Privacy Policy

1. Personal Information We Collect Depending on how you interact with our websites and software, we collect only the minimum data necessary:

Checkout & Account Data: When you purchase a plugin on an Exindium product website or exindium.com, we collect your first name, last name, and email address to create or update your customer account in the Exindium Client Portal. Account passwords are securely hashed using WordPress’s native password-hashing mechanisms and are never stored in plain text.

Transaction & Billing Records: We store your purchased product tier, payment status, purchase/renewal dates, license expiration date, and PayPal transaction ID. All payments are processed directly by PayPal; Exindium never collects or stores your credit/debit card numbers or CVV.

License & Domain Activation Data: When you activate an Exindium Pro plugin on a WordPress site, our licensing server records your license key, the normalized domain name (site_url) where the plugin is active, activation date, and cryptographic token status. Our licensing database does not store visitor IP addresses from your website.

License Activity & Diagnostic Logs: Our licensing infrastructure records selected license-related events, such as domain activations, deactivations, activation limit warnings, and licensing errors. These records may include the associated license key, domain name, event type, severity, timestamp, and relevant diagnostic details. We use these logs to troubleshoot licensing issues, prevent abuse, and maintain service reliability. Routine successful license validations are not individually logged.

Support & Contact Communications: Any name, email address, and message details you voluntarily send us when requesting support.

Server & Security Logs: Like most websites, our hosting infrastructure may temporarily log IP addresses, browser user-agents, and request timestamps to prevent abuse, DDoS attacks, and unauthorized access.

Customer account, transaction, and licensing information may be processed through Exindium’s centralized Client Portal and licensing infrastructure, including when purchases are made through individual product websites.

1. How & Why We Process Your Data (Legal Bases under GDPR)

Performance of a Contract (Art. 6(1)(b) GDPR): To verify your payment, issue your license key, authenticate your plugin installation via cryptographically signed tokens, provide software updates and downloads in the Client Portal, send transactional emails (purchase receipts, password setup links, and 30-day/7-day expiration reminders), and deliver technical support.

Legal Obligations (Art. 6(1)(c) GDPR): To retain transaction and accounting records required by applicable tax and financial regulations.

Legitimate Interests (Art. 6(1)(f) GDPR): To secure our websites and licensing APIs, prevent fraud or license key abuse, record relevant licensing events and diagnostic errors, troubleshoot technical issues, and maintain service reliability.

 

Consent (Art. 6(1)(a) GDPR): Where required for optional cookies (managed via CookieYes). We do not send unsolicited marketing spam or sell your personal data to third parties.

1. Third-Party Service Providers & International Transfers We share limited data only with essential infrastructure providers:

PayPal: Processes your checkout payments and fraud screening under the PayPal Privacy Statement.

Hosting & Email Infrastructure: Our web hosting and transactional SMTP providers process data strictly to host our websites and deliver account/license emails. Where any provider processes data outside the European Economic Area (EEA), we rely on recognized GDPR transfer mechanisms such as Standard Contractual Clauses (SCCs) or adequacy decisions.

1. Data Retention

Account & License Data: Retained for as long as your customer account or software license remains active or eligible for renewal or legacy usage. You may request account deletion at any time, subject to applicable legal retention obligations.

Transaction Records: Retained for the statutory period required by Greek and EU tax/accounting laws.

Support Emails: Retained for as long as reasonably necessary to resolve your inquiry and maintain support continuity.

License Activity & Diagnostic Logs: Retained for up to 60 days and automatically deleted afterward. These logs are used exclusively for licensing diagnostics, security, and abuse prevention.

Server & Security Logs: Retained temporarily for security, troubleshooting, and abuse prevention, according to our hosting provider’s applicable retention settings.

1. Your GDPR Rights Under the GDPR, you have the right to request access, rectification, erasure (deletion), restriction, or portability of your personal data, and to object to processing based on legitimate interests.

To exercise any of these rights, email info@exindium.com. We will respond within one (1) month of receiving your request. Where permitted by the GDPR, this period may be extended for complex requests, and we will inform you accordingly.

You also have the right to lodge a complaint with your local data protection authority or the Hellenic Data Protection Authority (HDPA) in Greece https://www.dpa.gr/