Privacy Policy

Introduction

This Privacy Policy explains how Jolo Vita (KvK: 87189437), operating as Bulk Contact Manager ("we", "us", or "our"), collects, uses, and protects personal data.

1. Our Role: Controller vs. Processor

To comply with the General Data Protection Regulation (GDPR), we distinguish between two types of data:

• Customer Account Data: Information about you (the user) necessary to create your account. For this data, Jolo Vita acts as the Data Controller.
• Xero Tenant Data: The contacts, invoices, and organizational data synchronized from your Xero account. For this data, you are the Data Controller, and we act exclusively as the Data Processor. This relationship is governed by our Data Processing Agreement (DPA).

2. Information We Collect (As a Controller)

When you connect to our Service, we collect:

• Account Data: Your email address, name, Xero Tenant ID, and OAuth access/refresh tokens. Legal Basis: Performance of a Contract.
• Support Data: Information you provide when contacting our support desk. Legal Basis: Legitimate Interest.
• Usage Data: Which features of the Service you use and when, for example signing in, running a bulk action, exporting a file or opening Help. This is linked to your account and organization. We record only the type of action and simple details, such as a count, the kind of bulk action or the names of the fields you changed. We never record the contents of your Xero data, the values you filter on or what you search for. We also count the calls the Service makes to Xero per organization (numbers and outcomes only), to keep the integration reliable. Usage Data is stored on the same servers in the European Union as the Service, without cookies or third-party analytics. We use it only to understand and improve the Service, never for advertising, and we do not share it. Legal Basis: Legitimate Interest. You can object to us recording your Usage Data at any time by emailing privacy@bulkcontactmanager.com.
• Billing and Payment Data: When you upgrade to a paid subscription, our third-party payment processor (Stripe) collects your payment method details (such as credit card numbers). We do not store or have access to your full payment card information; we only receive associated billing metadata (e.g., name, billing address, VAT/Tax ID, and the last 4 digits of your card) necessary to calculate local taxes and issue invoices. Legal Basis: Performance of a Contract and Compliance with a Legal Obligation (Dutch tax laws).

3. Information We Process (As a Processor)

To provide the filtering, calculating, and bulk-updating features of the Service, we temporarily cache:

• Cached Xero Data: Contact details (names, email addresses, physical addresses, phone numbers, tax numbers, contact persons, notes, contact group memberships), basic transaction metadata (dates and contact IDs of invoices, purchase orders, and bank transactions), and the contents of past bulk actions. Bank account details are never stored: they only pass through our systems during a sync, or when you import them to send them to Xero.
• Security: This data is stored on servers in the European Union (Germany). Encrypted backups are stored in the European Union (France), see “Backups” in section 6. Connections between your browser and the Service, and between the Service and Xero, use TLS 1.2 or higher. The OAuth tokens that give the Service access to your Xero organization are additionally encrypted at rest using AES-256-GCM, and database backups are encrypted (AES-256) before they leave our servers. We do not sync or store financial amounts, line items, or bank statement data.

4. Cookies and Local Storage

We use strictly necessary cookies and local browser storage solely to provide the core functionality of the Service. These include session cookies required to maintain your secure authentication state with Xero and tokens to prevent cross-site request forgery (CSRF) attacks. Because these technologies are strictly necessary to operate the application securely, they do not require prior consent. We do not use third-party tracking, advertising, or marketing cookies.

5. Information Sharing & Sub-processors

We do not sell, rent, or trade your personal information. We share data only with strictly vetted third-party sub-processors required to operate our infrastructure (e.g., EU-based cloud hosting and transactional email providers).

If a sub-processor is located outside the European Economic Area (EEA), we ensure data transfers are protected by Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework. A complete list of our sub-processors is available in our DPA.

Payment Processing & Tax Automation: We partner with Stripe, Inc. to handle payment processing, fraud detection, and global tax compliance (Stripe Tax). Depending on your location, Stripe may transfer and process your data outside the European Economic Area (EEA), protected under the EU-US Data Privacy Framework. For more details on how Stripe processes your data, please refer to the Stripe Privacy Policy at https://stripe.com/privacy.

6. Data Retention

• Xero Tenant Data: We keep cached Xero data only while we need it to provide the Service. We permanently delete an organization’s cached contact and transaction data, the contents of its past bulk actions (only counts are kept as a log), and the retention period set for it, from our active databases: (a) immediately, when you disconnect the organization in the Service, or when you delete your account and no other account uses the organization; (b) seven (7) days after the connection is revoked or lost on Xero’s side, for example from your Xero dashboard, so that an accidental revocation can be undone by reconnecting; (c) thirty (30) days after the trial or subscription of every account with access to the organization has ended; (d) fifty (50) days after the last sign-in, sync or other request to Xero for the organization. If the connection still exists at Xero, we also end it there.
• Backups: Encrypted disaster-recovery backups, stored within the European Union, are kept on a rolling schedule and expire automatically within thirty-five (35) days — deleted data is purged from the entire backup chain by the end of that window. Backups are encrypted on our own infrastructure before upload, and if a backup is ever restored, any deletion or anonymization performed after that backup was taken is re-applied as part of the restore procedure.
• Usage Data: Kept for thirteen (13) months, then deleted automatically. The counts of calls to Xero are kept for ninety (90) days. When you delete your account, its usage data is deleted from our active databases straight away, and from backups within thirty-five (35) days.
• Account Data: We keep your account data (name, email address, plan and billing references) and the log of your past bulk actions (counts and dates, no contact data) while your account exists. You can delete your account at any time on the Plan & Billing page; we then delete this data straight away. Invoices for past payments are kept by our payment processor Stripe, as Dutch tax law requires.

7. Your Privacy Rights

Under the GDPR, you have the right to:

• Access, correct, update, or request deletion of your personal data.
• Object to or restrict the processing of your personal data.
• Request data portability.

Exercising Your Rights

To exercise these rights regarding your Account Data, email us at privacy@bulkcontactmanager.com. We will respond within 30 days. Please note that if you wish to exercise rights regarding data within your Xero Tenant Data (e.g., a contact wishing to be forgotten), you must execute this action directly within the Bulk Contact Manager app or your Xero dashboard.

8. Right to Complain

If you believe we are processing your personal data in violation of the GDPR, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.

Changes to this Policy

• 14 October 2026: sections 2 and 6 describe Usage Data: which features of the Service are used and the counts of calls the Service makes to Xero, how long they are kept, and how to object.
• 14 October 2026: section 3 states that bank account details are never stored: they only pass through our systems during a sync, or when you import them to send them to Xero.
• 13 October 2026: section 3 now states precisely what is cached and what is encrypted (OAuth tokens at rest, backups before upload, connections with TLS 1.2 or higher). Section 6 lists when cached Xero data is deleted after a connection ends, and how you delete your account.

9. Contact Information

• Data Controller: Jolo Vita
• KvK Number: 87189437
• Registered in: The Netherlands
• Email: privacy@bulkcontactmanager.com