This text is a template the platform prepared for the legal adviser of NXDPRO Solutions to review. It is not legal advice and may change before it applies. Where a detail is missing, it is marked.
This policy covers the data NXDPRO Solutions processes for its own purposes, under the General Data Protection Regulation (EU) 2016/679 (GDPR) and Cyprus Law 125(I)/2018. The data of a store’s customers is processed by the store itself, under its own privacy policy; we host it on the store’s behalf, as set out in the Data processing agreement.
1. Controller
The controller of the data in this policy is NXDPRO Solutions:
- Name
- NXDPRO Solutions
- Address
- Pontidos 17
- Registration number
- 00000000
- VAT / tax identification number
- 00000000
- [email protected]
2. What data we process
- Requests from this site (invitation request, contact message): name, business, email, phone, country, what you sell, where you sell today, website and anything you write, with the page’s language and the version of this policy you saw. We do not keep your IP address with the request.
- Admin accounts (you and your team): name, email, password (only as a cryptographic hash), the two-step verification secret (encrypted), language, sign-in attempts with their IP address, and the activity log of the admin with the IP address.
- The business account: billing details, plan, and when, by whom and from which IP address the terms and the data processing agreement were accepted.
- Technical data: the IP address, the browser and the pages requested, in the server’s logs; for requests the server’s firewall blocks, their content too.
- Shop reports (the “Report this shop” link in every store’s footer): what you wrote, the page you named and, if you gave it, your email, so that we can confirm we received the report and tell you what we decided.
- Addresses that do not take email: when an email to an address bounces for good or the address does not exist, we keep only a cryptographic hash of it, and no store on the platform sends it newsletters any more; when the recipient marks an email as spam, only the store that sent it stops.
3. Why, and on what legal basis
- To answer your request and, if we work together, to open your account: steps prior to a contract, at your request (Article 6(1)(b) GDPR).
- To provide the service to your account: performance of the contract (Article 6(1)(b)).
- For the platform’s security and to prevent abuse (sign-in attempts, request limits, logs): legitimate interest (Article 6(1)(f)).
- To look into shop reports, confirm we received them and tell those who gave us an email what we decided: legal obligation (Article 6(1)(c) GDPR and Article 16 of Regulation (EU) 2022/2065, the Digital Services Act).
- So that newsletters are not sent to addresses that do not exist or do not take them, and every store’s emails keep reaching their recipients: legitimate interest (Article 6(1)(f)).
- For our tax and accounting obligations (invoices): legal obligation (Article 6(1)(c)).
4. No advertising
We do not send you advertising without your consent, and we neither sell your data nor give it to others for their own purposes. This site uses no statistics or advertising cookies.
6. Who receives the data
The data reaches only the providers that help us run the service, as processors on our behalf: the server’s hosting provider (OVH), the Cloudflare network, the email delivery provider when we use one and the provider of the mailbox where we receive requests and their notifications (OVHcloud), as well as our accountant and the authorities when the law requires it. The full list: Sub-processors.
7. Transfers outside the EEA
Where a provider processes data outside the European Economic Area (such as Cloudflare, Inc. in the USA), the transfer relies on an adequacy decision or standard contractual clauses, as the provider’s terms set out. [The legal adviser confirms.]
8. How long we keep them
- Requests from this site: 24 months after they last changed, or less if you ask us to delete them; we then delete the email notification we received about it too.
- Admin accounts: as long as they have access to a store; they are deleted 30 days after no store they belong to is left.
- Sign-in attempts: 30 days. Activity log: 365 days. Logs of the server and its firewall (IP address, browser, page): 90 days; the application’s logs: 30 days. Backups: up to 35 days.
- Shop reports: 2 years after they are closed.
- Addresses that do not take email (only as a cryptographic hash): for as long as the platform runs. [The legal adviser confirms the period.]
- Acceptances of the terms and invoices: for as long as we work together and as long as tax law requires afterwards. [The legal adviser confirms the period.]
9. Your rights
You have the right to ask for access to your data, rectification, erasure, restriction of processing and portability, and to object to processing based on legitimate interest. Write to us at [email protected]; we answer within one month. You may also complain to the Office of the Commissioner for Personal Data Protection (1 Iasonos Street, 1082 Nicosia, www.dataprotection.gov.cy).
10. Security
Every connection uses HTTPS, passwords are stored as cryptographic hashes, secrets (provider keys, two-step verification) encrypted, access to the admin works with roles and two-step verification where switched on, and we keep a copy of the database every night, on the same server; there is no copy in another location yet.
11. Changes
When this policy changes, so does its version at the top of the page. We tell account holders about significant changes.