Privacy Policy
Xago Software AS — Last updated: 14 August 2026
This privacy policy explains how Xago Software AS (“Xago”, “we”) processes personal data in connection with our Business Central apps — including Xago Calendar and Xago Mobile — and related licensing, support, and customer administration.
1. Data controller
Xago Software AS is the data controller for the processing described in this policy.
- Company: Xago Software AS
- Org. no.: 922 021 074
- Address: Frydenbergveien 46B, 0575 Oslo, Norway
- Phone: +47 22 34 34 23
- Privacy contact: Managing Director (daglig leder), privacy@xago.no
2. What personal data we collect
App user profiles (Xago Calendar and Xago Mobile). For users of these apps we store a hashed email address and hashed phone number. This data is used solely for license validation and user profile management, and is hosted in Microsoft Azure within the EU/EEA.
Support and licensing. When you or your organisation contact us regarding support, licensing, or purchases, we process your name, email address, and company name. This data is stored in our email system and in our ERP system (Microsoft Dynamics 365 Business Central), where license and customer information is also kept.
Invoicing. Customer details, customer contact details, and invoices are processed for accounting purposes.
We do not collect any other personal data through our apps. Our apps do not send telemetry to Xago.
3. Your business data stays in your tenant
Our apps run entirely within your organisation’s Microsoft Dynamics 365 Business Central tenant. The apps do not store, copy, or transfer your business data out of your tenant. Xago has no standing access to your data.
Where Xago has delegated admin access to a customer’s tenant, this access is used only to provide support at the customer’s request. Such work is performed under a consultancy agreement that includes a data processing agreement (DPA). In these cases, the customer is the data controller for the data in its tenant, and Xago acts as a data processor on the customer’s documented instructions.
4. Purposes and legal basis (GDPR Article 6)
| Purpose | Personal data | Legal basis |
|---|---|---|
| License validation and user profiles in Xago Calendar / Xago Mobile | Hashed email address and phone number | Art. 6(1)(b) — performance of a contract |
| Support and customer service | Name, email, company | Art. 6(1)(b) — performance of a contract; Art. 6(1)(f) — legitimate interest in responding to enquiries |
| Accounting and invoicing | Customer and contact details, invoices | Art. 6(1)(c) — legal obligation (Norwegian Bookkeeping Act, bokføringsloven) |
| Marketing (newsletters, product updates) | Name, email | Art. 6(1)(a) — consent, which you may withdraw at any time |
5. Retention
- App profile data (hashed email and phone number) is deleted when the license/subscription ends.
- Support correspondence is retained only as long as necessary to handle the matter and the customer relationship.
- Accounting records (customer details, invoices) are retained for at least 5 years as required by the Norwegian Bookkeeping Act.
6. Data processors and third parties
We use the following processors:
- Microsoft — hosting of app profile data in Microsoft Azure and operation of Microsoft Dynamics 365 Business Central.
Personal data is processed within the EU/EEA. We do not sell personal data and do not share it with third parties beyond the processors listed above, unless required by law.
7. Your rights
Under the GDPR you have the right to:
- request access to the personal data we hold about you,
- request rectification of inaccurate data,
- request erasure of your data,
- request restriction of processing and object to processing,
- data portability, where applicable,
- withdraw consent at any time, where processing is based on consent.
To exercise your rights, contact us using the details in section 1. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no) or your local supervisory authority.
8. Changes to this policy
We may update this policy from time to time. The current version is always available on this page, with the date of the last update shown above.