Privacy Policy

The controller responsible for processing personal data on this website and on the X-SHARE platform within the meaning of the General Data Protection Regulation (GDPR) is:

Company

X-SHARE Technologies GmbH

Address

Messerschmittstraße 3, 86825 Bad Wörishofen, Germany

Represented by

Igor Mikulina and Johannes Ried, Managing Directors

Phone

+49 8247 96294-05

Email

info@x-share.eu

For any data protection question and to exercise your rights, contact us at info@x-share.eu or by post at the address above, marked “Data protection”.

This policy covers two services that differ considerably in how much data they process:

• The website you are visiting. It informs about X-SHARE and collects no data itself: registration and login take place on the IndustryFusion platform or the X-SHARE platform. It sets no cookies, uses no analytics or tracking services and loads no content from third-party servers.
• The X-SHARE platform for sheet-metal companies: company registration, CAD uploads, calculation, quotation and order. It is in its pilot phase. Functions that become available only with the full platform launch are marked “At platform launch” in this policy.

We do not sell personal data and do not pass it on to third parties for advertising.

When you open the website, your browser necessarily transmits data to our server. We process:

• IP address
• date and time of access
• page or file requested and amount of data transferred
• referrer URL (the page visited before), if your browser sends it
• browser type, operating system and HTTP status code

The purpose is to deliver the website and to keep it secure and stable, for example by fending off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the site. We delete server log files after 14 days at the latest, unless a specific security incident requires keeping them longer until it has been resolved.

The website runs on the cloud infrastructure of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in data centres in the European Union. IONOS processes the data as our processor, on our instructions.

Fonts and every other part of the website are served from our own server. Opening the site makes no connection to third-party servers, such as Google Fonts or content delivery networks.

This website sets no cookies and stores no information in your browser, for example in local storage. We use no analytics, tracking or marketing tools and embed no third-party content such as maps, videos or social media plugins. Consent under Section 25 of the German TDDDG is therefore not required, and you will not see a cookie banner.

On the X-SHARE platform, a login token is stored in your browser after you sign in; it keeps your session active for up to 14 days unless you sign out. This storage is strictly necessary for the service you request (Section 25(2) no. 2 TDDDG). For the use of Google reCAPTCHA at registration, see “Platform: registration and user account”.

Should we use services that require consent in future, we will ask for it beforehand through a consent tool and update this policy.

When you contact us by email or phone, we process your details — such as name, contact data, company and the content of your enquiry — to handle your request. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. We use an email service provider as our processor.

Request buttons and forms on this website (for example for a machine quote or a live demo) send nothing to our server. They open your email program with a prepared message to info@x-share.eu; we receive your details only once you send it, and this section applies. Your entries are not stored in your browser.

We delete the data once your enquiry has been fully handled. Business correspondence is kept for the retention periods required by German commercial and tax law (Section 257 HGB, Section 147 AO; six, eight or ten years depending on the document).

To use the platform, you register your company and create a user account. Registration takes place via the IndustryFusion platform (platform.industry-fusion.com) or at cockpit.x-share.eu, login at cockpit.x-share.eu; the IndustryFusion platform's own privacy notice also applies there. We process:

• required: email address, password, first and last name, salutation, phone number, company and country
• optional: VAT identification number
• can be added later in the account: billing and delivery address, bank details and company logo
• account data: role (such as buyer or manufacturer), language setting, time of registration and of last login

After registering, you receive an email with a confirmation link; you can sign in only after confirming. The purpose is to provide the platform and perform the user agreement; the legal basis is Art. 6(1)(b) GDPR. The required details are necessary for the contract; without them we cannot set up an account.

We store account data for as long as your account exists. After the account is deleted, we remove it within 30 days unless statutory retention obligations apply, for example to quotes, orders and invoices. Such data is restricted until the retention period ends.

To protect against automated registrations and login attempts, the platform uses Google reCAPTCHA. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, acting as a processor. Your IP address and information about how you use the form are processed, including by Google LLC in the USA. The purpose is preventing abuse and automated attacks. reCAPTCHA is loaded only after you have consented (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); you can withdraw consent at any time with effect for the future.

On the platform you upload CAD files (such as STEP), technical drawings and project details such as material, quantity and delivery date. From these, the system produces a part analysis, flat pattern, previews and a calculation. Quotes and orders are assigned to your company account and stored with your name as their creator.

These documents are primarily your company’s trade secrets, but they can contain personal data, such as the names of engineers in drawing title blocks or file metadata. We process them only for your own enquiries and orders — for calculation, quotation and order handling — on the basis of Art. 6(1)(b) GDPR. On confidentiality:

• Only authorised users of your company account and the manufacturer you send an enquiry or order to have access.
• Download links to your files are valid for 24 hours only.
• Files are stored in data centres in Frankfurt am Main.

We keep project data until you delete it or your account is deleted. Documents relating to quotes and orders are subject to statutory retention periods.

Calculation is automated: from geometry, material and quantity, the system determines manufacturing effort and price. If a part cannot be calculated automatically, the manufacturer reviews it manually.

The calculation assesses parts, not people. Whether a quote is issued or accepted, or an order is placed, is always decided by you or the manufacturer concerned. No decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you takes place within the meaning of Art. 22 GDPR.

With the full platform launch, you can pass orders you do not make yourself to partners in the X-SHARE network (Make-or-Share). A partner receives only what you release for that order and what it needs to assess and produce it:

• part geometry
• material and quantity
• delivery date
• required machine capability

Your end customer, your sales price and margin, and your full capacity plan are not passed on. Enquiries in the network are sent without your company details; only once you place an order does the partner receive the contact and delivery details needed to fulfil it. The exchange runs through data spaces (IF-X Data Spaces), where every release is bound to a usage policy and can be revoked.

The legal basis is Art. 6(1)(b) GDPR. The partner processes the data for production as a separate controller.

With the full platform launch, the XANA decision engine supports the make-or-share decision: it matches orders against free capacity and machine capability and suggests whether an order can be made in-house or shared in the network. It works on order and company data.

XANA does not build profiles of natural persons. Its suggestions are recommendations — the decision is always made by a person in your company. No automated decision-making within the meaning of Art. 22 GDPR takes place. The legal basis is Art. 6(1)(b) GDPR.

Personal data goes only to the following parties, and only as far as the purpose requires. Processors act solely on our instructions under a contract pursuant to Art. 28 GDPR.

IONOS SE

Website hosting · Montabaur, Germany · processor

goCAD GmbH

Technology partner for CAD analysis, calculation and quotation; operates the platform application · Am Stadtpark 80, 70435 Stuttgart, Germany · processor

Amazon Web Services EMEA SARL

Storage of platform files in Frankfurt am Main · 38 Avenue John F. Kennedy, L-1855 Luxembourg · sub-processor of goCAD

Google Cloud EMEA Limited

reCAPTCHA at platform registration and login · Dublin, Ireland · sub-processor, only with your consent

Email service provider

Sending and receiving email · processor

Manufacturing partners

only the data released for an order · separate controllers · at platform launch

Authorities and courts

only where we are legally obliged

The website processes personal data exclusively in the European Union. Platform files are stored in Frankfurt am Main.

Some providers belong to groups headquartered in the USA (Amazon Web Services, Google). Access from the USA therefore cannot be ruled out entirely, and with Google reCAPTCHA data is also processed by Google LLC in the USA. Google LLC and Amazon Web Services, Inc. are certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision under Art. 45 GDPR. The European Commission’s Standard Contractual Clauses apply in addition (Art. 46(2)(c) GDPR).

Server log files

14 days at most

Contact enquiries

until fully handled; business correspondence for the statutory periods

Platform account

for as long as the account exists; deleted within 30 days of account deletion

Projects and CAD files

until you delete them or your account is deleted

Quotes, orders, invoices

statutory retention under Section 257 HGB and Section 147 AO: six, eight or ten years

We protect personal data with technical and organisational measures under Art. 32 GDPR, which we keep in line with the state of the art. These include in particular:

• encryption of every connection via TLS (HTTPS)
• access rights tied to company account and role — manufacturers see only what has been released to them
• time-limited download links for files
• website hosting and platform file storage in data centres in the European Union
• staff access only where their task requires it

You have the right at any time to:

• access the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability in a common, machine-readable format (Art. 20 GDPR)
• withdraw consent you have given, with effect for the future (Art. 7(3) GDPR)

For any request, an email to info@x-share.eu is enough. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de

We update this policy when our data processing changes — in particular before the full platform launch and before we introduce new services. The version published on this page applies.