How we handle personal data.
Last updated 5 October 2026. What we collect, why, who sees it and what rights you have.
1. Who we are
Xetuu ERP Limited (“Xetuu”, “we”) provides the Xetuu ERP software service and operates this website. This policy explains how we handle personal data in two situations: when you use this website or contact us, and when you use the Xetuu service.
For personal data about your own customers, employees and suppliers that you place in your Xetuu workspace, you are the controller and we act as your processor, handling it only on your instructions as described in your agreement with us.
2. What we collect
- Contact details you give us: name, work email, company, and anything you write in a message or application.
- Account data: your name, email, role, company and workspace details when you sign up or are invited.
- Usage and security data: sign-in times, IP address, device and browser type for your sessions, and audit-log entries of actions taken in the workspace.
- Content you store in the service, such as invoices, customers and employees, which belongs to you.
3. How we use it
- To provide, secure and support the service, including authenticating you and keeping the audit log.
- To respond to enquiries, demo requests and job applications.
- To send service messages such as verification codes and notices about your account.
- To improve and troubleshoot the product, and to prevent abuse and fraud.
- To meet legal obligations.
We do not sell personal data.
4. Our legal bases
Where data protection law requires a legal basis, we rely on: performing our contract with you; our legitimate interests in running and securing the service and responding to enquiries; compliance with legal obligations; and your consent where we ask for it.
6. International transfers
Your data may be processed in a country other than your own, depending on where your workspace is hosted. Where required, we put appropriate safeguards in place. Ask us which region your workspace uses.
7. How long we keep it
We keep account data while your account is active and as needed afterwards for legal, tax and dispute purposes. Audit-log entries are append-only by design and are kept for the life of the workspace. When an agreement ends, workspace data is returned or deleted as set out in that agreement.
8. Security
We protect personal data with database-per-tenant isolation, role-based access, hashed passwords, encryption of stored credentials and an append-only audit log. See the Security & Compliance whitepaper for detail. No system is perfectly secure, and we will tell affected customers promptly if a breach affects their data.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to a data protection authority.
If your data sits in a customer's workspace, please contact that customer first, because they control it. For data we control, contact us and we will respond within the time the law allows.
11. Children
The service is for businesses and is not directed at children. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy as the service or the law changes. The date at the top shows the latest version, and we will give notice of material changes.
13. Contact
Questions about privacy? Use the contact form or write to [email protected], addressed to Xetuu ERP Limited.