Privacy Policy

Data Protection & Institutional Information Governance

Exanteon is an independent infrastructure for voluntary ex-ante governance, operated by SIA EBL Consulting.

This Privacy Policy explains how personal data are processed in connection with the Exanteon website, institutional membership, authenticated access, governance protocols and related services.

Exanteon's principal purpose is to maintain attributable records of commitments and subsequently reported developments between eligible legal entities. It is not designed to monitor individual consumers or evaluate their personal behaviour.

Nevertheless, information relating to identifiable individuals may be processed in the course of institutional operations and remains protected by applicable data protection law.

Data Controller and Responsibilities

SIA EBL Consulting, registration number 50203595801, Kaļķu iela 7, Rīga, LV-1050, Latvia, is responsible as data controller for personal data processing activities whose purposes and essential means it determines, including the administration of its website, institutional relationships and user accounts.

Contact: mail@exanteon.com

For processing involving governance records submitted by participating institutions, the allocation of responsibilities between Exanteon and those institutions depends on the purposes and means of the relevant activity.

Exanteon may act as a controller, joint controller or processor, as applicable. These responsibilities must be established through the relevant contractual and data-processing arrangements.

Where Exanteon acts as a processor, personal data are processed under the documented instructions of the responsible controller, subject to applicable law.

Categories and Sources of Data

Exanteon primarily processes information relating to legal entities and institutional commitments.

Where personal data are involved, the relevant categories may include:

Professional identification and contact information of representatives, administrators and authorised users.
Institutional affiliation, professional role, reporting authority and access permissions.
Account authentication information, technical identifiers, access logs and security-related metadata.
Communications, institutional onboarding information and records of contractual acceptance.
Personal information incidentally contained in authorised institutional declarations, correspondence or governance documentation.

Information may be collected directly from individuals, submitted by participating institutions, generated through the use of Exanteon services or obtained from lawful institutional identity and verification sources.

Members are expected to submit only information permitted by the applicable protocol and necessary for its defined purpose.

The infrastructure is not intended to collect special-category personal data, individual consumer profiles or personal behavioural assessments. Such information must not be submitted unless expressly authorised, legally justified and supported by appropriate safeguards.

Purposes of Processing

Personal data may be processed for the following purposes:

Institutional identification, eligibility verification and membership administration.
Authentication of authorised representatives and management of access permissions.
Operation and security of applicable governance protocols.
Attribution of submissions, technical notarisation and preservation of authorised records.
Administration of contractual relationships, billing and relevant legal obligations.
Prevention, investigation and management of unauthorised access, misuse and technical security incidents.
Institutional communications, enquiries and service-related notifications.
Handling of data-subject requests, corrections, objections and disputes where applicable.

Information is processed only for specified, legitimate purposes and according to the applicable legal basis.

Legal Bases of Processing

The legal basis depends on the specific processing activity and the relationship concerned.

Legal obligations — Article 6(1)(c) GDPR

Processing necessary to comply with applicable statutory obligations, including relevant accounting, legal and regulatory requirements.

Legitimate interests — Article 6(1)(f) GDPR

Processing necessary for legitimate purposes such as institutional administration, professional communication, account security, protection of infrastructure integrity and prevention of misuse, provided those interests are not overridden by individuals' rights and freedoms.

Contractual necessity — Article 6(1)(b) GDPR

Processing necessary for a contract with the individual concerned or pre-contractual steps requested by that individual, where this legal basis applies.

A contract concluded with a legal entity does not automatically make contractual necessity the appropriate legal basis for processing the personal data of all its representatives.

Consent — Article 6(1)(a) GDPR

Processing based on valid consent where required, including certain optional communications or non-essential tracking technologies.

Consent may be withdrawn at any time, without affecting processing lawfully undertaken before withdrawal.

Where Exanteon processes personal data on behalf of another controller, the relevant controller remains responsible for establishing an appropriate legal basis for that processing.

Organisational Indicators and Profiling

Exanteon is designed to record institutional commitments and their subsequently reported evolution, not to evaluate individual consumer behaviour.

Certain governance protocols may generate defined organisational indicators from attributable declarations and reported events.

These indicators concern the relevant institutional reporting framework and do not constitute independent verification or certification of conduct.

Exanteon is not designed to make decisions based solely on automated processing that produce legal or similarly significant effects on natural persons.

Where any processing constitutes profiling within the meaning of the GDPR, the relevant transparency, lawful-basis and data-protection requirements apply.

The use of organisational indicators does not remove GDPR protections where information can be linked to identifiable individuals.

Technical Notarisation and Tokenisation

Exanteon uses technical recording and notarisation mechanisms to preserve evidence concerning submitted information, its attributed source, integrity and recording time.

Cryptographic references, hashes, tokens or other technical identifiers may be used where supported by the applicable implementation.

Technical notarisation concerns the record. It does not independently establish the truth, accuracy or legal validity of the underlying declaration.

Tokenisation, hashing or pseudonymisation does not necessarily make information anonymous. Where an individual remains identifiable, the relevant information continues to be treated as personal data.

Exanteon's technical evidentiary mechanisms are not intended to create tradable financial instruments or confer legal certification of underlying institutional conduct.

Recipients, Service Providers and HeyData Affiliation

Personal data may be accessible, where necessary and lawfully permitted, to:

Authorised Exanteon personnel and service administrators.
Contracted hosting, infrastructure, authentication, security and technical service providers.
Payment, accounting, legal and professional service providers where relevant.
Authorised participating institutions or other recipients under defined protocol access arrangements.
Competent authorities where disclosure is legally required or otherwise lawfully authorised.

Service providers processing personal data on Exanteon's behalf are subject to appropriate contractual and data-protection obligations.

Where participating institutions receive information for their own purposes, they may have independent data-protection responsibilities.

HeyData affiliation

SIA EBL Consulting maintains an affiliate or partner relationship with heyData, a provider of data-protection and compliance-related services.

This affiliation does not, by itself, constitute GDPR certification, appointment of heyData as Exanteon's Data Protection Officer, or authorisation to disclose Exanteon member information to heyData.

Any separate processing, advisory or data-protection services involving heyData are subject to the relevant contractual arrangements and applicable legal requirements.

Cross-Border Transfers

Where personal data are transferred outside the European Economic Area, Exanteon applies the requirements of Chapter V of the GDPR.

Depending on the recipient and destination, lawful transfer mechanisms may include European Commission adequacy decisions, approved Standard Contractual Clauses or other applicable safeguards.

Additional measures are considered where required by the circumstances of the transfer.

Information about applicable transfer safeguards may be requested through Exanteon's data-protection contact.

Data Retention

Personal data are retained only for as long as necessary for the relevant processing purpose, subject to applicable legal obligations and justified retention requirements.

Retention is determined according to the category of information and its purpose.

Account and membership information is retained during the relevant institutional relationship and, where justified, for subsequent contractual, legal or administrative requirements.

Billing and accounting information is retained in accordance with applicable statutory obligations.

Authentication and security logs are retained for defined periods proportionate to operational security and incident-investigation requirements.

Governance-related personal data are retained according to applicable protocol terms, legitimate evidentiary purposes, contractual responsibilities and data protection requirements.

The persistent character of an Exanteon governance record does not override mandatory personal-data rights or lawful retention limitations.

Where correction, restriction or erasure is required, Exanteon applies the relevant procedures according to its legal role and the applicable processing arrangements.

Data Commercialisation and Disclosure Policy

SIA EBL Consulting does not operate Exanteon as a marketplace for personal data or as a commercial data-brokerage service.

The infrastructure is designed to provide governance-recording, technical notarisation and controlled observability services.

Personal data and institutional governance information are not sold or rented as commercial datasets to unrelated third parties.

Access to governance records is governed by applicable protocol conditions, authorisation arrangements, confidentiality obligations and legal requirements.

Depending on the circumstances, access may rely on valid contractual permissions, an appropriate legal basis, applicable consent or another lawful disclosure mechanism.

Institutional authorisation does not replace the legal rights of identifiable natural persons.

No protocol grants unrestricted public access to all recorded information merely by virtue of participation.

Cookies and Website Technologies

The Exanteon website and authenticated platform may use technologies necessary for functionality, authentication, security and user preferences.

Optional analytics, third-party integrations or other non-essential tracking technologies are subject to applicable transparency and consent requirements.

Where consent is required, non-essential technologies must not be activated before valid consent has been obtained.

Users must be able to withdraw consent through an accessible mechanism.

Information about the specific cookies and similar technologies actually used, their providers, purposes and retention periods is made available through the applicable cookie information and preference controls.

Security and Data Protection by Design

Exanteon's governance architecture is based on institutional attribution, defined access permissions, data minimisation and the separation of recording functions from downstream decisions.

Appropriate technical and organisational safeguards must reflect the nature of the information processed and the associated risks.

These may include authentication, restricted access, audit logging, integrity protection, secure communications and incident-response procedures, according to the implemented systems.

Exanteon's independent recording infrastructure does not imply unrestricted data disclosure.

Security arrangements and data-protection responsibilities may be further documented in applicable contractual or institutional due-diligence materials.

Rights of Data Subjects

Individuals have rights under the GDPR, subject to applicable conditions and limitations.

These include the rights of access, rectification, erasure, restriction of processing, objection and, where applicable, data portability.

Individuals may withdraw consent where processing is based on consent and may exercise rights relating to qualifying automated decision-making.

Requests may be sent to:

mail@exanteon.com

Exanteon will assess requests according to its role in the relevant processing activity.

Where another participating institution is the responsible controller, Exanteon may direct or assist with the request in accordance with applicable contractual and legal obligations.

Requests are handled within the applicable GDPR time limits. Identity verification may be required where necessary and proportionate.

Complaints

Individuals who believe that their personal data have been processed unlawfully may contact Exanteon using the address provided above.

They also have the right to lodge a complaint with a competent data protection supervisory authority.

For processing supervised in Latvia, the relevant authority is:

Datu valsts inspekcija — Data State Inspectorate

Website: https://www.dvi.gov.lv/en

Individuals may also contact the competent supervisory authority in another EU or EEA Member State where applicable.