Privacy Policy

Introduction

NexusFleet ("we", "our", or "us") is an AI operations and automation platform operated by NexusFleet, a company registered in Malta. We are committed to protecting and respecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Maltese data protection legislation.

This Privacy Policy explains how we collect, use, store, and share your personal data when you access our website at nexusfleet.net, use our platform services, or otherwise interact with us. By using our services, you acknowledge that you have read and understood this policy.

For the purposes of the GDPR, NexusFleet is the data controller responsible for your personal data.

What Data We Collect

We collect and process the following categories of personal data, depending on how you interact with our services:

Why We Collect Your Data

We process your personal data only where we have a lawful basis to do so under the GDPR. The legal bases upon which we rely are:

• Performance of a contract (Article 6(1)(b)): To create and manage your account, process your subscription, provide the NexusFleet platform services, and deliver customer support.
• Legitimate interests (Article 6(1)(f)): To improve and optimise our platform, analyse usage patterns, ensure network and information security, prevent fraud, and conduct business analytics.
• Consent (Article 6(1)(a)): Where you have explicitly opted in to receive marketing communications, newsletters, or product updates from us. You may withdraw consent at any time.
• Legal obligation (Article 6(1)(c)): To comply with applicable laws, regulations, and legal processes, including tax, accounting, and anti-money laundering requirements under Maltese and EU law.

How We Use Your Data

Your personal data is used for the following purposes:

• Service delivery: To provision and operate your NexusFleet account, including AI agent execution, WhatsApp automation, lead management, and all platform features included in your subscription plan.
• Payment processing: To process subscription payments, issue invoices, manage billing cycles, and handle refunds through our payment processor, Stripe.
• Communication: To send transactional emails (account confirmations, password resets, billing receipts, service alerts) via our email service provider, Brevo (formerly Sendinblue).
• Platform improvement: To analyse aggregated usage data in order to improve our AI models, optimise platform performance, develop new features, and enhance the user experience.
• Security: To detect, prevent, and respond to security incidents, unauthorised access attempts, fraud, and abuse of our services.
• Legal compliance: To meet our obligations under applicable laws, respond to lawful requests from public authorities, and enforce our Terms of Service.
• Marketing: Where you have consented, to send promotional materials, product updates, and newsletters. You may opt out at any time via the unsubscribe link in any marketing email or by contacting us.

Data Storage & Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. Sensitive data at rest is encrypted using industry-standard AES-256 encryption.
• Access controls: Access to personal data is restricted to authorised personnel on a need-to-know basis. All access is logged and auditable.
• Infrastructure: Our platform is hosted on secure, enterprise-grade cloud infrastructure within the European Economic Area (EEA). Servers are protected by firewalls, intrusion detection systems, and regular security audits.
• Password security: User passwords are hashed using cryptographically secure, one-way hashing algorithms. We never store plaintext passwords.
• Incident response: We maintain a data breach response plan in accordance with GDPR Article 33. In the event of a breach likely to affect your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

While we take every reasonable precaution to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to maintaining the highest practicable standard of data protection.

Third-Party Data Processors

We share your personal data with the following categories of third-party processors, each bound by data processing agreements that ensure GDPR compliance:

We do not sell, rent, or trade your personal data with third parties for their marketing purposes. Data may also be disclosed to legal and regulatory authorities where required by law or to protect our legitimate interests.

Cookies & Local Storage

NexusFleet uses cookies and browser localStorage to provide core functionality, maintain your authenticated session, and enhance your experience on our platform.

We do not use third-party advertising or tracking cookies. All cookies and localStorage entries used by NexusFleet are strictly necessary for the operation of our platform or the provision of features you have explicitly requested. As these fall under the "strictly necessary" exemption, explicit consent is not required under the ePrivacy Directive. However, you may clear localStorage and cookies at any time through your browser settings. Please note that doing so may require you to re-authenticate.

Your Rights Under the GDPR

As a data subject, you are entitled to the following rights under the GDPR. You may exercise any of these rights by contacting us at privacy@nexusfleet.net.

We will respond to all legitimate requests within 30 days. In exceptional circumstances, this period may be extended by a further two months, in which case we will inform you of the extension and the reasons for the delay. There is no fee for exercising your rights unless a request is manifestly unfounded or excessive.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our retention periods are as follows:

• Account data: Retained for the duration of your active subscription and for 30 days following account deletion to allow for reactivation, after which it is permanently erased.
• Payment & billing records: Retained for a minimum of 7 years following the transaction date, as required by Maltese tax and accounting regulations.
• Usage & analytics data: Retained in identifiable form for up to 24 months. Thereafter, data is anonymised and aggregated for statistical purposes.
• Communication records: Support tickets and correspondence are retained for up to 3 years to maintain service quality and resolve any disputes.
• Server logs: Technical and access logs are retained for 90 days for security monitoring and incident investigation purposes.

When personal data is no longer required, it is securely deleted or irreversibly anonymised in accordance with our data disposal procedures.

International Data Transfers

Your personal data is primarily processed and stored within the European Economic Area (EEA). Where a transfer of data outside the EEA is necessary (for example, where a third-party processor operates infrastructure in a non-EEA jurisdiction), we ensure that appropriate safeguards are in place, including:

• Adequacy decisions by the European Commission (Article 45 GDPR)
• Standard Contractual Clauses (SCCs) approved by the European Commission (Article 46(2)(c) GDPR)
• Binding Corporate Rules where applicable

You may request further details about the specific safeguards applied to international transfers of your data by contacting us.

Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact our data protection team:

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC), the supervisory authority in Malta, or with the supervisory authority in your EU Member State of habitual residence or place of work.

Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify registered users via email where the changes materially affect how we process your personal data
• Where required by law, seek your consent before applying changes that affect the legal basis of processing

We encourage you to review this page periodically to stay informed about how we protect your data. Your continued use of NexusFleet after any changes to this Privacy Policy constitutes your acceptance of those changes, except where further consent is required by law.