UbicutoUbicuto ("we") provides accounting software for e-commerce sellers holding inventory across multiple EU countries. This statement describes which personal data we process, for what purposes, and the rights you have.
Two roles
For data of website visitors and account holders we act as controller. For the administration data our customers process through the software — orders, payouts, invoices, including personal data of their buyers contained therein — we act as processor and the customer is the controller. That processing is governed by our Data Processing Agreement.
Data we process
- Website: no cookies, no trackers, no analytics. Server logs (IP address, timestamp, requested page) are retained for at most 14 days for security and troubleshooting.
- Account: name, business email address, phone number, organisation details and credentials (passwords hashed, two-factor authentication).
- Administration (as processor): the data the customer supplies via integrations or uploads, including order data with buyer names and addresses, counterparty VAT numbers and bank transactions.
- Communication: emails and support requests, retained as long as needed for handling and accountability.
Purposes and legal bases
- Providing the service and account management — performance of the contract.
- Invoicing and administration — legal obligation.
- Security, abuse prevention and troubleshooting — legitimate interest.
- Product announcements to customers — legitimate interest; you can opt out at any time.
Retention
- Administration data: in line with the customer's statutory retention obligation (seven years in the Netherlands), on the customer's instruction.
- Account data: deleted within 30 days after termination of the agreement.
- Website server logs: at most 14 days.
Recipients and transfers
We do not sell data and share it only with subprocessors required to deliver the service; the current list is published on the subprocessors page. All customer data is stored and processed within the EU: the application and database run in Germany and document storage is contractually bound to the EU jurisdiction. Where a subprocessor has a parent company outside the EEA, appropriate safeguards apply (EU jurisdiction configuration and standard contractual clauses).
No model training
Customer data is not used to train AI models and is not shared for benchmarking or advertising purposes.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection. Send your request to privacy@ubicuto.com; we respond within one month. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). If your request concerns administration data of one of our customers, we will refer you to that customer as controller and assist them in handling it.
Contact
Ubicuto (a trading name of Maasbach Finance & Audit B.V.) · Biezenwei 23-02, 4004 MB Tiel, The Netherlands · Chamber of Commerce 91773628 · privacy@ubicuto.com