Xavio
What this page is
Your company enters into Xavio the personal data of its own customers, suppliers and employees. Under the GDPR, your company is the controller of that data and we are its processor. This page sets out the terms on which we process it, and is part of the contract for the use of Xavio.
If your company needs a separate signed data-processing agreement, write to contact@xavio.ro.
Subject matter and instructions
We process the data only to provide Xavio: to store it, show it to the users your company authorises, produce the documents your company asks for, send those documents where your company directs, and keep the whole thing running and backed up.
We act on your company's instructions. Operating the application as it is documented is that instruction; anything beyond it is agreed in writing. We do not use the data for our own purposes, we do not sell it, and we do not use it to train anything.
Categories of people and of data
People: your company's customers and suppliers (including natural persons and the contact people of companies), its employees and collaborators, and the users of your workspace.
Data: name, company name, tax number, address, telephone, email, bank account; commercial and accounting documents with the amounts and the history they contain; and the technical trace of use — who did what and when.
Xavio is not built for special categories of data (health, biometrics, political or religious views) and we do not expect them. If your company chooses to put such data into a free-text field, it does so as controller and on its own assessment.
Subprocessors
We use the following subprocessors, each bound to equivalent obligations:
- Hetzner Online GmbH Germany (Nuremberg)
Hosting of the application and the database. - Hetzner Online GmbH — Storage Box Germany (Falkenstein)
Backups, encrypted before they leave the server. - Cyber_Folks SRL Romania
The mail server used to send platform messages and the company documents sent to its customers. - sendSMS.ro / SMSO.ro Romania
Sending text messages — only if the company enables the channel and configures its own API key.
We tell your company before adding a new subprocessor that touches its data, so it has time to object.
No transfer outside the EEA
The application, the database, the backups and the mail server are in the European Economic Area — Germany and Romania. No personal data is transferred outside the EEA. If that ever has to change, your company is informed in advance, together with the safeguard relied upon.
Security measures, concretely
- HTTPS only; the server accepts key-based sign-in for one administrative account.
- Passwords stored as hashes; two-step authentication available to every account.
- Each company isolated in its own workspace; rights evaluated per company.
- An audit log of the actions taken on documents, rights, roles and settings, which the company can read itself.
- Nightly database dump, verified, kept 7 days locally, plus an encrypted off-site copy (7 daily / 4 weekly / 6 monthly), checked by a watchdog that raises an alarm when a night is missed.
- Changes reach the server only from the version-controlled repository, never edited in place.
Help with requests from data subjects
When a person asks your company for access, correction, deletion or a copy of their data, the company answers; we help with what the application cannot do on its own. Most of it it can: lists, exports and documents are reachable by the company itself.
If such a request arrives at us directly, we do not answer it on the merits. We pass it to your company and tell the person who the controller is.
Incidents
If we discover a breach of security that affects your company's data, we tell the company without undue delay, with what we know at that moment: what happened, which data is affected as far as we can tell, and what we are doing. We do not wait for a complete picture before the first message.
How long, and what happens at the end
We keep the data for as long as your company uses Xavio. On termination the workspace stays available for export 30 days, then it is deleted. Backups containing it roll off on their own schedule, within six months at the latest.
The owner of a company can start the complete deletion of the workspace earlier, from Settings → General → Organisation. That path is deliberately strict: only the owner, only when no other user is attached, and with repeated confirmation — because it cannot be undone.
Evidence
On request we provide the information your company needs to show that it chose a processor that offers sufficient guarantees: the list of subprocessors, the location of the data, the security measures, and the way we handle incidents. We do not grant access to the systems of other companies, for the same reason we do not grant anyone access to yours.