Privacy Policy

Home/Privacy Policy

Version 1.0 — Effective 1 October 2026

1. Who we are

The controller for the processing described in this policy is XtenCore, registered with the Dutch Chamber of Commerce (KvK) under number 42178845, VAT number NL002877816B87 (“XtenCore”, “we”).

Contact for all privacy questions and requests: support@xtencore.com.

We have not appointed a Data Protection Officer, as we are not legally required to.

2. What this policy covers

This policy covers the Data Quality Companion extension for Microsoft Dynamics 365 Business Central (“the extension”), the online licence and billing service behind it, and our website xtencore.com.

The extension is designed to keep your business data in your own environment. Section 4 below explains what never reaches us.

3. What we process, why, and on what legal basis

3.1 Licence check data

  • What: your Microsoft Entra Tenant ID and a licence key (API key), sent by the extension to our licence service, plus the time of the request.
  • When: nothing is sent when you install the extension. The first contact with our licence service happens when an administrator clicks Activate on the Data Quality Companion Setup page. From that point on, the extension checks in automatically, roughly once a day, to keep your licence status current.
  • Why: to verify that your organisation has a valid trial or subscription and to provide the extension.
  • Legal basis: performance of the contract (Art. 6(1)(b) GDPR). For security and the prevention of trial abuse: our legitimate interest (Art. 6(1)(f)).

A Tenant ID identifies an organisation, not a person. It can become linked to a person, for example when the buyer completes a purchase with that Tenant ID as reference (see 3.3).

3.2 Licence record

  • What: we store, per Tenant: Tenant ID, subscription tier, licence status, trial and validity dates, time of the last check, the Stripe customer ID and subscription ID (once you have subscribed), and the licence key issued to your Tenant.
  • Why and legal basis: as in 3.1.
  • Where: Azure Table Storage in the Belgium Central region (EU).

3.3 Purchase and billing data

  • What: name, email address, country and billing details, and payment details you enter at checkout. Payment details (such as card numbers) are collected and stored by Stripe. We never see them. We receive confirmation of the payment, your Stripe IDs, and invoice data.
  • Why: to process your subscription, send invoices, and meet our tax and accounting obligations.
  • Legal basis: performance of the contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).

3.4 Information we receive from Microsoft

When you install the extension from Microsoft AppSource, Microsoft may share contact, usage, and transaction information with us, such as the name, email address, company, and country of the administrator who installs it. Microsoft acts as an independent controller for its own processing. We use this information to support you and to administer the customer relationship.

Legal basis: performance of the contract (Art. 6(1)(b)) and our legitimate interest in supporting our customers (Art. 6(1)(f)).

3.5 Support communication

  • What: the name, email address, and content of messages you send us, including any attachments.
  • Why: to answer your request and improve the extension.
  • Legal basis: performance of the contract or steps prior to entering into one (Art. 6(1)(b)), and our legitimate interest (Art. 6(1)(f)). We ask you not to send customer, vendor, or other business data in support requests.

3.6 Technical logs

  • What: our licence service is hosted on Microsoft Azure. Requests to it may be logged with technical data such as the time, the request address (which includes the Tenant ID), the outcome, and the IP address of the server making the request. Requests from Business Central online originate from Microsoft’s servers, not from your users’ devices.
  • Why: to keep the service secure, diagnose errors, and detect abuse.
  • Legal basis: our legitimate interest (Art. 6(1)(f)).

4. What stays in your environment

The extension runs inside your Business Central environment. We do not receive any of the following: customer or vendor records, field values, completeness scores, the list of missing fields, Change Log entries, the names or email addresses of your Business Central users, or any financial or sales data.

The extension does not send usage analytics or telemetry to us. The only data that leaves your environment is the licence data described in 3.1, and, if you use the Manage Subscription or upgrade actions, your browser is sent to Stripe.

Because we do not process Business Central data on your behalf, we are not a processor of that data, and you are the controller of it. The extension can switch on Business Central’s Change Log for fields you mark as mandatory. That log is stored in your own environment and is under your control (see Section 9.4 of our End User License Agreement).

5. Who we share data with

We do not sell personal data and do not use it for advertising. We use the following providers:

  • Microsoft (Azure) — processor — hosting of our licence service and database (Belgium Central, EU).
  • Stripe (Stripe Payments Europe, Limited, and affiliates) — processor for payment processing on our behalf, and independent controller for its own legal and fraud-prevention obligations — checkout, subscription billing, customer portal (PCI DSS Level 1 certified).
  • Microsoft (AppSource / Partner Center) — independent controller — distribution of the extension and sharing of customer contact and transaction information with us (see 3.4).
  • TransIP B.V. — processor — hosting of our website and email (the Netherlands).

We may also disclose personal data where the law requires it or to establish, exercise, or defend legal claims.

6. International transfers

We store the licence data in the EU (Belgium Central). Some of our providers, in particular Stripe, may process personal data outside the European Economic Area, including in the United States. Where that happens, the transfer relies on an adequacy decision, the EU–US Data Privacy Framework, or the European Commission’s standard contractual clauses.

7. How long we keep data

  • Licence record: while the extension is active in your Tenant, and up to 12 months after the last successful licence check or the end of your subscription, whichever is later. We clean up at least once a year.
  • Invoices and payment records: 7 years, as required by Dutch tax law.
  • Support communication: up to 24 months after the request is closed.
  • Information received from Microsoft (3.4): up to 12 months after the end of the customer relationship.
  • Technical logs: up to 30 days.

Stripe keeps data on its own systems according to its own policies and legal obligations.

8. Your rights

You have the right to access your personal data, have it corrected or erased, restrict or object to its processing, and receive it in a portable format. Where a right depends on a legal basis, we will apply it as the law provides. For example, we must keep invoice data for the legal retention period.

To exercise a right, email support@xtencore.com. We may ask you to verify your identity, and for licence data we may ask for your Tenant ID. We respond within one month.

You can request deletion of your licence record at any time. Deleting it ends your access to the paid features, so please cancel any active subscription first.

If you believe we are not handling your personal data properly, you can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in your country.

9. Security

Licence requests are sent over HTTPS and are authenticated with a licence key. Inside Business Central, the key is kept in the platform’s isolated storage rather than in an ordinary table. Our licence data is stored on Microsoft Azure, which encrypts stored data by default, and access to our systems is restricted to the operator of XtenCore.

If a personal data breach occurs that poses a risk to you, we will notify the Dutch Data Protection Authority and, where required, the people affected, as the law provides.

10. Other information

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The extension and our services are intended for business use and are not directed at children.

Our website

Our website address is https://xtencore.com. When you submit the contact form, the information you provide (name, email address, and message) is stored in our website’s database and sent by email to our support address. We do not use analytics or tracking cookies on this website. Visitors cannot create an account on this website. If a blog article includes embedded content from another website (such as a video), that content behaves as if you had visited the other website directly, and that website may collect data about you independently of us.

11. Changes to this policy

We may update this policy. The current version is always available at this address, with its effective date at the top. If we make a significant change to how we process personal data, we will notify our customers by email or in the extension.

12. Contact

XtenCore
KvK 42178845 · VAT NL002877816B87
support@xtencore.com · https://xtencore.com