Privacy Policy

Last updated: September 30, 2026

Effective date: October 1, 2026

This Privacy Policy describes how Nisos Holdings Inc. and its subsidiaries and affiliates (“Nisos”, “we”, “us” or “our”) process personal data that we collect through (i) our digital and online properties or services that link to this Privacy Policy (including as applicable, our website and electronic communications with our enterprise customers); (ii) our marketing activities; (iii) our provision of software and professional services to our enterprise customers, to the extent we act as a controller as described in this Privacy Policy; and (iv) other activities, in each case as described in this Privacy Policy (collectively, the “Service”). The personal data that we may process about you depends on the context in which we interact with you.

See the ‘Notice to European Users’ section of this Privacy Policy for additional information if you are located in the EEA or the United Kingdom.

Our Service is designed for enterprise customers. We do not offer products or services for use by individuals for their personal, family or household purposes. This Privacy Policy does not apply to information that we process on behalf of our enterprise customers while providing services to them, which our enterprise customers provide to us or instruct us to process. Our use of information that we process on behalf of our enterprise customers is governed by our agreements with such customers. This Privacy Policy does apply to personal data that we process as a controller in connection with the software and professional services we provide to our enterprise customers, including (a) account and usage data relating to individuals who access our software, and (b) Threat Intelligence Data, as described in the ‘Threat Intelligence Data’ section below. If you have questions regarding your personal data that we process on behalf of an enterprise customer, please direct such questions that you may have to the enterprise customer with which you have a relationship.

This Privacy Policy does not apply to our employees or independent contractors or job candidates.

INFORMATION WE COLLECT ABOUT YOU

We may collect or otherwise infer the following categories of personal data about you. Our activities depend on the nature of your interaction with us and how we come into possession of your personal data.

⎻ Contact data, such as your first and last name, salutation, alias, email address, billing and mailing address, business address, professional title, company name, and phone number.

⎻ Demographic data, such as your city, state, country of residence, and postal code.

⎻ Communications data based on our exchanges with you, including when you contact us through the Service, provide feedback, communicate with us via email, phone, or otherwise.

⎻ Transactional data, such as information relating to or needed to complete your orders on or through the Service.

⎻ Marketing data, such as your preferences for receiving our marketing communications and details about your engagement with them.

⎻ Usage data, excluding any data subject to the relevant commercial agreement, such as information about how you access and interact with the Service, including information associated with any content you upload to the websites or otherwise submit to us, and information you provide when you use any interactive features of the Service.

⎻ Call/video recordings, such as recordings of customer support calls.

⎻ Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Third-party sources. We may combine personal data we receive or infer from you with personal data of the kinds identified above that we obtain from other sources, such as:

⎻ Data providers, such as information services, data licensors/brokers, and lead generators.

⎻ Our Customers, when they create individual accounts for their personnel to use our Service.

⎻ Service providers that provide services on our behalf or help us operate the Service or our business.

⎻ Partners, such as joint marketing partners and event co-sponsors.

⎻ Ad networks

⎻ Data analytics providers

⎻ Social media platforms

Automatic data collection. We, our service providers, and our advertising partners may automatically collect information about you, your computer or mobile device, and your interactions over time with the Service, our communications, and other online services, such as:

⎻ Device data, such as your computer or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), and general location information such as city, state or geographic area.

⎻ Location data, which may be approximate (for example, as inferred from network data or device settings).

⎻ Communication interaction data such as your interactions with our email, text, chat or other communications (e.g., whether you open and/or forward emails) – we may do this through use of pixel tags (which are also known as clear GIFs), which may be embedded invisibly in our emails enabling us to detect if you have opened or forwarded a message.

⎻ Online activity data, such as pages or screens you viewed, search history, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages or screens, information about your activity on a page or screen, click-activity, access times and duration of access, and whether you have opened our emails or clicked links within them.

Tracking technologies. We may use cookies and similar technologies on our website and other digital properties to automatically collect certain information as described above. For more information about the cookies we use and how to manage your preferences, please see our Cookie Policy https://nisos.com/cookie-policy/.

THREAT INTELLIGENCE DATA

We may collect or otherwise infer the following categories of personal data about you. Our activities depend on the nature of your interaction with us and how we come into possession of your personal data.

Nisos provides threat intelligence, investigations, digital risk monitoring, and related services to enterprise customers. In the course of providing these services, and in building and maintaining our own threat intelligence capabilities, we collect personal data from publicly available, licensed, and other third-party sources rather than directly from the individuals concerned (“Threat Intelligence Data”). We act as a controller of Threat Intelligence Data. This section describes that processing. It does not apply to personal data that our enterprise customers provide to us or instruct us to process, which is governed by our agreements with those customers.

Categories of Threat Intelligence Data: Depending on the activity, Threat Intelligence Data may include names, aliases, usernames and online identifiers; contact details; professional and employment information; images; online posts, content, and activity; IP addresses, domains, device identifiers, and other technical indicators; information concerning compromised credentials or leaked documents; and information relating to actual or suspected threats, fraud, or other harmful activity. We do not intentionally collect special categories of personal data, but such data may appear incidentally in the sources we review and collect.

Sources and methods. We obtain Threat Intelligence Data only through lawful means, from:

⎻ commercial data providers and licensors;

⎻ threat intelligence feeds and information-sharing communities; and

⎻ online forums and marketplaces, including on the dark web, where criminals offer or discuss compromised credentials, leaked documents, or other stolen information.

We monitor these sources so we can alert our enterprise customers when their data, systems, or personnel have been compromised or targeted. We do not access private accounts, devices, or communications without authorization. We do not bypass passwords or other security controls, and we do not intercept communications.

Why we do this. Our work is defensive. We collect and analyze Threat Intelligence Data to protect our enterprise customers, their personnel, and their customers from cyberattacks, fraud, impersonation, and other harm, and to help prevent and detect crime. We do not use Threat Intelligence Data to make decisions about individuals’ eligibility for credit, insurance, employment, or similar benefits, and our customers are contractually prohibited from doing so.

Purposes: We process Threat Intelligence Data to identify, investigate, assess, and help mitigate threats to our enterprise customers and their personnel, assets, and operations, including cyber threats, fraud, insider risk, physical security threats, impersonation, and disinformation; to prepare reports and other deliverables for our enterprise customers; to develop, maintain, and improve our threat intelligence capabilities, analytical techniques, and services; to train and assess our personnel; and for the compliance and protection purposes described in this Privacy Policy.

Recipients: We share Threat Intelligence Data with our enterprise customers in reports and other deliverables, and with the recipients described in the ‘Third Party Disclosure’ section, including service providers, professional advisors, and law enforcement or other authorities where we believe in good faith that disclosure is necessary or appropriate.

Retention: We retain Threat Intelligence Data for as long as reasonably necessary for the purposes described above, including to maintain continuity of the services we provide to our enterprise customers and to support legal, regulatory, and dispute resolution needs, and we periodically review the Threat Intelligence Data we hold. When Threat Intelligence Data is no longer required, we delete or anonymize it.

Your choices: You may contact us at privacy@nisos.com to ask about Threat Intelligence Data that relates to you or to exercise any rights available to you under applicable law, including the rights described in the ‘Notice to European Users’ appendix. We may decline or limit a request where permitted by applicable law, including where fulfilling it would prejudice the prevention or detection of crime, fraud, or security threats, or would disclose the confidential information of our enterprise customers.

HOW WE USE YOUR PERSONAL DATA

We may use your personal data for the following purposes or as otherwise described at the time of collection:

Website, account, and business operations. We may use your personal data to:

⎻ create and administer user accounts and authenticate users;

⎻ communicate with you about your account or our business relationship, including by sending updates, security alerts, and support and administrative messages;

⎻ respond to your requests, questions, feedback, and support inquiries;

⎻ manage our relationships with customers, prospective customers, partners, and other business contacts;

⎻ process transactions and maintain related business records;

⎻ personalize our website and communications based on your preferences and interactions; and

⎻ prevent, identify, investigate, and address fraudulent, harmful, unauthorized, or illegal activity.

Marketing and advertising. We and our third-party advertising partners may collect and use your personal data for marketing and advertising purposes:

⎻ Direct marketing. We may send you direct marketing communications and may personalize these messages based on your needs and interests. You may opt-out of our marketing communications as described in the ‘Opt-out of communications’ section.

⎻ Testimonials. We may use your feedback to post comments about your experience with any Service on the website, in our marketing and promotional materials.

Analytics and Improvement. We may use device data, usage data, online activity data, and communication interaction data to understand how individuals interact with our website and communications; measure and analyze performance and engagement; diagnose technical issues; and improve our website, online properties, and communications. Where required by applicable law, we obtain consent before using non-essential cookies or similar technologies for these purposes.

These purposes apply only to personal data covered by this Privacy Policy. They do not describe our processing of personal data on behalf of enterprise customers, which is governed by our agreements with those customers.

Compliance and protection. We may use your personal data to:

⎻ protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims);

⎻ audit our internal processes for compliance with legal and contractual requirements or our internal policies;

⎻ enforce the terms and conditions that govern the Service; and

⎻ prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

With your consent. In some cases, we may specifically ask for your consent to collect, use, or share your personal data for further purposes, if those purposes are not compatible with the initial purpose for which that personal data was collected.

Cookies and similar technologies. In addition to the other uses included in this section, we may use the ‘Tracking Technologies’ described above for the following purposes:

⎻ Technical operation. To allow the technical operation of the Service, such as remembering selections as you navigate the site and remembering whether you are logged in.

⎻ Functionality. To enhance the performance and functionality of our services.

⎻ Analytics. To help us understand user activity on the Service, including the volume and demographics of users, which pages are most and least visited and how users move around the Service or interact with our emails.

⎻ Corporate Transactions. We may share certain personal data in connection with actual or prospective corporate transactions. For more information, see Third Party Disclosure below.

DATA PRIVACY FRAMEWORK NOTICE

Nisos complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce, with respect to personal data other than human resources data received in reliance on those frameworks. Nisos has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data other than human resources data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Nisos has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data other than human resources data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles shall govern. To learn more about the Data Privacy

Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

The Federal Trade Commission has jurisdiction over Nisos Holdings Inc.’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

Under certain circumstances, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

If we transfer personal data received under the Data Privacy Framework to a third party acting as an agent or service provider, we will do so only for limited and specified purposes. We will require the recipient to provide at least the same level of protection as required by the applicable Data Privacy Framework Principles, notify us if it can no longer meet that obligation, and stop and remediate unauthorized processing as appropriate. If we transfer personal data received under the Data Privacy Framework to a third party acting as an independent controller, we will do so consistent with the Notice and Choice Principles and pursuant to a contract requiring the recipient to provide the same level of protection required by the applicable Data Privacy Framework Principles. Nisos Holdings Inc. may remain liable under the Data Privacy Framework Principles if our agent processes such personal data in a manner inconsistent with those Principles, unless we prove we are not responsible for the event giving rise to the damage.

For purposes of the Data Privacy Framework, personal data that we process on behalf of clients in providing services, including data relating to a client’s current or former employees, contractors, or personnel, is processed in a business-to-business context, not as Nisos human resources data collected in the context of an employment relationship with Nisos.

Under applicable law and when legally required, we will share personal data to comply with a court order, law, or legal process, including to respond to any government or regulatory request, to enforce or apply our website policies and other agreements, for billing and collection purposes, or if we believe disclosure is necessary or appropriate to protect our rights, property, or safety or that of our customers or others. In some situations that solely implicate personal data and requests thereof, we will always endeavor to notify our client users to allow them to intervene, unless we are legally restricted from doing so.

DISPUTE RESOLUTION

If a privacy complaint or dispute relating to Personal Data received by Nisos in reliance on the Data Privacy Framework (or any of its predecessors) cannot be resolved through our internal processes, we have agreed to participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure. Subject to the terms of the VeraSafe Data Privacy Framework Dispute Resolution Procedure, VeraSafe will provide appropriate recourse free of charge to you. To file a complaint with VeraSafe and participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure, please submit the required information here: https://www.verasafe.com/privacy-services/dispute-resolution/submit-dispute/

If a complaint or dispute cannot be resolved through our internal process, we have also agreed to cooperate with the EU and UK data protection authorities and the Swiss Federal Data Protection and Information Commissioner and to participate in the dispute resolution procedures of the panel established by such data protection authorities.

BINDING ARBITRATION

If your dispute or complaint related to your Personal Data that we received in reliance on the Data Privacy Framework cannot be resolved by us, nor through the dispute resolution mechanism mentioned above, you may have the right to require that we enter into binding arbitration with you under the Data Privacy Framework “Recourse, Enforcement and Liability” Principle and Annex I of the Data Privacy Framework.

If you are one of our clients’ personnel and you have any questions or concerns regarding Personal Data that we process on behalf of your employer or your privacy rights, or you would like to access or correct that Personal Data, please contact your employer. For questions about your account and usage data, contact us at privacy@nisos.com.

THIRD PARTY DISCLOSURE

Nisos may share your information with third parties in the following situations, and as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection:

⎻ Our customers, who created your account to use our Service.

⎻ Affiliates. Our corporate parent, subsidiaries, and affiliates.

⎻ Service Providers: We may share your information, including Personal Data, with third parties or affiliates to assist in our business operations (e.g., to process payments, store data, provide maintenance to the Nisos software, deliver information, and perform other similar functions), or to provide the services you have requested.

⎻ Artificial intelligence platforms. We use third-party artificial intelligence (AI) providers to power certain aspects of the Services.

⎻ Social networks. We use their ad services to display ads to our enterprise customers, or other people like them, on social media. We do not necessarily control how these recipients may use your personal data.

⎻ Third parties designated by you. We may share your personal data with third parties where you have instructed us or provided your consent to do so. We do not necessarily control how these recipients may use your personal data.

⎻ Enterprise customers, including any of your information in reports and other deliverables we prepare for them in connection with our threat intelligence, investigations, and digital risk services. We do not necessarily control how these recipients may use your information.

⎻ Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.

⎻ Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the Compliance and protection purposes described above.

⎻ Corporate transactions. We may disclose personal data in the context of actual or prospective business transactions (e.g., investments in Nisos, financing of Nisos, public stock offerings, the sale, transfer or merger of all or part of our business, assets or shares, liquidation or reorganization). For example, we may need to share certain personal data with prospective counterparties and their advisers. We may disclose your personal data to an acquirer, successor, or assignee of Nisos or a portion of our business assets as part of any merger, acquisition, sale of assets, or similar transaction, and/or in the event of an insolvency, bankruptcy, or receivership in which personal data is transferred to one or more third parties as one of our business assets.

CHILDREN UNDER THE AGE OF 18

Our Website is not intended for children under 18 years of age. We do not knowingly collect personal data from children under 18. If you are under 18, do not use or provide any information on this Website or on or through any of its features/register on the Website, make any purchases through the Website, use any of the interactive or public comment features of this Website or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received data from a child under 18, we will promptly take commercially reasonable steps to delete that information.

If you believe we might have any information from or about a child under 18, please contact us at privacy@nisos.com.

YOUR CHOICES

In this section, we describe the choices available to all users. Users who are located in Europe can find additional information about their rights below in the ‘Notice to European Users’.

Access or update your information. You may have the right to access and update personal data we hold about you.

Opt-out of communications. You may opt-out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us. It may take time for your opt-out to be effective. Please note that if you choose to opt-out of marketing-related emails, you may continue to receive service-related and other non-marketing emails.

Cookies. For information about cookies employed by the Service and how to control them, see our Cookie Policy.

Declining to provide information. We need to collect personal data to provide certain services. If you do not provide the information we identify as required or mandatory, we may not be able to provide those services.

For information about how Nisos handles personal data relating to job applicants in the context of Nisos’s own employment-related activities, please review the separate EU/EEA/UK privacy notice related to prospective employees. This Privacy Policy and the Data Privacy Framework statements above apply to non-HR data only.

DATA RETENTION

We retain personal data only for as long as reasonably necessary to fulfill the purposes for which it was collected, including providing the Service, maintaining our business relationship with you, complying with our legal and regulatory obligations, resolving disputes, and enforcing our agreements.

In determining the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data; the purposes for which we process it; whether we can achieve those purposes through other means; the potential risk of harm from unauthorized use or disclosure; and applicable legal, regulatory, contractual, accounting, and reporting requirements.

When personal data is no longer required, we will delete or anonymize it in accordance with our applicable retention practices. We may retain aggregated, de-identified, or anonymized information for longer periods where that information can no longer reasonably be used to identify an individual.

DATA SECURITY

We have implemented security measures designed to secure your personal data from accidental loss and from unauthorized access, use, alteration, and disclosure. The safety and security of your information also depends on you. When using our software, you are responsible for keeping your username, password, and any other login credentials or user verification information confidential. You may not share this information with anyone. Unfortunately, the transmission of information via the internet is not completely secure, so we cannot guarantee the security of your personal data transmitted to our Website.

OTHER SITES AND SERVICES

The Service may contain links to websites, mobile applications, and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites, mobile applications or online services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites, mobile applications and online services you use.

CHANGES TO OUR PRIVACY POLICY

The “LAST UPDATED” legend at the top of this Privacy Policy indicates when this Privacy Policy was last revised. We reserve the right to modify this Privacy Policy at any time. For any changes we make to this Privacy Policy, we will post an updated policy on this page and revise the Last Updated date above. Depending on the kind of change we make, we may also notify you directly, and where required under applicable law ask for your consent. Any modifications to this Privacy Policy will be effective upon our posting the modified version or as otherwise indicated at the time of posting.

Nisos Holdings Inc. Email: privacy@nisos.com

APPENDIX: NOTICE TO EUROPEAN USERS

General

Where this Notice applies. The information provided in this Appendix applies to individuals located in the European Economic Area (“EEA”) and the United Kingdom (collectively, “Europe”). This Appendix supplements the main body of the Privacy Policy and, where there is any conflict between the main body and this Appendix with respect to European data subjects, this Appendix shall prevail.

Personal information. References to “personal information” in the main Privacy Policy should be understood to include “personal data” as defined in the General Data Protection Regulation (EU) 2016/679 (“EU GDPR”) and the UK General Data Protection Regulation (“UK GDPR”) (together, the “GDPR”).

Controller. Nisos Holdings Inc. (“Nisos,” “we,” “us” or “our”) is the controller of your personal data for the purposes of the GDPR in respect of personal data that we collect directly, including website visitor data, marketing contact information, and software account data, and in respect of Threat Intelligence Data. Where Nisos processes personal data on behalf of its clients (“Client Data”), Nisos acts as a processor or service provider, and the relevant client is the controller. If your personal data has been provided to us by or on behalf of a Nisos client, please direct any data protection queries to that client.

Nisos Holdings Inc.
Email: privacy@nisos.com
Postal address: 2101 Wilson Blvd., Suite 304, Arlington, VA 22201

Our Representatives in Europe. As required by Article 27 of the EU GDPR and the equivalent provision of the UK GDPR, we have appointed the following representatives in Europe. You may contact them directly with any data protection queries:

Legal Bases for Processing

The GDPR requires us to have a “legal basis” for each purpose for which we process your personal data. Our legal bases for processing your personal data as described in this Privacy Policy are set out below.

We rely on the following legal bases:

⎻ Contractual Necessity. Where we need to process your personal data to perform a contract we are about to enter into or have entered into with you (for example, to provide our software or services to you as a direct customer or to manage your account).

⎻ Legitimate Interests. Where processing is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. The specific legitimate interests pursued for each processing purpose are set out in the table below.

⎻ Compliance with Law. Where we need to process your personal data to comply with a legal or regulatory obligation to which we are subject.

⎻ Consent. Where we have obtained your specific, informed consent to carry out the processing for the purpose in question (for example, for marketing emails or the use of non-essential cookies). Where consent is the legal basis, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

The table below sets out the legal basis relied upon for each processing purpose:

Threat Intelligence Data

Legal basis: We process Threat Intelligence Data on the basis of our legitimate interests, and those of our enterprise customers, in identifying, investigating, and mitigating threats to the security of networks, information, people, and property, and in preventing and detecting fraud and other unlawful or harmful activity. We have assessed these interests against the rights and interests of the individuals concerned, taking into account the sources of the data, the safeguards we apply, and the limited, security-focused purposes for which we use it. Where we process Threat Intelligence Data to comply with a legal obligation, we also rely on Compliance with Law.

Information about sources and notice: Threat Intelligence Data is obtained from the sources described in the ‘Threat Intelligence Data’ section of this Privacy Policy, which include publicly accessible sources. Because we do not collect Threat Intelligence Data directly from the individuals concerned, and in many cases have no means of contacting them, providing individual notice would be impossible or would involve a disproportionate effort, and in some cases would seriously impair the security and fraud prevention objectives of the processing. We therefore make the information about this processing publicly available through this Privacy Policy and apply appropriate safeguards, including access controls, confidentiality obligations, and the Security Measures described in our agreements with our enterprise customers.

Special categories: Special categories of personal data or data relating to criminal convictions and offences may appear incidentally in Threat Intelligence Data. Where we process such data, we do so only where permitted by applicable law, including where the data has been manifestly made public by the individual or where processing is necessary for the establishment, exercise, or defense of legal claims or the prevention or detection of unlawful acts.

Sensitive Personal Data

We do not intentionally collect special categories of personal data (as defined in Article 9 GDPR), such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation, through our Website or directly from you. We ask that you do not provide any such sensitive personal data to us. If you nonetheless provide sensitive personal data, we will process it only with your explicit consent or where otherwise permitted by applicable law.

Children

Our Website and services are not directed at children under the age of 16 (or such lower age as may be applicable in your EU Member State of residence). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without valid parental consent where required, we will take steps to delete that data promptly.

Cookies and Similar Technologies

When you visit our Website, we use cookies and similar technologies (web beacons, pixels, local storage) as described in our separate Cookie Policy available at https://nisos.com/cookie-policy/.

Your Rights Under the GDPR

European data protection laws give you certain rights regarding your personal data. You may ask us to take the following actions in relation to your personal data that we hold:

Access. You have the right to obtain confirmation as to whether we process your personal data and, if so, to request access to that data together with certain prescribed information about our processing activities.

Rectification. You have the right to request that we correct any inaccurate personal data and complete any incomplete personal data concerning you.

Erasure (“Right to be Forgotten”). You have the right to request the deletion of your personal data where there is no compelling reason for us to continue processing it, for example where you have withdrawn consent, the data is no longer necessary for its original purpose, or you have exercised your right to object.

Restriction of Processing. You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of the data or assess an objection you have raised.

Data Portability. You have the right to receive a machine-readable copy of certain personal data concerning you and, where applicable, transmit that data to a third party of your choice.

Right to Object. You have the right to object to our processing of your personal data where we are relying on legitimate interests as the legal basis, and we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. You may object at any time to our processing of your personal data for direct marketing purposes, including related profiling. If you object, we will stop processing your personal data for those purposes.

Withdrawal of Consent. Where we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Right Not to be Subject to Automated Decision-Making. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the decision is necessary for a contract, authorised by EU or Member State law, or based on your explicit consent (Article 22 GDPR). Nisos does not currently make decisions based solely on automated processing that produce legal or similarly significant effects on individuals within the scope of this Privacy Policy.

Exercising Your Rights. You may submit requests to exercise any of the rights described above by contacting us at privacy@nisos.com. We may request specific information from you to help us confirm your identity and process your request. We will respond to your request within one (1) month of receipt, which may be extended by a further two (2) months where necessary given the complexity of the request or the number of requests received, in which case we will inform you of the extension and the reasons for delay. If we decline your request (whether in whole or in part), we will inform you of our grounds for doing so.

Right to Lodge a Complaint with a Supervisory Authority

If you are not satisfied with our response to your request or how we process your personal data, you have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

For individuals in the EEA, contact details for each national data protection authority can be found at: https://edpb.europa.eu/about-edpb/board/members_en

For individuals in the United Kingdom, the relevant supervisory authority is:

The Information Commissioner’s Office
Water Lane, Wycliffe House
Wilmslow, Cheshire SK9 5AF
Tel: +44 303 123 1113
Website: https://ico.org.uk/make-a-complaint/

International Data Transfers Outside Europe

Nisos is headquartered in the United States. When you interact with our Website, use our software, or provide your personal data to us, your personal data may be transferred to, stored, and processed in the United States or other countries outside Europe that may not provide an equivalent level of data protection as your home jurisdiction.

Where we transfer your personal data outside Europe, we ensure that appropriate safeguards are in place, including:

⎻ EU-U.S. Data Privacy Framework. Nisos has certified its compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework, as described in the “Data Privacy Framework Notice” section of this Privacy Policy. Where we rely on the DPF as the transfer mechanism, transfers are made in accordance with the applicable DPF Principles.

⎻ Adequacy decisions. We may transfer your personal data to countries or territories that have been deemed by the European Commission or UK Government (as applicable) to provide an adequate level of protection for personal data.

⎻ Standard Contractual Clauses (SCCs). Where no adequacy decision applies, we may use the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum, as applicable) to provide appropriate safeguards for the transfer.