GDPR Privacy Policy
Last updated: May 20, 2026
This Privacy Policy describes how Xasolilo ("we," "us," or "our") collects, uses, stores, and protects personal data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws. By using our platform at xasolilo.world, you acknowledge that you have read and understood this policy.
1. Data Controller
Xasolilo acts as the data controller for personal data collected through our platform and services. If you have questions or concerns regarding the processing of your personal data, you may contact us at:
Email: [email protected]
Phone: +6282285756961
Address: Jl. Kayu Ambon No.82, Kayuambon, Kec. Lembang,
Kabupaten Bandung Barat, Jawa Barat 40391, Indonesia
2. Personal Data We Collect
We collect personal data that you provide directly, data generated through your use of our services, and data received from third parties where applicable.
2.1 Data You Provide Directly
Account registration: name, email address, password, and
profile information.
Payment information: billing name, address, and payment method
details processed through secure third-party payment processors.
Communication: messages, feedback, and support requests you
send to us.
Learning content: assignments, responses, and materials
submitted during sessions.
2.2 Data Collected Automatically
Usage data: pages visited, features used, session duration, and
interaction patterns.
Technical data: IP address, browser type and version, operating
system, device identifiers, and time zone.
Cookies and similar technologies: session tokens, preference
cookies, and analytics identifiers as described in our Cookie Policy.
2.3 Data From Third Parties
We may receive data from authentication providers if you choose to sign in using a third-party account, from payment processors confirming transaction status, and from analytics partners providing aggregated usage insights.
3. Legal Bases for Processing
We process your personal data only when a valid legal basis exists under the GDPR. The legal bases we rely upon are:
| Processing Purpose | Legal Basis |
|---|---|
| Providing and managing your account and learning services | Performance of a contract (Article 6(1)(b)) |
| Processing payments and preventing fraud | Performance of a contract; Legitimate interests (Article 6(1)(b), (f)) |
| Sending transactional and service-related communications | Performance of a contract (Article 6(1)(b)) |
| Sending marketing and promotional communications | Consent (Article 6(1)(a)) |
| Improving platform functionality and user experience | Legitimate interests (Article 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Article 6(1)(c)) |
| Analytics and performance measurement | Legitimate interests (Article 6(1)(f)) |
| Personalizing learning paths and recommendations | Consent or Legitimate interests (Article 6(1)(a), (f)) |
4. How We Use Your Personal Data
We use collected personal data for the following purposes:
Service delivery: to create and manage your account, provide access to courses and sessions, facilitate live interactions with instructors, and deliver personalized learning paths.
Communication: to send you account notifications, session reminders, support responses, and, where you have consented, promotional content about new courses or features.
Platform improvement: to analyze usage patterns, diagnose technical issues, conduct research, and develop new features that improve the learning experience.
Security and integrity: to detect, prevent, and respond to fraud, abuse, security incidents, and violations of our terms of service.
Legal compliance: to fulfill obligations imposed by applicable laws, regulations, court orders, or lawful requests from public authorities.
5. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to operate our platform, remember your preferences, maintain session security, and gather analytics data. Cookies fall into the following categories:
Strictly necessary cookies: required for the platform to function. These cannot be disabled without affecting core functionality.
Preference cookies: store your settings such as language, time zone, and display preferences.
Analytics cookies: help us understand how users interact with our platform. These are only placed with your consent.
Marketing cookies: used to deliver relevant communications. These are only placed with your explicit consent.
You may manage your cookie preferences through your account settings or your browser settings at any time. Withdrawing consent for non-essential cookies does not affect the lawfulness of prior processing.
6. Data Sharing and Disclosure
We do not sell your personal data. We share personal data only in the following circumstances:
6.1 Service Providers
We engage trusted third-party service providers to perform functions on our behalf, including cloud hosting, payment processing, email delivery, customer support tooling, and analytics. These providers are bound by data processing agreements and are permitted to use your data only to perform services for us.
6.2 Instructors and Learning Partners
When you enroll in a course or session, relevant data such as your name, progress, and submitted work may be shared with the instructor or learning partner facilitating that session, to the extent necessary for the delivery of the educational service.
6.3 Legal Requirements
We may disclose personal data when required to do so by law, regulation, legal process, or enforceable governmental request, or when we believe disclosure is necessary to protect the rights, safety, or property of Xasolilo, our users, or the public.
6.4 Business Transfers
In the event of a merger, acquisition, reorganization, or sale of assets, personal data may be transferred as part of that transaction. We will notify affected users before personal data becomes subject to a different privacy policy.
7. International Data Transfers
As an international platform serving learners across multiple regions, your personal data may be transferred to and processed in countries other than the country in which you reside. When transferring personal data outside the country of collection, we ensure appropriate safeguards are in place, which may include:
Standard Contractual Clauses (SCCs) approved by relevant data
protection authorities.
Adequacy decisions confirming that the destination country
provides an adequate level of data protection.
Binding Corporate Rules or other recognized transfer mechanisms
where applicable.
By using our services, you acknowledge that your data may be transferred internationally in accordance with the safeguards described above.
8. Data Retention
We retain personal data for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.
Account data is retained for the duration of your active account and for a reasonable period thereafter to allow account reactivation or resolve disputes.
Transaction records are retained for the period required by applicable financial and tax regulations.
Communication records are retained as long as necessary to resolve the matter and for a reasonable period for audit purposes.
Analytics data is retained in aggregated or anonymized form and does not constitute personal data once anonymized.
When personal data is no longer required, we securely delete or anonymize it.
9. Your Rights Under GDPR
If you are located in the European Economic Area or another jurisdiction with equivalent data protection legislation, you have the following rights regarding your personal data:
9.1 Right of Access
You have the right to request a copy of the personal data we hold about you and information about how it is processed.
9.2 Right to Rectification
You have the right to request correction of inaccurate or incomplete personal data we hold about you.
9.3 Right to Erasure
You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent and no other legal basis applies, or where the data has been unlawfully processed.
9.4 Right to Restriction of Processing
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.
9.5 Right to Data Portability
You have the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
9.6 Right to Object
You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing your data for that purpose immediately.
9.7 Rights Related to Automated Decision-Making
You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. Where we use automated processes to personalize your learning experience, a human review is available upon request.
9.8 Right to Withdraw Consent
Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
9.9 Right to Lodge a Complaint
You have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction if you believe our processing of your personal data violates applicable data protection law.
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. In complex cases, we may extend this period by an additional 60 days and will notify you accordingly.
10. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include encryption of data in transit using TLS, access controls limiting data access to authorized personnel, regular security assessments and audits, and incident response procedures.
While we take reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security and encourage you to use strong, unique passwords and to contact us immediately if you suspect unauthorized access to your account.
11. Children's Privacy
Our platform is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16 without verifiable parental or guardian consent. If we become aware that we have collected personal data from a child under 16 without appropriate consent, we will take steps to delete that data promptly. If you believe we may have collected data from a child under 16, please contact us at [email protected].
12. Third-Party Links and Services
Our platform may contain links to third-party websites, tools, or services. This Privacy Policy applies solely to data processed by Xasolilo. We are not responsible for the privacy practices of third parties and encourage you to review the privacy policies of any third-party services you access through our platform.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will notify you by email or through a prominent notice on our platform prior to the changes taking effect. The date at the top of this policy indicates when it was last revised. Your continued use of our services after the effective date of any changes constitutes your acknowledgment of the updated policy.
14. Contact Us
If you have questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact us:
Xasolilo
Email: [email protected]
Phone: +6282285756961
Address: Jl. Kayu Ambon No.82, Kayuambon, Kec. Lembang,
Kabupaten Bandung Barat, Jawa Barat 40391, Indonesia
Website: xasolilo.world
We are committed to working with you to resolve any concerns about your privacy in a fair and timely manner.