1. Scope and who is responsible
This policy addresses personal data associated with the Xone Business website, accounts, subscriptions, support and accounting service. Personal data means information relating to an identified or identifiable individual, including business contact information.
To confirm before publication: the full legal name of the operating company, registered address, registration details, country of establishment and verified privacy contact. “Xone Business” is the product name; it does not yet identify the legal data controller.
2. Our role and your business data
The operating company would normally act as controller for its own account administration, billing and website activities. When accounting records contain personal data about your customers, employees or suppliers, your organisation would normally determine the purposes of that processing and Xone Business would act as processor on its instructions.
Those roles must be verified for each activity. A separate data processing agreement (DPA), covering instructions, confidentiality, security, subprocessors, assistance, transfers and deletion or return of data, must be finalised before customer personal data is processed. This policy does not replace that agreement.
3. Personal data covered
Depending on which features are actually enabled, the service may handle:
- Account information: name, work email, organisation, account identifiers and authentication information.
- Business records: invoices, quotes, receipts, transaction details, customer and supplier contacts, and uploaded documents.
- Payroll or employee information, bank information and tax identifiers, only where the relevant functionality is provided.
- Subscription and payment records, such as billing address, plan, invoice history and payment status.
- Support correspondence, feedback and information you choose to provide.
- Technical information such as IP address, browser details, device information, access times and security logs, if collected.
The final notice must list only data actually collected and explain which fields are necessary. Do not submit sensitive personal data that is not required for an enabled feature.
4. Where information comes from
Data may be supplied directly by you, by an authorised member of your organisation, or through a bank, payment service or other integration you choose to connect. Technical information may be generated when you use the service.
The sources, categories and permissions for each enabled integration must be disclosed before use. If someone uploads information about another person, that organisation is responsible for having an appropriate legal basis and giving the required notices.
5. Purposes and legal bases
Where GDPR or similar law applies, each controller activity needs an appropriate legal basis. The proposed purposes and bases below must be checked against actual practices:
- Creating accounts and delivering the agreed service: performance of a contract with an individual customer, or legitimate interests in administering a business customer relationship.
- Billing and maintaining required financial records: performance of a contract and compliance with applicable legal obligations.
- Security, fraud prevention, troubleshooting and responding to support requests: legitimate interests, subject to a documented assessment and safeguards.
- Optional marketing or non-essential tracking: consent where required, or another lawful basis only where local law allows it.
- Responding to lawful requests or exercising legal claims: legal obligations or legitimate interests, as applicable.
Processing of customer-controlled accounting records must follow the customer's lawful instructions and DPA. Where information is required, the final notice must explain the consequences of not providing it.
7. Sharing and service providers
Data may need to be shared with authorised users in your organisation and providers delivering hosting, storage, support, communications, security or payment processing. Information may also be disclosed where legally required, necessary to establish or defend legal claims, or as part of a lawful business transfer with appropriate safeguards.
To confirm: actual recipient categories, provider names, processing locations, contracts and the process for notifying customers about subprocessor changes. Stripe has been proposed for subscriptions but is not established as an active provider by this draft. Connected banks and integrations may have their own controller obligations and privacy notices.
No sale, advertising-sharing or independent reuse of customer records should be assumed from this draft; the final policy must explicitly state the verified position.
8. International transfers
To confirm: where information is stored and accessed, including service provider support locations. If personal data is transferred outside the EEA, UK or another protected jurisdiction, the final notice must identify the applicable transfer mechanism.
Depending on the transfer, safeguards may include an adequacy decision, approved standard contractual clauses and any necessary supplementary measures. Customers must be told how to obtain relevant information or a copy of applicable safeguards, subject to legitimate redactions. This draft makes no claim that data is hosted exclusively in any country.
9. Retention and deletion
Retention should be limited to what is needed for the purpose of collection, contractual responsibilities, mandatory accounting or tax requirements, security and legal claims. Customer records should be returned or deleted in accordance with the DPA and applicable law.
To confirm: retention periods or sufficiently specific criteria for account data, accounting records, invoices, support messages, security logs and backups; the cancellation export window; and the time needed for deletion from backups. A deletion request may not remove records that must legally be retained, but retained data should be restricted to that purpose.
10. Security and incident handling
The service must use appropriate technical and organisational measures proportionate to the risks of financial and personal data processing. Customers should protect their credentials, limit permissions to appropriate people and notify the service of suspected unauthorised access.
To confirm: the implemented access controls, encryption, backup arrangements, staff controls and incident response process. No certification, audit status, absolute security guarantee or specific safeguard is claimed by this draft. Personal data breaches must be assessed and notified to customers, authorities or affected individuals when applicable law requires it.
11. Your privacy rights
Depending on your location and the applicable legal basis, you may have rights to access, correct or erase personal data; restrict processing; receive portable data; and object to processing, including direct marketing. Consent may be withdrawn at any time without affecting earlier lawful processing.
Rights are subject to legal conditions and exceptions. Requests should be sent to the verified privacy contact once published. Proportionate identity verification may be needed. Under GDPR, responses are generally due within one month; a lawful extension of up to two further months may apply to complex or numerous requests, with notice and reasons given within the first month.
For data controlled by your organisation, contact its administrator first; a processor must assist the controller as required. You may complain to a competent data protection authority, including in the EU country of your habitual residence, workplace or alleged infringement.
12. Automated decisions and AI
To confirm: whether any feature uses profiling, AI providers or decisions based solely on automated processing that produce legal or similarly significant effects. The final notice must describe applicable purposes, data recipients, meaningful information about decision logic and consequences, and any rights to human review or challenge.
This draft does not authorise model training on customer records or claim that automated decision-making is absent.
13. Children and third-party services
Xone Business is intended as a business accounting service, not a service directed to children. If information about a child is entered as part of legitimate business records, it still requires appropriate protection and a lawful basis.
Links and optional integrations can lead to services with their own privacy policies. Review their terms and permissions before sharing data. An intended account eligibility age must be confirmed in the final Terms & Conditions.
14. Changes and contact
The final policy should be kept accurate as processing changes. Material changes should be communicated through an appropriate channel before they take effect where required, and new consent obtained when necessary rather than inferred from continued use.
Contact to verify: support@xonebusiness.com is the address currently displayed on the website, but its ownership and suitability for privacy requests have not been confirmed. Publish the operator's full contact details and any required data protection officer or representative details before using this as a final privacy notice.