Data Subject Rights

This page explains the rights that individuals have over their personal information held by XBert, and how to exercise those rights.

XBert operates as both a data controller (for information about XBert’s own users and prospects) and a data processor (for accounting data and other information that XBert processes on behalf of the accounting firms that use the platform). The pathway to exercise a right depends on which role applies.

1. If your firm is an XBert customer

Where XBert processes your personal information on behalf of an accounting firm that uses XBert (for example, you are an employee or client of that firm), the firm is the data controller for that information. Requests under the rights below should be directed to the accounting firm in the first instance. XBert will support the firm in responding to your request as a data processor.

2. If XBert is the data controller

Where XBert is the data controller for your information — for example, you have created an XBert account directly, you are an XBert prospect, employee, or contractor — the following rights apply.

2.1 Australian Privacy Principles (APPs) — Privacy Act 1988 (Cth)

Right	Description
Access (APP 12)	You may request access to your personal information that XBert holds.
Correction (APP 13)	You may request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
Anonymity and pseudonymity (APP 2)	Where lawful and practicable, you may interact with XBert anonymously or under a pseudonym.
Complaints handling	You may make a complaint about how XBert has handled your personal information; XBert will respond within 30 days.
Escalation	If you are not satisfied with XBert’s response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Right	Description
Right of access (Art. 15)	Confirmation of whether your personal data is being processed, plus a copy of that data.
Right to rectification (Art. 16)	Correction of inaccurate or incomplete personal data.
Right to erasure (Art. 17)	“Right to be forgotten” — deletion of personal data under specified conditions.
Right to restriction (Art. 18)	Restriction of processing under specified conditions.
Right to data portability (Art. 20)	Receive your personal data in a structured, commonly used, machine-readable format.
Right to object (Art. 21)	Object to processing based on legitimate interests or for direct marketing.
Rights related to automated decision-making (Art. 22)	Right not to be subject to a decision based solely on automated processing that produces legal effects.
Right to lodge a complaint (Art. 77)	With a supervisory authority in the EU member state or the UK ICO.

3. How to exercise a right

Send a written request to security@xbert.io including:

Your name and the email address associated with your XBert account (if applicable)
The right you are exercising
A description of the information your request relates to
Verification of identity (XBert may request additional verification before acting on the request)

XBert will respond to verified requests within:

30 days for Australian Privacy Principle requests
One month for GDPR requests (extendable by two further months for complex requests, with notification)

There is no fee for a standard request. XBert may charge a reasonable fee for manifestly unfounded, excessive, or repetitive requests, as permitted by law.

4. What XBert collects and why

XBert publishes a Privacy Policy at xbert.io that explains in detail what personal information XBert collects, how it is used, who it is shared with, and how long it is retained. This page complements that policy.

5. Retention

Personal information is retained only for as long as is necessary to deliver the XBert service and to meet legal, regulatory, and accounting obligations. See the Data Retention & Disposal Policy for the full retention schedule.

Version	Date	Change
1.0	2026-06-04	Initial publication