# Xero: Privacy (legal) page changed > Xero’s privacy notice now describes collecting government-issued identification, facial imagery and biometric data for identity verification, plus sanctions screening and sharing with security and compliance partners that may act as independent data controllers. It also adds guidance on requesting r Canonical: https://rewindex.com/change/p7949 Last updated: 2026-10-26T08:45:44Z **Summary:** Xero’s privacy notice now describes collecting government-issued identification, facial imagery and biometric data for identity verification, plus sanctions screening and sharing with security and compliance partners that may act as independent data controllers. It also adds guidance on requesting review of automated decisions, clarifying customers’ options and the expanded handling of sensitive data. _(machine-written, sol)_ - Kind: Privacy policy · Label: Changed (not classified) (rule) - Changed: 2026-10-26 08:45 UTC · Detected: 2026-10-26 08:45 UTC - [Source: https://xero.com/privacy](https://xero.com/privacy) - [Company: Xero](https://rewindex.com/company/xero.md) - Versions: before page\_version:3622 → after page\_version:7949 - Change 3 of 6 for this page ## What changed **1. Changed** ```diff …Offer ends ‹date› . Terms apply. Buy now - 1 4 Days 1 1 Hours 2 7 Mins 5 1 + 0 8 Days 1 0 Hours 3 1 Mins 3 6 Secs Pricing Features Popular features Accounting Software Manage… ``` **2. Changed** ```diff …get it How we use your personal data - ’ + Automated decision-making Cookies and similar tracking technologies How we share… ``` **3. Added** ```diff …our services. We source this directly from you. + Verification and identification data to verify your identity and the details of your business, we collect government-issued identification documents such as passports and driver's licenses. We also may collect facial imagery and biometric data (including facial recognition templates) to match you to your identity documents and ensure it really is you when accessing our services through your login. We source this directly from you or from… ``` **4. Changed** ```diff …you, our business and people, we may use - malware + anti-malware and other monitoring tools to detect suspicious activity… ``` **5. Changed** ```diff …and uploaded content. For legal and regulatory compliance. - For example, to comply with any + To comply with all legal and regulatory obligations which apply to us.… ``` **6. Changed** ```diff …all legal and regulatory obligations which apply to - us, including responding to + us. This includes sanction screening, where we use your identity and business data to screen against international and domestic sanctions lists to ensure we are not providing services to prohibited individuals or entities in compliance with laws in the jurisdictions where we operate. Legal and regulatory compliance may also require us to respond to information requests under data protection or other applicable laws.… ``` **7. Added** ```diff …data, communications data, device data, service usage data, + uploaded content, and verification and identification data. To manage legal claims. For example, to preserve… ``` **8. Added** ```diff …Please contact us using the details in the + 'How to contact us' section. You can give us information you'd like us to take into account, ask us to explain the decision in general terms, and ask us to review it. There are limits on what we can tell you — for example, where the law prevents us from doing so, or where explaining the details would undermine the prevention or detection of crime. 7. Cookies and similar tracking technology We use cookies… ``` **9. Changed** ```diff …control them, please see our cookie notice . - 7. + 8. How we share your personal data There will… ``` **10. Added** ```diff …their own marketing purposes without your explicit consent. + Security and compliance partners: We share personal data with specialized partners, who provide identity verification, sanctions screening, and fraud detection services. These partners may act as independent data controllers for certain activities, such as verifying your identity against global databases. They may also use anonymised or aggregated data across their network to improve fraud detection models and platform security for all users. Third party services that you integrate with on… ``` **11. Changed** ```diff …your use of our services with that subscriber. - 8. + 9. Personal data retention We'll retain your personal data… ``` **12. Changed** ```diff …that, we'll make sure it’s deleted or anonymised. - 9. + 10. Security Security is a priority for us when… ``` **13. Changed** ```diff …from them, sign up to our security noticeboard. - 10. + 11. International transfers When we share personal data, it… ``` **14. Changed** ```diff …safeguards in place to protect your personal data. - 11. + 12. Your rights It’s your personal data and you… ``` **15. Changed** ```diff …to advise you how to submit a complaint. - 12. + 13. Updates to this notice We may update this… ``` **16. Changed** ```diff …notice on our websites and in our apps. - 13. + 14. How to contact us We’re always keen to… ``` **17. Changed** ```diff …else, you can contact us at legalnotices@xero.com . - 14. + 15. Additional information if you’re in the EEA or… ``` **18. Changed** ```diff …(for a description of each purpose, see the - ‘ + ‘How we use your personal data’ section): Contractual necessity. We need certain personal data… ``` ## History of this page | When (UTC) | Change | Label | | --- | --- | --- | | 2026-10-19 08:45 UTC | [Privacy (legal) page changed](https://rewindex.com/change/p2620.md) | Changed (not classified) | | 2026-10-20 12:05 UTC | [Privacy (legal) page changed](https://rewindex.com/change/p3622.md) | Changed (not classified) | | 2026-10-26 08:45 UTC | Privacy (legal) page changed (this change) | Changed (not classified) | | 2026-10-27 08:45 UTC | [Privacy (legal) page changed](https://rewindex.com/change/p8713.md) | Changed (not classified) | | 2026-10-29 08:45 UTC | [Privacy (legal) page changed](https://rewindex.com/change/p10317.md) | Changed (not classified) | | 2026-11-03 08:45 UTC | [Privacy (legal) page changed](https://rewindex.com/change/p13660.md) | Changed (not classified) | Previous: [change](https://rewindex.com/change/p3622.md) · Next: [change](https://rewindex.com/change/p8713.md) · All Xero changes: [timeline](https://rewindex.com/company/xero/changes.md) _Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._ ## Cite this Privacy (legal) page changed on Xero’s Privacy (legal) page, changed 2026-10-26 08:45 UTC (change 3 of 6). - Canonical URL: https://rewindex.com/change/p7949 - Citation: Xero, “Privacy (legal) page changed” (2026-10-26 08:45 UTC). Archived by Rewindex: https://rewindex.com/change/p7949 (CC BY 4.0). - Markdown link: `[Xero: Privacy (legal) page changed (2026-10-26)](https://rewindex.com/change/p7949)` --- Canonical: https://rewindex.com/change/p7949 · Markdown: https://rewindex.com/change/p7949.md · JSON: https://rewindex.com/api/v1/changes/p7949 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T14:40:35.209Z