Privacy Policy

This Privacy Policy is issued in compliance with Regulation (EU) 2016/679 («GDPR»), Italian Legislative Decree 196/2003 as amended, and Directive 2002/58/EC («ePrivacy»), describing how personal data of NEXO IP users is processed.

1. Data controller

The Data Controller is Nexo Labs S.r.l.s..

2. Data Protection Officer (DPO)

Pursuant to Art. 37 GDPR, the Controller has assessed the obligation to appoint a DPO and has determined that such appointment is not mandatory, since its core activities do not involve regular and systematic monitoring of data subjects on a large scale, nor large-scale processing of special categories of data. Privacy enquiries may nonetheless be addressed to privacy@nexoip.it.

3. Categories of data processed

4. Purposes and legal basis

The service does NOT perform direct marketing, profiling or automated decision-making under Art. 22 GDPR.

5. Sub-processors (Art. 28 GDPR)

6. Data retention

7. International data transfers

Application data is hosted on infrastructure located in the European Union. Transfers to third countries occur only towards:

• Telnyx LLC (USA): for voice calls, under EU Standard Contractual Clauses (Decision 2021/914).
• Telegram FZ-LLC: for Bot API notifications, under the vendor terms.
• WhatsApp / Meta Platforms Ireland Ltd.: WhatsApp messages, forwarded via the sub-processor BulkGate (EU), transit through Meta's infrastructure. This may involve processing in third countries, under the safeguards adopted by Meta (EU Standard Contractual Clauses / EU-US Data Privacy Framework).
• Browser web push services (Google/Firebase Cloud Messaging, Apple Push, Mozilla): the user's encrypted browser endpoint and the notification payload are delivered through these services, whose servers may reside in third countries, under the safeguards adopted by the respective providers.

Transfers to third countries only take place where adequate safeguards under Chapter V GDPR are in place. Sub-processors' DPAs are publicly available on their websites and upon request.

8. Data subject rights

You may exercise the following rights anytime (Arts. 15-22 GDPR):

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure / right to be forgotten (Art. 17)
• Restriction (Art. 18)
• Portability (Art. 20)
• Object (Art. 21)
• Not be subject to automated decision-making (Art. 22)
• Complain to the Italian Data Protection Authority or your local DPA

Self-service: registered users can directly exercise access (data export), rectification and erasure via the Privacy Dashboard. For more complex requests (portability, restriction, objection) contact privacy@nexoip.it. We respond within 30 days (extendable to 60 in complex cases, Art. 12 GDPR).

9. Cookies

The service uses strictly necessary technical cookies only (authenticated session, CSRF protection, language preference). These cookies are exempt from prior consent under Art. 122 D.lgs 196/2003 and Art. 5.3 of the ePrivacy Directive. See the Cookie Policy for details.

10. Data Breach procedure

1. Identification and containment, isolation of compromised systems.
2. Risk assessment for data subjects' rights and freedoms.
3. Notification to the supervisory authority within 72 hours where risk is not unlikely (Art. 33).
4. Communication to data subjects without undue delay if risk is high (Art. 34).
5. Internal documentation of all breaches.
6. Post-incident analysis and remediation.

11. Impact assessment (DPIA)

The Controller performed a preliminary impact assessment under Art. 35 GDPR, classifying processing as low/medium risk: no special categories (Art. 9), no large-scale systematic monitoring, no automated decision-making. A DPIA summary is available upon reasoned request at privacy@nexoip.it.

12. Records of processing (Art. 30)

The Controller maintains a Record of Processing Activities pursuant to Art. 30 GDPR. It is available to the supervisory authority and, upon reasoned request, to data subjects.

13. Security measures (Art. 32)

• Encryption in transit (TLS 1.2+) on all client-server communications and external APIs/SMTP
• Encryption at rest of contact data (AES-128 Fernet, per-account keys)
• Password hashing with bcrypt (12 rounds, per-user salt)
• Two-factor authentication (email OTP; optional WebAuthn/Passkey)
• Rate-limiting on login, registration, password reset, privacy endpoints
• Immutable audit log of admin actions on user data
• Automatic retention for data minimization (Art. 5.1.e)
• Encrypted, rotated backups
• Least-privilege principle for database access
• HTTP security headers (HSTS, X-Frame-Options, Referrer-Policy, etc.)

14. Changes and version history

This notice may be updated to reflect legal, organizational or technological changes. Material changes will be notified to registered users and require renewed explicit acceptance at next login.

• v1.3 (July 7, 2026) — Removed the Stripe sub-processor (prepared but never activated); added Fatture in Cloud (TeamSystem S.p.A.) for order management and issuance of fiscal documents.
• v1.2 (July 5, 2026) — Updates on consumer withdrawal, invoicing data and international transfers.

Previous versions are available at /legal/versions/.

15. Contact

• Privacy email: privacy@nexoip.it
• PEC: amministrazione@pec.nexolabs.it
• Postal address: Nexo Labs S.r.l.s., Via San Gabriele 4/A, 63066 Grottammare (AP), Italy

By accepting this Privacy Policy, you confirm having read, understood and consented to processing for the purposes set out, within the limits of the legal bases indicated.