding targeted advertising, we will honor your manual choice.
- Opt-out of App-Based Targeted Advertising. You may opt-out of App-based targeted advertising (e.g., SDKs with advertising partners) by going to the settings menu in your mobile device.
- Objection to or Restriction of Certain Processing. In certain circumstances, you may object to the processing of your personal information, or ask that we restrict processing of your personal information. To do so, follow the instructions below.
- Promotional Emails. You may provide us with your email address to allow us to send newsletters, surveys, offers, or other promotional content, as well as targeted offers from third parties. You can stop receiving such emails by following the unsubscribe instructions at the bottom of those emails. If you choose not to receive such emails, we may still send you service-related communications.
- Promotional Mailings. If you do not want to receive offers and/or circulars from us, email us with “NO SNAIL MAIL” in the subject line, and include your name, address, and zip code. Note that our mailings are prepared before we send them. We will remove your name from our mailing list after receiving your request, but you may receive mailings from us that were prepared prior to processing your request.
- Promotional Text Messages. If you get a text message from us that has promotional content, you can opt-out of future text messages by replying “STOP.”
- Revocation Of Consent. Where we process your personal information based upon consent, you may revoke consent. Note, if you revoke consent for processing personal information, we may no longer be able to provide you some types of services.
- Geolocation Data. You can turn off geolocation data for mobile apps through your mobile device’s privacy settings.
- California Shine the Light. If you would like more information on the categories of personal information (if any) we share with third parties or affiliates for those parties to use for direct marketing, submit a written request using the information in the Contact Information section.
Not all the rights above are absolute, and they do not apply in all circumstances. We may limit or deny a request because the law permits or requires us to. We will not discriminate against individuals who exercise a privacy right.
Submitting Requests
You may exercise the above rights by contacting us at support@xchangeplace.freshdesk.com. If you disagree with our denial of a request, you may appeal our decision by contacting us with the subject line “Appeal.”
We will require you to prove your identity when making most types of requests. We may verify your identity by phone or email. Depending on your request, we will ask for information such as your name, the last item you purchased from us, or the date of your last purchase from us. We may also ask you to send us a signed declaration confirming your identity.
In some circumstances, you may designate an authorized agent to exercise rights on your behalf. If you are an authorized agent, you must provide a signed and notarized permission from the consumer stating that the agent has authorization to act on their behalf.
5. International Transfers
Depending on the scope of your interactions with our Services, your personal information may be stored in, transferred to, or accessed from multiple countries. Such countries may be located outside of the country or jurisdiction where you are located and may have data protection laws that are less protective than the laws of the jurisdiction in which you reside. Where possible, we treat personal information using the same privacy principles that guide the law of the country in which we first receive your data. By submitting your personal information to us you agree to the transfer, storage, and processing of your data in a country other than your country of residence including, but not limited to, the United States. For more information on our attempts to apply the privacy principles applicable in one area to data when it goes to another, contact us using the contact information below. You may also request a copy of any Standard Contractual Clauses we use for the transfer of your data outside of the EEA, which includes the categories of information transferred by contacting us using the contact information below.
6. Security
No method of internet transmission or electronic storage is fully secure. While we use reasonable efforts to protect personal information, we cannot guarantee its security. If we are required to inform you about a security incident, we will do so electronically, in writing, or by phone, as the law permits.
Some of our websites permit you to create an account. You are responsible for selecting a unique and complex password and keeping it confidential. You are responsible for any access to or use of your account by someone who has obtained your password, whether or not you approved of such access or use. Notify us of unauthorized use of your password or account immediately.
We keep your personal information for only as long as necessary to fulfil the purposes in this Notice unless a longer retention period is required or permitted by law. This includes the purposes of satisfying legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the data. We also weigh the potential risk of harm from unauthorized use or disclosure of the data, the purposes for which we obtained the data and whether we can meet those purposes through other means, as well as applicable legal requirements.
7. Changes To This Privacy Notice
We may change our Notice and privacy practices. New notices will be published on our website. If changes are material, we will notify you by posting an update on our website or by email, if required by applicable law. Also, if changes are material, the Notice that was in place when you submitted personal information to us will generally govern that data unless you consent to the new Notice. Our Notice shows “effective” and “last updated” dates below. The effective date is the date the current version took effect. The last updated date is the date the current version was last substantively changed.
8. Children
We do not knowingly collect personal information from any person under the age of 18. If XChange Place has reason to believe that a user under the age of 18, XChange Place will require the user to close their account and will not allow them to conduct transactions. We will also take steps to delete information about the user as soon as possible. Please notify us if you know of any individuals under the age of 18 using our Services so that we can take action to prevent access to our Services.
9. Contact Us
Trust and transparency are our top priorities. If you have questions or complaints about our privacy practices, or if you need to access this Notice in a different form due to a disability, please contact us. We will try to address your requests and provide you with additional privacy-related information.
support@xchangeplace.freshdesk.com
6 East 69th Street
New York, NY 10021
646 752 7506
If you are not satisfied with our response and are in the European Union or United Kingdom, you may have a right to lodge a complaint with your local supervisory authority.
Effective Date: June 8, 2026
Last Update: June 8, 2026