GDPR

How we protect your privacy

on nizu.io and when you use our services

NIZU OÜ and its affiliates offer many services to help you run your business, including a platform to host your own NIZU database. As part of running those services we collect data about you and your business. This data is not only essential to run our services, but also critical for the safety of our services and all our users.
This policy explains what information is collected, why it is collected, and how we use it.

Information we collect

Most of the personal data we collect is directly provided by our users when they register and use our services. Other data is collected by recording interactions with our services.

Account & Contact Data: When you register on our website to use or download one of our products, or to subscribe to one of our services (NIZU Online, Free Trial, NIZU Apps, nizu.io, etc.), or fill in one of our contact forms, you voluntarily give us certain information. This typically includes your name, company name, email address, and sometimes your phone number, postal address (when an invoice or delivery is required),your business sector and interest in NIZU, as well as a personal password.
We never record or store credit card information from our customers, and always rely on trusted third-party PCI-DSS-compliant payment processors for credit card processing, including for recurring payment processing.

How we use this information

Account & Contact Data: We use your contact information in order to provide our services, to answer your requests, and for billing and account management reasons. We may also use this information for marketing and communication purposes (our marketing messages always come with a way for you to opt-out at any time). We also use this data in aggregated/anonymised form in order to analyze service trends.
If you have registered to participate in an event published on our website, we may transfer your name, email address, phone number and company name to our local organizer and to the sponsors of the event for both direct marketing purposes and in order to facilitate the preparations and booking for the event.
If you have expressed interest in using NIZU or otherwise asked to be contacted by an NIZU service provider, we may also transfer your name, email address, phone number and company name to one of our official Partners in your country or region, for the purpose of contacting you to offer their local assistance and services.

Job Application Data: We will only process this information for our recruitment process, in order to evaluate and follow-up with your application, and in the course of preparing your contract, if we decide to send you a job proposition. You may contact us at any time to request the deletion of your information.

Browser Data: This automatically recorded data is anonymously analyzed in order to maintain and improve our services. Google reCAPTCHA may also be used for security purposes, in order to prevent abuse of our services. In that case we only process the anonymous score that reCAPTCHA determines based on your browser and device.
We will only correlate this data with your personal data when required by law or for security purposes, if you have violated our Acceptable Use Policy.

Customer Database: We only collect and process this data on your behalf, in order to perform the services you have subscribed to, and based on the instructions you explicitly gave when you registered or configured your service and your NIZU database.
Our Helpdesk staff and engineers may access this information in a limited and reasonable manner in order to solve any issue with our services, or at your explicit request for support reasons, or as required by law, or to ensure the security of our services in case of violation of our Acceptable Use Policy in order to keep our services secure.

Free Trial Session Recording: The purpose of these recordings is to improve our products: they will be seen and analysed solely by our R&D Usability team, who will treat your data as strictly confidential information. By watching the recordings they will be able to see a tangible representation of a user’s first steps into NIZU and improve the User Experience accordingly.
The recordings are processed and stored with tools provided by FullStory (cf. our list of service providers), under strict confidentiality terms.
The other sections of this Policy explain :

Github.com Account Data: During the configuration phase of your nizu.io project, the platform uses your OAuth token to setup the Github.com project you will use for nizu.io, including the necessary web hooks and deployment key to allow nizu.io to detect every commit you push to your project repository. The OAuth token is not stored and is deleted as soon as you close your nizu.io session, or after 2 days.

The contents of your project repository is stored as long as your nizu.io subscription is active in order to provide the service itself.

Our Helpdesk staff and engineers may access this information in a limited and reasonable manner in order to solve any issue with our services, or at your explicit request for support reasons, or as required by law, or to ensure the security of our services in case of violation of our Acceptable Use Policy in order to keep our services secure.

In-App Purchase (IAP) Transaction Data: You can find the detailed privacy policy for each service on the IAP Privacy Policy page.

Account & Contact Data: You have the right to access and update personal data you have previously provided to us. You can do so at any time by connecting to your personal account on nizu.io. If you wish to permanently delete your account or personal information for a legitimate purpose, please contact our Helpdesk to request so. We will take all reasonable steps to permanently delete your personal information, except when we are required to keep it for legal reasons (typically, for administration, billing and tax reporting reasons).

Job Application Data: You may contact us at any time to request access, updates or deletion of your application information. The easiest way to do it is to reply to the last message you exchanged with our Human Resource personnel.

Customer Database:You can manage any data collected in your databases hosted on nizu.io at any time, using your administration credentials, including modifying or deleting any personal data stored therein.
At any time you can export a complete backup of your database via our control panel, in order to transfer it, or to manage your own backups/archive. You are responsible for processing this data in compliance with all privacy regulations.
You may also request the deletion of your entire database via your control panel, at any time.
When you use the NIZU Database Upgrade service, your data is automatically deleted after your upgrade was successfully completed, and may also be deleted upon request from you.

Free Trial Session Recording: You may contact us at any time to request access to or deletion of the recording of your trial session (see contact info below). Please remember to include the name or the URL of your database (e.g. mydatabase.nizu.io) to allow us to retrieve your specific recording. Recordings are automatically destroyed after 2 months, so if your trial is older than that the data does not exist anymore.
The other sections of this Policy explain :

Github.com Account Data: You can view and manage the project repository data collected from your Github.com account directly on nizu.io.
You may request the deletion of this information via your control panel on nizu.io, at any time.
You can also request the deletion of your Github.com OAuth token by simply logging out from nizu.io.

In-App Purchase (IAP) Transaction Data: You can find the detailed privacy policy for each service on the IAP Privacy Policy page.

Safety Retention Period: we retain a copy of your data in our backups for safety reasons, even after they are destroyed from our live systems. See Data Retention for more details.

We realize how important and sensitive your personal data is, and we take a great number of measures to ensure that this information is securely processed, stored and preserved from data loss and unauthorized access. Our technical, administrative and organizational security measures are described in details in our Security Policy.

In order to support our operations we rely on several Service Providers. They help us with various services such as payment processing, web audience analysis, cloud hosting, marketing and communication, etc.

Whenever we share data with these Service Providers, we make sure that they use it in compliance with Data Protection legislation, and that the processing they carry out for us is limited to our specific purpose and covered by a specific data processing contract.

Below is a list of the Service Providers we are currently using, why we use them, and what kind of data we share with them.

In-App Purchase (IAP): The list of third-party service providers for each IAP service is available on the IAP Privacy Policy page.

These third-party service providers are processing data for which NIZU is Controller or Processor, on behalf of NIZU.

Important: due to the great variability in resources and services provided by these subprocessors, NIZU Customers cannot select the subprocessor that will be used to process their data. They can however choose their main hosting region (see the Data Location section).

Account & Contact Data: we will only retain such data as long as necessary for the purpose for which it was collected, as laid out in this policy, including any legal retention period, or as long as necessary to carry out a legitimate and reasonable promotion of our products and services.

Job Application Data: If we do not hire you, we may keep the information you provide for up to 3 years in order to contact you again for any new job proposition that may come up, unless you ask us not to do so. You may ask us to erase your personal information earlier, however we will retain a minimal subset of information, specifically your name, email address, and passport/ID number, for a limited period of 18 months. This retention is strictly necessary to protect the integrity of our recruitment process (prevention of repeated applications for the same position, test fraud, and defense of our legal interests). If we hire you, your personal information will be stored for the duration of your employment contract with us, and afterwards, during the applicable legal retention period that applies in the country where we employed you.

Browser Data: we may retain this data for a maximum of 12 months, unless we need to keep it in relation with a legitimate concern related to the security or performance of our services, or as required by law. Any server-side session information is discarded maximum 7 days after it stops being actively used.

Server Logs & Security Logs: we retain those logs for a maximum of 12 months, unless we need to keep them in relation with a legitimate concern related to the security or performance of our services, or as required by law.

Customer Database: we will only retain this data as long as necessary for providing the services you subscribed to. For databases hosted on the NIZU Cloud, if you cancel the service your database is kept deactivated for 3 weeks (the grace period during which you can change your mind), and then destroyed. For databases uploaded to the NIZU Database Upgrade website, your database is kept for up to 4 months after the last successful upgrade, and may be deleted earlier upon request.

Free Trial Session Recording: The recordings are automatically deleted after 2 months, and may be deleted earlier once they have been processed, or considered irrelevant, or upon request.

Github.com Account Data: we keep this data as long as your nizu.io subscription is active, except the OAuth token which is deleted after 2 days, or as soon as you logout from nizu.io.

In-App Purchase (IAP) Transaction Data:You can find the detailed privacy policy for each service on the IAP Privacy Policy page.

Safety Retention Period: As part of our Security Policy, we always try to preserve your data from accidental or malicious deletion. As a result, after we delete any of your personal information (Account & Contact Data) from our database upon request from you, or after you delete any personal information from your database (Customer Database), or if you delete your entire database, it is not immediately deleted from our backup systems, which are secured and inalterable. The personal data could remain stored for up to 12 months in those backups, until they are automatically destroyed.
We commit not to use those backup copies of your deleted data for any purpose except for maintaining the integrity of our backups, unless you or the law require us to do so.

Production & Backups

Customer databases are hosted in the NIZU Cloud Hosting Region closest to where they are situated, and can request a change of region (subject to availability).

In addition to the production copy, NIZU commits to maintaining at least three redundant backup copies of each customer database, stored in separate data centers that are geographically distant enough to ensure resilience against region-wide and country-wide incidents.

The table below lists the current countries hosting production environments and backups for each NIZU hosting region. These locations may evolve within the same region as needed to maintain service continuity, performance, and compliance with contractual and legal obligations.

It is not possible to choose or restrict the backup locations. The same locations are used for all customers within the same hosting region to ensure consistency and data integrity.

Database Upgrades
Customer databases are upgraded within their current production hosting location (see above) or on a global upgrade server located in Europe 

In-App Purchase (IAP) Transaction Data
You can find the detailed privacy policy for each service on the IAP Privacy Policy page.

Free Trial Session Recording
Free trial sesssions recording data is processed by FullStory (see our Service Providers) in Google Cloud data centers located in the United States. As a reminder, this data is only recorded if you opt-in and is only kept for a very limited time.

International Staff
In some cases, the personal data mentioned in this Privacy Policy may be accessed by staff members of NIZU OÜ subsidiaries in other countries. Such access will always be done for the same purposes and with the same privacy and security precautions as if it was done by our own local staff, so all the guarantees we provide still apply. NIZU uses EU Standard Contractual Clauses to bind subsidiaries in a way that offers sufficient safeguards on data protection for the limited and temporary data transfers that occur for such access.

Except as explicitly mentioned above, we do not sell, trade, or otherwise transfer your personal data to third parties. SMS/text messaging opt-in is excluded from any data transfer covered above. We may share or disclose aggregated or de-identified information, for research purposes, or to discuss trends or statistics with third-parties.

Cookies are small bits of text sent by our servers to your computer or device when you access our services. They are stored in your browser and later sent back to our servers so that we can provide contextual content. Without cookies, using the web would be a much more frustrating experience. We use them to support your activities on our website, for example your session (so you don't have to login again) or your shopping cart.

Cookies are also used to help us understand your preferences based on previous or current activity on our website (the pages you have visited), your language and country, which enables us to provide you with improved services. We also use cookies to help us compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future.

We also use third-party services such as Google Analytics, who set and use their own cookies to identify visitors and provide their own contextual services. For more information regarding those third-party providers and their Cookie Policy, please see the relevant references in the Third-Party Service Providers section.

Here is an overview of the cookies that may be stored on your device when you visit our website:

You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. Each browser is a little different, so look at your browser's Help menu to learn the correct way to modify your cookies, or look at the links below.

We do not currently support Do Not Track signals, as there is no industry standard for compliance.

We may update this Privacy Policy from time to time, in order to clarify it, to reflect any changes to our website, or to comply with legal obligations. The "Last Updated" mention at the top of the policy indicates the last revision, which is also the effective date of those changes. We give you access to archived versions of this policy, so you can review the changes.