DRT-PRIVACY POLICY
PikoHANA Pte. Ltd. – Dashboard Reporting Tool
Last updated: January 2026
This Privacy Policy explains how PikoHANA Pte. Ltd. (UEN: 201226975Z) collects, uses, processes, stores and protects personal data in connection with our dashboard reporting software application made available via the Xero App Marketplace.
1. Scope
This Policy applies to personal data processed through our Software, data accessed via Xero API integration, and data collected through our website.
This Policy does not apply to data processed directly by Xero.
2. Categories of Personal Data
Data retrieved from Xero via API may include organisation details, financial transactions, invoices, contact names, contact emails, payment records and account balances.
Account registration data may include name, business name, email address and billing details.
Technical data may include IP address, device type, browser type and usage logs.
3. Legal Basis for Processing
We process personal data for contract performance, legitimate interests, legal compliance and consent where required.
Under the Singapore PDPA, PikoHANA acts as a data intermediary when processing data on behalf of Customers.
4. Use of Personal Data
To provide dashboard and reporting functionality.
To maintain secure API connectivity with Xero.
To provide customer support and improve service performance.
To comply with legal and regulatory requirements.
5. Data Sharing
We may share data with cloud hosting providers, payment processors, IT service providers and regulatory authorities where required.
We do not sell personal data or use Xero data for advertising.
6. Data Retention
Personal data is retained only as long as necessary for service provision, contractual obligations and legal requirements.
Upon termination, API access is disconnected and data may be deleted after a reasonable retention period.
7. Data Security
We implement encryption, access controls, secure hosting and monitoring measures.
No internet transmission method is completely secure.
8. Your Rights
Subject to applicable law, you may request access, correction or deletion of personal data.
Where we act as a data intermediary, requests may need to be directed to the relevant data controller.
9. Contact Information
PikoHANA Pte. Ltd.
10 Petain Road, #04-01
Singapore 208089
Email: [Insert Privacy Email Address]
DATA PROCESSING ADDENDUM (PDPA + GDPR ALIGNED)
This Data Processing Addendum (“DPA”) forms part of the End User Licence Agreement between PikoHANA Pte. Ltd. (“Processor”) and the Customer (“Controller”).
1. Roles of the Parties
The Customer acts as Data Controller.
PikoHANA acts as Data Processor (or Data Intermediary under PDPA).
Processing shall occur only on documented instructions of the Controller.
2. Nature and Purpose of Processing
Processing is limited to retrieving, analysing, transforming and displaying accounting data from Xero for dashboard reporting purposes.
3. Categories of Data Subjects
Employees, customers, vendors, contractors and other contacts contained within the Customer’s Xero organisation.
4. Types of Personal Data
Names, contact details, financial transaction data, invoice details, payment records and user identifiers.
5. Security Measures
Encryption in transit (TLS).
Access controls and authentication safeguards.
Role-based access restrictions.
Secure hosting infrastructure.
6. Sub-processors
PikoHANA may engage cloud hosting providers and IT service providers as sub-processors.
All sub-processors are subject to contractual data protection obligations.
7. International Transfers
Where personal data is transferred outside Singapore or the EEA, appropriate safeguards shall be implemented.
8. Data Subject Rights
Processor shall assist Controller in responding to data subject access, correction and deletion requests.
9. Data Breach Notification
Processor shall notify Controller without undue delay upon becoming aware of a personal data breach.
10. Deletion or Return of Data
Upon termination, personal data shall be deleted or returned to the Controller, unless retention is required by law.
11. Audit Rights
Controller may request reasonable information to demonstrate compliance with this DPA.