Xedul
Log in

Privacy Policy

Last updated: 23 September 2026

1. Data Controller

The data controller of personal data is Xedul S.r.l., with registered office in Treviso (TV), Italy.

For any communication relating to the processing of personal data, you may contact the Controller at: privacy@xedul.com.

2. Data Collected

In providing the Service, Xedul collects the following categories of personal data:

Data provided by the User

  • First and last name, email address, organisation details (company name, VAT number) provided at registration.
  • Content entered while using the Service (tasks, cases, documents, client contacts).

Data collected automatically

  • Technical data: IP address, browser type and version, operating system, device used.
  • Usage data: pages visited, features used, session timestamps.

3. Purposes of Processing

Personal data are processed for the following purposes:

  • Provision of the Service: account creation and management, operation of the CRM platform, processing of data entered by the User.
  • Support: handling technical and functional support requests.
  • Service communications: operational notifications, platform updates, security alerts.
  • Product improvement: aggregated and anonymised usage analysis to improve the user experience.
  • Legal compliance: legal, accounting and tax obligations.

4. Legal Basis

Processing is based on the following legal bases under Regulation (EU) 2016/679 (GDPR):

  • Art. 6(1)(b) — Contract performance: processing is necessary for the performance of a contract to which the User is a party.
  • Art. 6(1)(a) — Consent: for specific processing previously authorised by the User.
  • Art. 6(1)(f) — Legitimate interest: for improving the Service and preventing abuse.
  • Art. 6(1)(c) — Legal obligation: to comply with applicable legal obligations.

5. Data Sharing

Xedul does not sell, assign or share Users' personal data with third parties for marketing purposes. Data may be disclosed solely to the following parties, as processors or sub-processors:

  • Supabase, Inc. — database, authentication and storage services (EU region).
  • Vercel, Inc. — hosting and delivery of the web application.
  • Resend, Inc. — transactional email services (confirmations, security notifications).

Each sub-processor is bound by a Data Processing Agreement compliant with the GDPR.

6. International Data Transfers

User data are processed primarily within the European Economic Area (EEA). Where a transfer to a third country is necessary, it takes place on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate safeguards under the GDPR.

The primary database infrastructure (Supabase) is configured in the EU region to ensure data residency in the European Economic Area.

7. Data Retention

Personal data are retained for the duration of the contractual relationship and thereafter for the period required by applicable law (tax, accounting and archiving obligations).

At the end of the contractual relationship, User and Organisation data are deleted or anonymised within 90 days, unless a different legal obligation applies, upon the User's request.

8. Data Subject Rights

In accordance with Articles 15–22 of the GDPR, the User has the right to:

  • Access — obtain confirmation that processing is taking place and access their data.
  • Rectification — obtain the correction of inaccurate data or completion of incomplete data.
  • Erasure — obtain erasure of their data in the cases provided by law.
  • Restriction — obtain restriction of processing in the cases provided by law.
  • Portability — receive their data in a structured, commonly used and machine-readable format.
  • Objection — object to processing based on legitimate interest.

To exercise these rights, the User may send a request to privacy@xedul.com. The request will be handled within 30 days.

The User also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it).

9. Cookies

Xedul uses only technical cookies strictly necessary for the operation of the Service:

  • Session cookies — to maintain authentication and the User session.
  • Preference cookies — to store User preferences (language, theme).

Xedul does not use profiling cookies, marketing cookies or third-party cookies for advertising purposes. Prior consent is therefore not required for the cookies used.

10. Security Measures

Xedul adopts appropriate technical and organisational measures to protect personal data, including:

  • TLS (Transport Layer Security) encryption for all communications.
  • Row Level Security (RLS) at the database level for isolation of data between organisations.
  • Role-based access control and multi-factor authentication.
  • Periodic backups and disaster recovery procedures.

11. Changes to this Policy

Xedul reserves the right to amend this policy. In the event of material changes, the User will be informed by email or by notification within the platform. The date of the last update is always shown at the top of this document.

12. Contacts

For any question or request relating to this policy or to the processing of personal data:

  • Email: privacy@xedul.com
  • Xedul S.r.l. — Treviso (TV), Italy