Snapshot 39705
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Privacy Policy Who are we? Syft, together with its subsidiaries and affiliates listed in Appendix 1, provides integrated financial analytical tools and reporting solutions to business customers. We are the controller of the personal data processed under this privacy policy. The relevant data controllers of your personal data will depend on where you are located, the products and/or services you purchase, the website(s)/application(s) you visit and the nature of the processing activities. Please see Appendix 1 for a list of our subsidiaries and affiliates and how to contact them. References in this policy to "we”, “us” and “our” are to the relevant data controller(s). About this privacy policy This privacy policy tells you about how we process personal data both offline (e.g. via phone, mail, in-person meetings and other correspondence) and online (e.g. when our website, applications and services are used). This privacy policy is limited to the personal data that we process as a controller, which predominantly consists of personal data relating to representatives of our corporate clients, partners and vendors and visitors to our websites. We refer to such individuals as “you” and “your” in this privacy policy. This privacy policy does not cover the processing of our personal data where we act as a data processor (including where we process personal data relating to customers/end-users of our clients as part of the provision of our services to our clients). Our handling of this personal data is governed by the applicable Terms of Use and the Data Processing Addendum. Our websites/applications may contain links to other third-party websites or applications that we do not operate or control. These websites and applications may have their own privacy notices or policies, which will apply to any personal data processed by them. Country specific provisions Depending on your location, the following appendices may apply in addition to this privacy policy: Appendix 2: EEA and UK specific provisions Appendix 3: USA specific provisions Appendix 4: South Africa specific provisions What personal data do we collect? In most cases, we will collect personal data directly from you. However, we may also combine personal data collected from one source with personal data that we have collected from other sources, such as when you connect a third-party account or service. We may collect the following categories of personal data: Personal data in connection with the use of our services This may include name, email address, other contact details, business information, shipping address, billing address, marketing preferences, account information (username), and other information provided as part of a user profile. Transaction information We collect personal data when you transact with us. This may include biographical information, contact information, telephone number, and payment and invoicing information. Correspondence and interactions with us We collect personal data where you contact us or we contact you. This may include your name and contact information, account information, your order information, your queries, and other personal data you choose to provide to us. We also collect personal data provided to us through a testimonial, feedback, review or comment. Social media information We collect personal data when you interact with us on social media. These social media platforms may set cookies and other tracking technologies on your device when you visit their pages. The output of such information may be provided to us (usually for statistical purposes to see how users interact with our content on social medial platforms).Information about how these platforms process your personal data can usually be found on their websites. Survey and contest/sweepstake information We collect personal data where you complete surveys that we may use for research purposes, and where you choose to enter into contests/sweepstakes that we run. This may include your name and contact information and other personal data you choose to provide us. Information stored on a device We may access metadata and information associated with other files stored on your device such as IP address, domain name, browser version and operating system, traffic data, web logs and other communication data, and device identifiers. Where required, we will ask for your consent prior to collecting device information. Location Information With your permission (where required by applicable law), we may collect information about the general location of a device. Collection and use of public information We may also process personal data that is publicly available for the purposes set out in this privacy policy. Why do we use personal data? We may use your personal data for the purposes set out below. For account registration We use personal data to open and manage your accounts. This may include name, address, phone number, billing information, and email address. To conduct our business and provide our services To conduct our business, including to enable use of our services and our websites/applications to respond to queries, to carry out our obligations arising from any agreements entered into and to contact customers or potential customers in connection with our business and services. To provide communications (about updates and changes) and to provide technical and customer support To communicate about updates to our business, services and websites/applications; to provide customer and technical support; to respond to requests, comments, questions, or concerns from customers or potential customers. Such communications are provided by various means, including emails, telephone calls, video calls and internet chat. Calls may be recorded for training and monitoring purposes and a transcript of the internet chat sessions may be retained to resolve questions or issues related to our services. To facilitate payments To take payment from you when you sign-up for certain features; to provide you with refunds and to process payments when you transact with us. To allow use of the interactive features of our websites/applications To allow testimonials, reviews or comments. Please note that such testimonial, review or comment may be read, collected and used by anyone. To ensure our websites/applications content is relevant and to maintain the security of our websites/applications To ensure that content from our websites/applications are presented in the most effective and secure manner. For analytics and business development purposes, including feedback and surveys To analyse personal data in order to better understand our business, services and our customers' services and marketing requirements, and to better understand our business and develop our services and websites/applications. This may include aggregating and/or de-identifying your personal data. To provide marketing materials To provide updates and offers, where customers or potential customers have chosen to receive these communications. We may also use personal data for marketing our own and our selected business partners' products and services by mail, email, SMS, phone and social media. Where required by law, we will ask for consent to conduct these types of marketing and provide an option to unsubscribe from further marketing communications. Please note that even if you opt-out of receiving marketing communications, you may still receive communications from us that are important or related to your interactions with us, or otherwise as required by law. To enforce our terms, in connection with legal or regulatory obligations and to manage claims We may process personal data to enforce our terms and to comply with our legal and regulatory requirements or dialogue with regulators/judicial proceedings/court orders and manage claims and litigation (as applicable) which may include disclosing personal data to relevant third parties, the court service and/or regulators or law enforcement agencies in connection with enquiries, proceedings or investigations by such parties anywhere in the world or where compelled to do so. To reorganise or make changes to our business In the event that we: (i) are subject to negotiations for the sale of our business or part thereof to a third party; (ii) are sold to a third party; or (iii) undergo a reorganisation, we may need to transfer personal data to the relevant third party (or its advisors) as part of any due diligence process for the purpose of analysing any proposed sale or re-organisation. We may also need to transfer personal data to that re-organised entity or third party after the sale or reorganisation. Cookies and similar technologies We use cookies and similar technologies. For more information, please refer to our respective entities' cookies policies, available here. Who do we share personal data with and why? We may share or disclose personal data for the purposes set out in this privacy policy to third parties. These third parties include service providers, our advisors and partners who assist and enable us to use the personal data to, for example, support delivery of or provide functionality on the website or services, or to market or promote our goods and services to you. We may share your personal data we collect and process across our subsidiaries, affiliates, and group companies, including other organizations in the Xero group of companies. We may also need to transfer personal data in the context of a reorganisation or sale of all or part of our business. Any personal data made available publicly, such as reviews, comments or testimonials, may be shared with other users of our website. We may disclose personal data as required by law or court orders, and when we believe that disclosure is necessary to protect our rights or comply with a court order or other legal process. How do we protect personal data? We take commercially reasonable efforts to protect the personal data under our control. Unfortunately, the transmission of information via the Internet is not completely secure. Although we do our best to protect personal data, we cannot guarantee the security of it transmitted to our websites, applications or through communications. If you are given or you create user credentials (such as username and passwords), please keep these safe and do not disclose these to third parties. International transfers of personal data Personal data may be accessed by staff or suppliers in, transferred to, and/or processed at, a destination outside the country in which you are located, including in the United States and South Africa. The laws of these countries may differ from those that apply in your country. We will ensure that personal data transferred outside your country is safeguarded in line with this privacy policy and applicable laws. How long do we keep your personal data? Our retention periods for personal data are based on business needs and legal requirements. We will retain personal data while we are using it for purposes described in this privacy policy. We may continue to retain it after we have ceased such uses for certain legitimate business purposes. We may also continue to retain personal data to meet our legal requirements or to defend or exercise our legal rights. The length of time for which we will retain personal data will depend on the purposes for which we need to retain it, which will generally require that we retain your personal data for the term of the Agreement and up to 7 years following expiration or termination of the Agreement. After we no longer need to retain personal data, we will delete it, anonymise it, or securely destroy it. What are your rights? We operate in countries with data protection laws which provide different rights to individuals in respect of their personal data. In general, you have rights to: stop receiving marketing communications; require us to update any inaccuracies in the personal data we hold; request a copy of your personal data; withdraw your consent (where our processing activity is based on your consent); require us to delete personal data; restrict how we use your personal data whilst a complaint is being investigated; object to our processing of your personal data (where our processing is based on our legitimate interests); and ask us not to reach decisions that have legal or significant effects on you using automated processing or profiling. To submit a request regarding personal data by email, please contact us as per section 12 below. If you are not satisfied with how we are processing your personal data you can also contact your local Data Protection Authority. Contacting us If you have any queries or complaints about our use of personal data, please contact us as follows: [email protected]. Updates to this privacy policy We regularly review and, if appropriate, update this privacy policy from time to time, and as our services and use of personal data evolves. We will update the date of this document each time it is changed. Last update This privacy policy was last updated on 26 May 2026 and is effective for new and existing users from this date. Appendix 1: List of Syft affiliates and subsidiaries acting as data controllers under this privacy policy Name Registered Address Country of establishment Contact details for data protection queries Syft Analytics Inc 1615 Platte Street, Denver, CO 80202 USA [email protected] Appendix 2: EEA and UK specific provisions If you are located in the EEA or the UK, the provisions of this Appendix 2 apply in addition to the general provisions of the privacy policy. Why do we use your personal data? Who do we share your personal data with and why? The provisions of this section I apply in addition to section 5 and section 7 of the privacy policy. With respect to individuals located in the EEA or the UK, use and disclosure of personal data must be based on one of a number of lawful bases and we are required to set out the lawful bases in respect of each use made of your personal data. In the list below, we have set out the relevant lawful bases that apply to each purpose for which we use your personal data as described in section 5 of the privacy policy (including the sharing of your personal data for these purposes as per section 7 of the privacy policy). Lawful basis Purpose Contract performance: where we are required to collect and handle your personal data in order to provide you with the services that we have contractually agreed to provide to you. This only applies if our contract has been entered into with an individual. 5(a): For account registration (if our contract is entered into with an individual and in all other cases, legitimate interests) 5(b): To conduct our business and provide our services (if our contract is entered into with an individual and in all other cases, legitimate interests) 5(c): To provide communications (about updates and changes) and to provide technical and customer support (if our contract is entered into with an individual and in all other cases, legitimate interests) 5(d): To facilitate payments (if our contract is entered into with an individual and in all other cases, legitimate interests) Legitimate interests: where we have a legitimate interest in using your personal data. We will only rely on this lawful basis if we consider that our interest in using your personal data for the relevant purpose is not outweighed by any interests that you may have, or any prejudice that you may suffer, from the relevant use of your personal data. 5(a): For account registration 5(b): To conduct our business and provide our services 5(c): To provide communications (about updates and changes) and to provide technical and customer support 5(d): To facilitate payments 5(e): To allow use of the interactive features of our websites/applications 5(f): To ensure our websites/applications content is relevant and to maintain the security of our websites/applications 5(g): For research and development purposes, including surveys and feedback 5(h): To provide marketing materials 5(i): To enforce our terms and in connection with legal or regulatory obligations and to manage claims 5(j): To reorganise or make changes to our business Legal obligation: where we need to use your personal data to comply with our legal obligations. 5(e): In relation to fraud prevention 5(j): To enforce our terms and in connection with legal or regulatory obligations and to manage claims Consent: where you have given your consent to the processing of personal data for one or more specified purposes 5(i): To provide marketing materials International transfers of personal data (specifically, transfers outside of the EEA and UK) The provisions of this section III apply in addition to section 9 of the privacy policy If transfers are made to other countries that are not deemed to provide adequate protections under EEA or UK law, we will ensure that such transfer is subject to appropriate safeguards in accordance with applicable data protection laws such as approved standard contractual clauses. You can contact the relevant data controller as per Section 12 of the privacy policy for further information about the safeguards applied to your personal data. Appendix 3: USA specific provisions If you are located in the USA, the provisions of this Appendix 3 apply in addition to the provisions of the privacy policy. For all States except California What are your rights? The provisions of this section I apply in addition to section 11 of the privacy policy. In some states you have certain rights pertaining to your personal data, including: the right to delete, the right to opt out, the right to access your Personal data, and the right not to be discriminated against. Tracking We will not respond to Web browser “do not track” signals. If you would like additional information about online tracking and various opt-out mechanisms, please see https://youradchoices.com/ Because we link to social media sites, and from time to time may include third-party advertisements, other parties may collect your personally identifiable information about your online activities over time and across different websites when you visit this website. Please note that not all tracking will stop even if you delete cookies. For California Residents Only Where California privacy laws apply (if you are a consumer resident in California and where we meet the relevant threshold tests) the following additional provisions apply: What personal data do we collect? Why do we use your personal data?Who do we share your personal data with and why? The provisions of this section II apply in addition to section 4, section 5 and section 7 of the privacy policy. The information that we collect is set out in the main body of the privacy policy. We further detail it below in accordance with California privacy requirements: Category Business/Commercial Purpose Disclosed to Third Parties Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, or other similar identifiers. To perform services on behalf of ourselves, including servicing your account and providing you customer service and for the purposes set out in section 5 of the privacy policy. Personal information is disclosed in accordance with section 7 of the privacy policy. Recipients include service providers; business partners; our affiliated companies; other users of our websites/applications; and other parties as required for legal and regulatory purposes. Your signature, physical characteristics or description, telephone number, bank account number, credit card number, debit card number, or any other financial information. To perform services on behalf of ourselves, including servicing your account and providing you customer service and for the purposes set out in section 5 of the privacy policy. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. To perform services on behalf of ourselves, including servicing your account and providing you customer service and for the purposes set out in section 5 of the privacy policy. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet web site, application, or advertisement. Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards and for the purposes set out in section 5 of the privacy policy. Geolocation data To perform services on behalf of ourselves, including servicing your account and providing you customer service and for the purposes set out in section 5 of the privacy policy Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. To perform services on behalf of ourselves, including servicing your account and providing you customer service and for the purposes set out in section 5 of the privacy policy. Any other such personal information as set out in section 4 of the privacy policy. To perform services on behalf of ourselves, including servicing your account and providing you customer service and for the purposes set out in section 5 of the privacy policy. We may aggregate or de-identify any personal information that we collect in connection with our services, such that the information is no longer personally identifiable or attributable to you. We may use such aggregated information for our own legitimate business purposes without restriction. We do not sell the personal information of minors under 16 years of age without affirmative authorization. We will retain your personal information in accordance with Section 10 of the main body of the Privacy Policy. What are your rights? The provisions of this section III apply in addition to section 11 of the privacy policy. As a California resident, you have the right: to request access to the personal information we have about you; to request that we delete personal information about you, subject to certain exceptions and limitations; to request that we correct personal information about you to the extent that it is inaccurate or out of date; to opt-out of certain uses, transfers, exchanges or disclosures (including to third parties) of personal information about you, as further explained below; and not to be discriminated against based upon whether you decide to opt-out. You have the right to request that we disclose to you what information we collect, use, disclose, sell or share. Under California law, “sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration. Under California law, "share" is broadly defined to include the disclosure of personal information for cross-context behavioral advertising (sometimes called “targeted advertising”). To the extent that we “sell” or “share” your personal information under applicable law, you have the right to opt out of such “selling” or “sharing”. Please note, we do not “sell” or “share” your personal information as those terms are defined under applicable law, and we have not done so within the past 12 months. To submit a request regarding personal data by email, please contact us as per Section 12 of the privacy policy. Please note for your protection, any request sent to us to access or delete your personal information will be subject to the following verification procedure: upon your submission of a request, we will send an email confirmation to the email address we have on file for you requiring you to confirm your request. When you have completed this two-step process we will verify the information that you provide in your request we have on file for you. We reserve the right to deny your request if we cannot verify your identity. Where we deny your request in whole or in part, we will endeavor to inform you of the denial, provide an explanation of our actions, and provide the reasons for the denial. We shall not discriminate against you for exercising any of your above rights. You may designate an authorized agent to make a request to exercise your rights on your behalf. Your authorized agent must be able to provide to us written proof that you have authorized the agent to act on your behalf. For your protection, we reserve the right to deny any request from an agent who does not submit proof that they have been authorized to act on your behalf. We reserve the right to deny any request from an agent if we cannot verify your identity or the agent’s identity. Cookies and Similar Technologies The provisions of this section IV apply in addition to section 6 of the privacy policy. We will not respond to Web browser “do not track” signals. If you would like additional information about online tracking and various opt-out mechanisms, please see https://youradchoices.com Because we link to social media sites, and from time to time may include third-party advertisements, other parties may collect your personally identifiable information about your online activities over time and across different websites when you visit our websites/applications. Please note that not all tracking will stop even if you delete cookies. Appendix 4: South Africa specific provisions We may process and share your personal data with our affiliates or subsidiaries in South Africa. The provisions of this Appendix 4 will apply in addition to our privacy policy. Download in English | Download in Afrikaans Terminology For this Appendix 4, terms in the privacy policy will be understood as follows under the Protection of Personal Information Act, 2013 (POPIA): "Controller" means 'responsible party' as defined in section 1 of POPIA. "Processor" means 'operator' as defined in section 1 of POPIA. "Personal data" means 'personal information' as defined in section 1 of POPIA, including any information relating to an identifiable, living individual, and, where applicable, an identifiable, existing juristic person. Personal Information We Collect In addition to the categories listed in section 4 of the privacy policy, 'personal information' means information about a natural or juristic person from which that person can be identified. It does not include anonymous information. We do not collect special personal information (e.g., race, ethnicity, religious beliefs, sex life, sexual orientation, political opinions, trade union membership, health, genetic and biometric information) or information about criminal behavior. We do not knowingly process personal information relating to children. Collection Methods We collect personal information through: Direct Interactions: You may provide personal information when you: Create a user account on our website/applications. Fill in forms or correspond with us by post, phone, email, or otherwise. Use our products and services. Engage with us for a potential contract or commercial engagement. Subscribe to our newsletters or publications. Request marketing materials. Enter a competition, promotion, or survey. Provide feedback or contact us. If you fail to provide required information, we may not be able to perform the contract or service, and we will notify you if this is the case. Automated Technologies: We automatically collect technical information about your equipment, browsing actions, and patterns through cookies, server logs, and similar technologies. We may also receive information from other websites using our cookies. Third Parties/Public Sources: We may receive personal information from: Analytics providers. Advertising networks. Search information providers. Providers of technical, payment, and delivery services. Other publicly available sources. Cross-Border Transfers This section applies in addition to section 9 of the privacy policy. We may share your personal information within our group or with third parties, potentially transferring it outside South Africa. We ensure protection by requiring recipients to adhere to similar rules as in our privacy policy. Your Rights Notification of Collection: You have the right to be informed when your personal information is collected and its source if not collected from you. Notification of Security Compromises: You have the right to be notified if your personal information is accessed or acquired by an unauthorised person. Access: You can confirm, free of charge, whether we hold your personal information and request a copy or description of it (a fee may apply). Correction: You can request correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained personal information. Destruction/Deletion: You can request deletion of your personal information if there is no good reason for us to continue processing it. We may not always comply for specific legal reasons, which will be notified to you. Objection: You can object to processing based on legitimate interests or for direct marketing purposes. Restriction: You can request suspension of processing in certain scenarios, such as verifying accuracy or for proof purposes. Withdraw Consent: You can withdraw consent at any time, but this will not affect the lawfulness of prior processing. Withdrawal may affect service provision. Complaint: You can submit a complaint to the South African Information Regulator. Civil Proceedings: You can institute civil proceedings regarding alleged interference with your personal information protection.