GDPR
Xano & the General Data Protection Regulation (GDPR)
Last updated
Xano & the General Data Protection Regulation (GDPR)
Last updated
Effective May 2018, the General Data Protection Regulation (GDPR) was drafted and passed by the European Union (EU), it imposes obligations onto organizations anywhere, so long as they target or collect data related to people in the EU.
Xano continually champions initiatives that prioritize and improve the security and privacy of customer personal data, and we want you, as a Xano customer, to feel confident using our services in light of GDPR requirements. If you partner with Xano, we will support your GDPR compliance efforts by:
Committing in our Privacy Notice to comply with GDPR in relation to processing of customer personal data.
Offering additional security capabilities and features that may help you better protect data that is most sensitive.
Disclosing Subprocessors and offering documentation to assist you in your privacy assessment of our services.
Continuing to evolve our capabilities as the regulatory landscape changes.
You should review this document in conjunction with our Privacy Notice and potentially contact a specialist for legal advice.
What role Does Xano's third-party ISO/IEC 27001, and SOC 2/3 reports play in compliance with the GDPR?
Our third-party ISO/IEC certifications and SOC 2/3 audit reports can be used by customers to help conduct their risk assessments and help them determine whether appropriate technical and organizational measures are in place.
Xano is a data processor for any personal data made available by our customers.
Xano clients will usually act as the data controller for any personal data made available to Xano.
Xano offers a GDPR-compliant DPA (Data Processing Agreement), allowing customers with GDPR contractual obligations to receive a signed DPA. Xano's DPA is available for all users with an account who contact support either through email support@xano.com or by support chat, as shown below.
Please note GDPR requirements will be covered only for the customers who sign the DPA and acquire a GDPR-compliant plan. All other plans will not cover GDPR requirements.
Choose the following options: OK > Security and Compliance > I need to sign a GDPR DPA
Someone from our support team will verify your account and guide you through the appropriate next steps.
GDPR is a regulation in EU law on data protection and privacy in the European Union (EU) and the European Economic Area (EEA). Itβs primary aim is to enhance individuals' control and rights over their personal data and to simplify the regulatory environment for international business. Superseding the Data Protection Directive 95/46/EC, the regulation contains provisions and requirements related to the processing of personal data of individuals (formally called data subjects in the GDPR) who are located in the EEA, and applies to any enterpriseβregardless of its location and the data subjects' citizenship or residenceβthat is processing the personal information of individuals inside the EEA.
The GDPR applies to all organizations based inside or outside the EU that processes personal data of EU individuals. According to the European Commission Personal data is any information relating to an identified or identifiable natural person.
Not necessarily. The requirements of the GDPR apply to the physical location of the person whose data is being used, rather than their citizenship. If an EU citizen purchases an item while traveling or living in the United States and their data is then stored by an American company, in U.S.-based computer servers β the GDPR would not apply.
Conversely, if an American citizen is living or staying in the EU for an extended period, the GDPR can apply to the usage of his or her data. U.S. citizens who are living in the United States are not subject to these requirements.
Xano Subprocessors under the GDPR, is categorized as any business or contractor that customer data may pass through as a side effect of using Xano's service. See more.
A data controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Data controllers are key decision-makers. They have the overall say and control over the reason and purposes behind data collection and the means and method of any data processing.
Some data controllers may be governed by a statutory obligation to collect and process personal data. According to Section 6(2) of the 2018 Data Protection Act, if an organization is under such an obligation and processes personal data for compliance, it will be classed as a data controller.
A private company or any other legal entity β Including an incorporated association, incorporated partnership, or public authority.
An individual person β Such as a partner in an unincorporated partnership, a sole trader, or any self-employed professional.
Please see the GDPR checklist for data controllers.
A data processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
An organization that processes data on behalf of a data controller like cloud service providers. Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Xano will typically act as the data processor for any person data made available by your customers.
Click the Help button in the lower-left corner anywhere in Xano. Make sure you are logged in to your Xano account.
