Xeneta Privacy Policy
Last Updated: May 7th, 2026
1. Introduction to this Privacy Policy
At Xeneta, we prioritize the privacy and security of our users and are transparent about how we handle your information. We are committed to protecting your personal data and ensuring your privacy. We only collect, use, and store your data in accordance with applicable laws and regulations. Our data handling practices comply with all relevant privacy laws and regulations, including but not limited to GDPR and CCPA. We have implemented industry-standard security measures, including encryption and access controls, to protect your data from unauthorized users, alteration, disclosure, or destruction.
This privacy policy provides details on how Xeneta collects and processes your personal data through your use of this website, including any information you may provide when subscribing to our newsletter. It outlines the types of personal data we gather and your associated rights and choices. We will never sell your data to third parties without your explicit consent.
Our website is not intended for use by children, and we do not knowingly collect information about them.
We encourage you to read this privacy policy in conjunction with any other privacy notices or fair processing notifications we may provide at specific times when collecting or processing your data, so you are fully informed about how and why we use your information. This policy acts as a supplement to other notices and is not meant to override them.
2. Who We Are
Xeneta AS is a company registered in Norway, under business registration number NO 915 736 076, and located at Biskop Gunnerus gate 14A, NO-0185 Oslo, Norway. We are the controller of your personal data (collectively referred to as "Xeneta," "we," "us," or "our" in this policy).
If you have any questions regarding this policy or wish to exercise your legal rights, please contact the data privacy manager using the contact information provided below.
As the data controller, we are dedicated to ensuring that the collection and use of personal data comply with legal standards and is conducted securely. We respect your rights, including the right to access your personal data.
We occasionally collaborate with other organizations to collect and use your personal data. More information about these third parties can be found in Section 6.
For data protection inquiries and to exercise your rights as outlined in Section 8, please contact us at:
Xeneta AS
Biskop Gunnerus gate 14A, NO-0185 Oslo, Norway
privacy@xeneta.com
3. Links to External Websites
Our website, emails, and social media profiles may contain links to other companies, applications, or websites ("external websites") that are not operated by us. This privacy policy does not apply to how those external websites handle your information. We recommend reviewing the privacy policies of any external websites you visit.
4. Why, what, and for how long we process your data
| Purpose | Data processed | Legal basis | Retention period |
|---|---|---|---|
| Deliver our service & products We process your data to deliver our services & products, contact you concerning our platform, carry out demos, workshops, and other services that can be ordered through the website. We also process your data to ensure that you can log into your account (as Customer or Vendor), send you notifications, register and identify you as a customer/vendor/user, process your payment, enable account and product features, and save the actions you take when you use our product and website, respond to your questions and provide you with service and support, including sending service related messages and product updates to you. |
We don't process any sensitive data. From where we collect your personal data:
|
|
We will keep these data for as long as they are necessary for the purposes for which they are being processed. As a general rule, data will be kept for as long as you use our product or services or have an account with us plus two years following the conclusion of your account / relationship with us. Special circumstances or legal requirements may entail that such periods may be shorter or longer, including for the purpose of complying with legal requirements for the erasure or keeping of data. If you are employed by one of the customers or vendors, we will keep your data as long as we have a business relationship with that customer/vendor. |
| Marketing We process your data for marketing-related purposes, incl. sending you newsletters, doing demos and webinars, tailoring our communication with you to accommodate your areas of interests and focus and sending you relevant product and service promotion and offers. |
We don't process any sensitive data. From where we collect your personal data:
|
|
We keep your data for as long as you are subscribing to our newsletters, email marketing etc. We will keep your data for two years after your request so we can show that we have honored your request and to make sure that you aren't receiving the material. We keep your information for up to two years after our most recent contact with you. If we have collected publicly accessible information about you for the purpose of being able to carry out marketing activities, we will keep such data for as long as the relevant activity is ongoing and for two years after that. Regarding events, seminars, courses etc. we'll keep your personal data as long as they are necessary for the purposes of the course, the event or seminar in question and for evaluating them. |
| Improve, optimize or modify the experience on our website and online service We process your data to improve and optimize the experience on our website, the services and in the product etc. We use the data to operate our services, enhance and protect the security and ensure their secure, reliable, and robust performance, to improve the content we show you, determine what content is most helpful and the usability of our website, apps and online services. You can read about the cookies we use on our website here. |
From where we collect your personal data:
|
|
We keep this data for up to two years and cookie information is kept in accordance with the cookie policy. |
| Business and product development We process your data to do data analysis, audits, developing new products and services, identifying usage trends, determining the effectiveness of our promotional campaigns and operating and expanding our business activities. |
From where we collect your personal data:
|
|
For as long as you have an account with us plus up to two years from when you are no longer using our services. |
| Statistics We process your data to compile statistics for the use of our website and apps. |
From where we collect your personal data:
|
|
We will retain your data up to two years from when you visited our website and/or used our services & products. |
| Comply with obligations Data is processed to comply with legal obligations and requirements, requests from public and governmental authorities, relevant industry standards and our internal policies, and protect our operations and our rights. |
|
|
The data retention period will be based on statutory requirements. |
Additional Information
We do not sell or rent your personal information to marketers or third parties.
Some of the reasons for processing your data may overlap, meaning that multiple legal bases may justify our processing of your information.
We may utilize your data for additional purposes that we will communicate to you at the time of collection.
If you would like further information regarding our legal basis for processing your data, please don't hesitate to reach out to us using the contact information provided at the beginning of this policy.
Please be aware that specific circumstances or legal requirements might lead to shorter or longer data retention periods, depending on compliance obligations for the deletion or maintenance of information.
5. Safeguarding Your Data
We implement appropriate security measures to protect your personal data and maintain its confidentiality, integrity, and availability. This includes safeguarding against unauthorized or unlawful processing and minimizing risks of loss, accidental alteration, or unauthorized disclosure or access.
Our technical and organizational security measures may involve data encryption and pseudonymization, logging, access controls, backup procedures, staff training, confidentiality agreements, and ongoing monitoring. We ensure that your data transmitted through our website and applications is protected during transit with appropriate encryption methods.
That being said, complete elimination of security risks is not possible, and some residual risks may remain. We also remind you to take precautions to secure your information, such as keeping your login credentials confidential and ensuring that your devices are free of malware and viruses.
6. Disclosure of Personal Data to Third Parties
In the course of using your information as described in Section 4, we may need to share data with third parties. Potential recipients of your information may include:
Affiliated Companies
Our parent and subsidiary companies under the Xeneta group may utilize your information for risk management and business development purposes.
Service Providers
To efficiently deliver our products and services, we collaborate with service providers both within Norway and internationally. These service providers act as "Data Processors," meaning they are legally obligated to use your information solely as directed by us. We have established data processing agreements with these third parties to ensure compliance with relevant laws and regulations, including implementing security measures like encryption and access control.
Please note that some service providers may process your information independently for their own purposes (for example, performing statistical analyses). These providers are required to inform you about their data collection and usage practices in their privacy statements.
Certain service providers may also hold your data as "Joint Controllers." This includes partners like our logistics provider, DHL, and social media platforms such as Facebook and Instagram, which enable us to promote our products and services through targeted marketing.
Regulatory Authorities
We may disclose your information to courts and other public authorities as required by law. Information will only be provided about your content if mandated by a court order; in such cases, we will seek all available legal remedies to protect your content. As of the date of this Privacy Policy, we have not been compelled to share information about our customers' content with authorities.
Artificial Intelligence
We may use artificial intelligence (AI), machine learning, similar technologies and automated tools to provide, support, secure, maintain, analyze, and improve our services and internal operations. This may involve processing personal data, including usage data, as described in Section 4. All AI-assisted processes and workflows at Xeneta are subject to appropriate human oversight. We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing.
We may share limited personal data with trusted third-party AI providers who act as processors on our behalf, as described in this Section 6. Where we use such providers, we apply appropriate contractual, technical, and organizational safeguards, including data processing agreements, access controls, encryption, and data minimization measures.
We do not use personal data to train third-party AI models, and our third-party AI providers are not permitted to use your personal data to train their own models, unless otherwise agreed with you or expressly disclosed. This does not restrict the use of anonymized or aggregated usage data to train, fine-tune, or improve models where necessary to provide services to Xeneta, provided such data does not identify you, your organization, or any individual user.
Where AI-powered features are made available for your use, or where you interact directly with an AI-enabled tool, we will provide appropriate information that you are interacting with an AI system where required by applicable law, unless this is obvious from the circumstances and context of use.
Your rights described in Section 8 continue to apply to personal data processed in connection with AI-enabled features or AI-assisted workflows.
Other Entities
In the event of a sale or transfer of all or part of our business, we may disclose your data (including your personal information) to the parties involved in such transactions.
7. Transfers of Data Outside the EU/EEA
As outlined in Section 6, we share information about our customers and users with various parties, some of which may be located outside of Norway. As a result, your data may be processed in different jurisdictions.
When transferring personal data between Xeneta and a data processor located outside the EU/EEA, we ensure that the transfer includes appropriate safeguards, including but not limited to:
- The EU-U.S. Data Privacy Framework.
- Adoption of the EU standard contractual clauses as per implementing Decision (EU) 2021/914 of 4 June 2021 regarding the transfer of Personal Data to third countries under Regulation (EU) 2016/679.
- Any other safeguards recognized by the GDPR, such as adequacy decisions or approved codes of conduct.
8. Your Rights
You have these rights:
Your right of access and rectification - You have the right to ask us for copies of your personal data or ask us to rectify information you think is inaccurate. There are some exemptions, which means you may not always receive all the information we process but as a main rule you can always contact us and ask for your information.
Your right to erasure - You can ask us to erase your personal information in certain circumstances.
Your right to withdraw your consent - If processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdraw your consent. You may withdraw your consent by sending an email to privacy@xeneta.com.
Your right to restriction of processing and object to processing - You have the right to ask us to restrict the processing of your information and a similar right to object to processing.
Your right to data portability - You have the right to receive your personal information in a structured, commonly used and machine-readable format (data portability).
Where your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data about you for such marketing.
We will make sure to answer your request without undue delay and in any event within one month of receiving your request. It can be that the period will be extended by two further months if your request is very complex.
There may be conditions or limitations on these rights. It is therefore not certain e.g. you have the right of data portability in a specific case - this depends on the specific circumstances of the processing activity. You are always welcome to contact us and ask. The same goes for some of the other rights.
9. Complaints
You can always lodge a complaint with a European data protection authority, for example, the Norwegian Data Protection Agency.
Website: https://www.datatilsynet.no
Email: postkasse@datatilsynet.no
Address: Tollbugata 3, 0152 Oslo, Norway
Telephone: +47 22 39 69 00
Assistance and additional information
You can take steps to exercise your rights by using the contact details above. If you have questions about the policy, feel free to contact us by using the contact details in this policy.
How to unsubscribe to email marketing material?
If you've subscribed to our newsletters or asked to receive marketing material from us, you can always unsubscribe. In all these emails we include an unsubscribe link and you can always click the link and easily unsubscribe.
You can also unsubscribe by sending us an email to privacy@xeneta.com.
10. Changes to the Policy
We may change this policy to reflect our current practices. We will take reasonable steps to inform you about changes via our website.
If you are a registered user, we will notify you via email if significant changes are being made to the policy using the email address you gave us when you signed up.
If you continue to use our website or services after the notification, we will regard this as your acceptance of our privacy practices.
This policy was last updated on May 7th, 2026.