Privacy Policy

Ximplex is accounting software operated by [Legal entity name] ([RC number]), registered at [Registered address]. In this policy, "Ximplex", "we" and "us" refer to that company, and "you" refers to the person or business using the service.

This policy explains what we collect, why we collect it, who we share it with, and what you can ask us to do with it. It applies to the Ximplex web application, our marketing site, and any support we provide alongside them.

Where we decide why and how personal data is processed, we act as a data controller. Where we process data on your instructions — for example, records about your own customers, suppliers or employees that you enter into Ximplex — we act as a data processor and you remain the controller.

We collect the following categories of information:

• Account information — name, email address, phone number, password credentials, business name, role, and multi-factor authentication settings.
• Business and financial records — invoices, bills, credit notes, purchase orders, journal entries, payroll records, inventory, chart of accounts, tax positions, and any documents you upload such as bank statements or receipts.
• Bank connection data — where you link a bank account, the account identifiers, balances and transaction history returned by our open-banking partner. We do not receive or store your online banking password.
• Payment information — subscription plan, billing history and payment status. Card details are handled by our payment processor and are not stored on our systems.
• Usage and device data — pages visited, features used, IP address, browser and device type, and timestamps, collected to keep the service secure and to understand how it is used.
• Support correspondence — messages you send us and our replies.

You may enter personal data about other people, such as employees on a payroll run or contacts on an invoice. You are responsible for having a lawful basis to provide that data to us.

• To provide the service — recording transactions, generating reports, running payroll, preparing tax figures and producing compliant invoices.
• To authenticate you and protect your account, including multi-factor authentication and fraud prevention.
• To bill you and to collect subscription payments.
• To provide support and respond to your questions.
• To improve the product, diagnose faults and monitor performance and reliability.
• To send service messages about changes, incidents, billing or security. These are not marketing and you cannot opt out of them while you hold an account.
• To send product and marketing updates, where you have asked to receive them. You can withdraw consent at any time.
• To meet our own legal, regulatory, tax and accounting obligations.

Under the Nigeria Data Protection Act 2023, we rely on the following bases:

• Performance of a contract — to deliver the service you have subscribed to.
• Legitimate interests — to secure the platform, prevent fraud, and improve the product, balanced against your rights.
• Legal obligation — to keep records and respond to lawful requests from regulators or courts.
• Consent — for optional marketing communications and any non-essential cookies. Consent can be withdrawn at any time without affecting processing already carried out.

Bank connections are provided through [licensed open-banking partner], which is licensed to provide account-information services. When you connect an account you authenticate directly with your bank or with the partner — your banking credentials are never entered into Ximplex and are never visible to us.

We receive account details, balances and transactions so that they can be matched against your records. You can disconnect a bank account at any time from your account settings, which stops any further data being retrieved. Transactions already imported into your books remain, because they form part of your accounting records.

We do not sell personal data. We share it only in these circumstances:

• Service providers — hosting, database, email delivery, payment processing, open banking, error monitoring and customer support tools, each engaged under a contract that limits them to processing on our instructions.
• Your own team — other users you invite to your organisation, according to the role and permissions you assign them.
• Professional advisers — where you invite an accountant or auditor into your account.
• Legal and regulatory — where we are required to disclose by law, court order or a competent regulator, or where disclosure is necessary to establish or defend legal claims.
• Business transfer — if the business is sold or reorganised, subject to the acquirer honouring this policy.

A current list of our sub-processors is available on request from [privacy@domain].

Some of our service providers operate outside Nigeria. Where personal data is transferred abroad, we do so only where the destination provides an adequate level of protection, or under contractual safeguards that meet the requirements of the Nigeria Data Protection Act 2023.

We keep your account and financial records for as long as your account is active. After an account is closed we retain records for the period required by Nigerian tax and companies legislation, after which they are deleted or irreversibly anonymised.

You can export your data at any time while your account is active. If you ask us to delete data that we are legally required to retain, we will restrict its processing instead of erasing it, and explain why.

We protect data in transit with TLS encryption and encrypt it at rest. Access to production systems is restricted to staff who need it, authentication supports a second factor, and account activity is logged.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission and affected users as required by law.

Under the Nigeria Data Protection Act 2023 you may:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to delete data, where we have no continuing legal basis to keep it.
• Object to processing based on our legitimate interests, or ask us to restrict it.
• Ask us to provide your data in a portable, machine-readable format.
• Withdraw consent where processing is based on consent.
• Complain to the Nigeria Data Protection Commission if you believe we have handled your data unlawfully.

To exercise any of these, contact [privacy@domain]. We will respond within the timeframe set by law and may ask you to verify your identity first.

We use cookies that are strictly necessary to sign you in and keep your session secure. These cannot be turned off without breaking the service.

Where we use analytics or other non-essential cookies, we ask for your consent first, and you can change that choice at any time in your browser or through any cookie controls we provide.

Ximplex is a business product and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy as the service or the law changes. The date at the top of this page shows when it was last revised. Where a change materially affects your rights we will notify account holders directly before it takes effect.

Questions about this policy, or about how your data is handled, can be sent to [privacy@domain], or by post to [Legal entity name], [Registered address].