Nexufend GmbH
Last updated: 2026-05-04
1. Introduction
Nexufend GmbH ("Nexufend", "we", "us", "our") is committed to protecting personal data. This Privacy Policy explains how we collect, use, store, and share personal data when you or your organization interacts with us as a customer, prospective customer, or business contact.
This Privacy Policy covers Nexufend's role as a data controller – meaning the processing of personal data that Nexufend determines the purposes and means of, such as data about the individuals who represent our customers (account holders, billing contacts, authorized users, and support contacts).
It does not cover the processing of personal data that Nexufend performs as a data processor on behalf of customers – for example, network telemetry, security logs, and device data generated by the Nexufend Agent deployed on customer infrastructure. That processing is governed separately by the Data Processing Addendum ("DPA") entered into between Nexufend and the relevant customer.
2. Controller Identity and Contact
Data controller:
Nexufend GmbH
Office Park 2, 5. Stock
1300 Wien Flughafen
Austria
Commercial Register: FN 637490 k (Landesgericht Korneuburg)
VAT ID: ATU81156801
Data protection contact: legal@nexufend.com
For all data protection inquiries or to exercise your rights under this Policy, contact us at the address above or by email at legal@nexufend.com.
3. Scope and Applicability
This Policy applies to natural persons whose personal data Nexufend processes as a controller, including:
- Authorized users and administrators of the Nexufend management console
- Billing and procurement contacts at customer organizations
- Individuals who contact us for sales, support, or partnership inquiries
- Visitors to nexufend.com
This Policy applies regardless of whether the customer organization is located in the EU or elsewhere. Where applicable, we comply with the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and other applicable data protection laws.
4. Personal Data We Collect
4.1 Account and Contact Data
When a customer organization creates an account or enters into a contract with Nexufend, we collect personal data about the individuals designated to manage that relationship:
| Data | Examples | Source |
|---|---|---|
| Identity data | Full name, job title | Provided by the individual or customer organization |
| Contact data | Business email address, phone number | Provided by the individual or customer organization |
| Organization data | Company name, address, VAT number | Provided by the customer organization |
| Billing data | Invoice address, payment contact name | Provided by the customer organization |
| Account identifiers | Username | Created by the individual during registration |
| Authentication credentials | Passkeys, FIDO2 keys/tokens | Created/registered by the individual |
We do not collect payment card data directly. Payment processing is handled by our payment processor (see Section 7).
4.2 Usage and Platform Data
When authorized users access the Nexufend management console, we automatically collect:
| Data | Purpose |
|---|---|
| Login timestamps and IP addresses | Security and access auditing |
| Console activity logs (policy changes, configuration events) | Audit trail and support |
| Browser type and operating system | Compatibility and troubleshooting |
| Session identifiers | Authentication |
4.3 Communication Data
When you contact us by email, phone, or through our support platform, we collect the content of that communication and any personal data included within it, together with metadata such as date, time, and communication channel.
4.4 Website Data
The nexufend.com website is hosted on Webflow (Webflow Inc., USA). When you visit nexufend.com, technical data necessary to deliver the website (such as your IP address and browser information) is processed by Webflow's infrastructure. See Section 7.1 for details.
We use Google Tag Manager (Google LLC, USA) on nexufend.com to manage and deploy tracking tags. Google Tag Manager itself does not set cookies or collect personal data – however, the tags it manages (such as advertising pixels) may do so once you have given consent. No advertising or tracking tags will fire until you have accepted the relevant cookie categories via our consent banner.
We use advertising tracking pixels via Google Tag Manager (e.g., LinkedIn Insight Tag, Google Ads, or Meta Pixel) to support our marketing activities. Our cookie consent banner is already in place; no advertising tags will fire without your prior consent.
We also use Google reCAPTCHA (Google LLC, USA) on nexufend.com contact forms and other interactive elements to detect bots and prevent fraudulent submissions. reCAPTCHA processes your IP address, browser and device information, and behavioral signals (such as mouse movements and timing). This processing is based on our legitimate interest in protecting our website and users from automated abuse (Art. 6(1)(f) GDPR). reCAPTCHA is a functional security measure and does not require your consent, though you may object to this processing at any time (see Section 11).
The management console (dashboard), which is hosted separately on Scaleway infrastructure in the EU, does not use Google Tag Manager, tracking pixels, advertising cookies, or reCAPTCHA.
5. Legal Bases for Processing
We process personal data only where we have a valid legal basis under GDPR Article 6. The following table sets out the processing activities and their corresponding legal bases.
| Processing activity | Legal basis |
|---|---|
| Account creation and management | Art. 6(1)(b) – necessary for the performance of a contract |
| Providing the Service to authorized users | Art. 6(1)(b) – necessary for the performance of a contract |
| Billing, invoicing, and payment administration | Art. 6(1)(b) – contract performance; Art. 6(1)(c) – legal obligation (Austrian BAO §132) |
| Customer support and communications | Art. 6(1)(b) – contract performance |
| Sending product updates and service notices | Art. 6(1)(b) – contract performance; Art. 6(1)(f) – legitimate interest |
| Platform security monitoring and fraud prevention | Art. 6(1)(f) – legitimate interest in protecting the platform and customers |
| Marketing and commercial communications (where applicable) | Art. 6(1)(a) – consent, or Art. 6(1)(f) – legitimate interest for existing customers under applicable law |
| Advertising tracking on nexufend.com via Google Tag Manager | Art. 6(1)(a) – consent (cookie consent banner required; no tags fire without prior consent) |
| Bot detection and fraud prevention via Google reCAPTCHA on nexufend.com | Art. 6(1)(f) – legitimate interest in protecting the website and users from automated abuse and fraudulent submissions |
| Retaining records for statutory compliance | Art. 6(1)(c) – legal obligation (Austrian BAO §132, UGB §212) |
| Improving and developing the Service | Art. 6(1)(f) – legitimate interest |
Where we rely on legitimate interest, we have carried out a balancing assessment and determined that our interests do not override the rights and freedoms of the individuals concerned. You may object to processing based on legitimate interest at any time (see Section 10).
6. How We Use Personal Data
We use the personal data described in Section 4 for the following purposes:
- Contract administration: Managing customer accounts, processing orders and invoices, handling renewals and terminations.
- Providing the Service: Enabling authorized users to access the management console and operate the platform.
- Customer support: Responding to inquiries, resolving technical issues, and communicating service updates.
- Security: Monitoring for unauthorized access, investigating incidents, and protecting the integrity of the platform.
- Legal compliance: Fulfilling our obligations under Austrian commercial and tax law, including retaining business records for the required statutory periods.
- Service improvement: Using aggregated and anonymized usage patterns to identify issues and improve the platform. We do not use identifiable personal data from customer accounts to train AI/ML models.
7. Sub-processors and Third-Party Recipients
As a data controller, Nexufend shares personal data with the following categories of recipients:
7.1 Service Providers (Sub-processors)
These organizations process personal data on our behalf under contractual arrangements that include data protection obligations.
| Sub-processor | Role | Location | Data processed |
|---|---|---|---|
| Zoho Corporation GmbH | CRM, email, support ticketing, internal communications, payment processing | EU – Germany | Customer contact data, communications, account data, billing/payment data |
| Zoho Corporation B.V. | Sub-processor of Zoho GmbH; EU data center operations | EU – Netherlands | Same as above |
| Scaleway SAS | Cloud infrastructure hosting (management console) | EU – France | Platform data, access logs |
| Webflow Inc. | Website hosting (nexufend.com) | US (SCCs in place) | Website visitor IP addresses, browser data, technical delivery data |
| Google LLC (Google Tag Manager) | Tag management on nexufend.com | US (SCCs in place) | Manages and deploys tracking tags; no data collected by GTM itself |
| Google LLC (Google Meet) | Video conferencing | US (SCCs in place) | Names, email addresses of meeting participants |
| Google LLC (Google reCAPTCHA) | Bot detection and fraud prevention on nexufend.com forms and interactive elements | US (SCCs in place) | IP address, browser and device signals, behavioral data |
| Finsweet Inc. (ConsentPro) | Consent Management Platform – records and stores visitor consent preferences on nexufend.com | US (SCCs in place per Finsweet DPA, accepted via Finsweet ToS) | Visitor consent choices, IP region, browser/device information, page URLs, timestamps |
We do not sell personal data to third parties.
7.2 Affiliates
We may share personal data with Nexufend Affiliates (as defined in our Terms of Service) for the purposes of providing and improving the Service, or in connection with a corporate restructuring or transfer described in Section 8.
7.3 Legal Obligations
We may disclose personal data to public authorities, law enforcement bodies, or courts where required by applicable law, court order, or regulatory requirement. We will notify you where legally permitted before making such a disclosure.
7.4 Professional Advisors
We may share personal data with lawyers, auditors, and insurers where necessary in connection with a dispute, audit, or legal proceeding.
7.5 Advertising Platforms (Independent Controllers – Consent-Activated)
When you accept advertising cookies via our consent banner on nexufend.com, your browser sends data directly to the advertising platforms whose tags we deploy via Google Tag Manager (which may include LinkedIn, Google Ads, and Meta). These platforms act as independent data controllers in respect of the data they receive – they determine their own purposes and means of processing, and their processing is governed by their own privacy policies, not by this Policy or Nexufend's Data Processing Addendum.
No data is shared with these platforms unless you have given explicit prior consent via our cookie banner. You can withdraw consent at any time by updating your preferences in the banner.
8. International Data Transfers
All personal data processed by Nexufend is currently stored and processed within the European Union (Scaleway – France; Zoho – Germany/Netherlands).
Where we use service providers located outside the EU/EEA, data transfers are carried out under Standard Contractual Clauses (SCCs) as approved by the European Commission, or another valid transfer mechanism under GDPR Chapter V. This currently applies to:
- Webflow Inc. (USA) – website hosting for nexufend.com; visitor IP addresses and browser data processed in the US under SCCs
- Google LLC (USA) – Google Tag Manager (tag management on nexufend.com), Google reCAPTCHA (bot detection on nexufend.com), and Google Meet (video conferencing); processed in the US under SCCs
- Finsweet Inc. (USA) – ConsentPro consent management platform; visitor consent choices and associated browser/device data processed in the US under SCCs (DPA accepted via Finsweet ToS)
Advertising platforms (Section 7.5) operate as independent controllers under their own terms; any data they receive flows directly from your browser upon your consent and is not a transfer made by Nexufend.
EU customer data (Agent telemetry, management console data) will remain permanently within the EU. If Nexufend in the future routes such data to non-EU infrastructure, any such transfer will be carried out under a valid transfer mechanism and reflected in an updated version of this Policy and the applicable DPA.
9. Cookies
We operate two distinct web properties with different cookie profiles:
9.1 nexufend.com (Marketing Website – hosted on Webflow)
nexufend.com is hosted on Webflow Inc. (USA). Webflow may set cookies necessary to deliver the website. Our cookie consent banner is in place on nexufend.com; no advertising or analytics tags will fire without your prior consent.
We use advertising tracking pixels via Google Tag Manager (e.g., LinkedIn Insight Tag, Google Ads, or Meta Pixel) to support our marketing activities. These tags are only activated after you accept the relevant cookie categories in our consent banner.
We also use Google reCAPTCHA on contact forms and other interactive elements to protect against bots and automated abuse. reCAPTCHA may set functional cookies and processes behavioral signals to distinguish human users from bots. This is a functional security measure based on legitimate interest (Art. 6(1)(f)) – it does not require opt-in consent, though you may object at any time (see Section 11).
| Cookie type | Status | Consent required? |
|---|---|---|
| Strictly necessary (Webflow delivery) | In use | No – technically essential |
| Strictly necessary (ConsentPro consent preference) | In use | No – technically essential (remembers your consent choices) |
| Functional / security (Google reCAPTCHA) | In use | No – legitimate interest (fraud/bot prevention); right to object applies |
| Analytics | Not in use | Yes – if introduced |
| Advertising / tracking pixels (via GTM) | In use | Yes – no tags fire without prior consent via consent banner |
9.2 Management Console (Customer Dashboard – hosted on Scaleway, EU)
The Nexufend management console is hosted on Scaleway infrastructure in the EU and uses only strictly necessary cookies (session management and authentication). It does not use any analytics, tracking, or advertising cookies, and this will not change without updating this Policy.
| Cookie type | Status | Consent required? |
|---|---|---|
| Strictly necessary (session, authentication) | In use | No – technically essential |
| All other types | Not in use | N/A |
9.3 Managing Cookies
You can control and delete cookies through your browser settings. Disabling strictly necessary cookies on nexufend.com or the management console may affect functionality. You can accept or decline individual cookie categories at any time via the consent banner on nexufend.com.
10. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by law.
| Data category | Retention period | Basis |
|---|---|---|
| Contract and account data | Duration of the contractual relationship + 7 years | Austrian BAO §132 (tax/accounting records) |
| Invoices and payment records | 7 years from invoice date | Austrian BAO §132 |
| Account credentials and user profiles | Duration of contract + up to 60 days (grace period) | Legitimate interest / account recovery |
| Support communications | 3 years after the end of the contract | Statute of limitations (Austrian ABGB §1489) |
| Console access logs | 3 years | Security and audit |
| Website visitor data (nexufend.com via Webflow) | Per Webflow's data retention policy; technical delivery data not retained by Nexufend beyond the session | Technical necessity |
| Advertising / tracking data | Per the retention policy of the relevant advertising platform; subject to consent withdrawal at any time | Consent (Art. 6(1)(a)) |
When the retention period expires, personal data is securely deleted or anonymized.
11. Your Rights
Under GDPR, individuals have the following rights regarding their personal data held by Nexufend as controller. Note that some of these rights apply in specific circumstances.
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we hold about you |
| Rectification (Art. 16) | Request correction of inaccurate or incomplete personal data |
| Erasure (Art. 17) | Request deletion of your personal data, subject to legal retention obligations |
| Restriction (Art. 18) | Request that we limit processing of your data in certain circumstances |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format |
| Objection (Art. 21) | Object to processing based on legitimate interest, including direct marketing |
| Withdraw consent | Where processing is based on consent, withdraw it at any time |
To exercise any of these rights, contact us at legal@nexufend.com. We will respond within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing a request.
We do not charge a fee for handling rights requests except where they are manifestly unfounded or excessive.
12. Right to Lodge a Complaint
If you believe that Nexufend has processed your personal data in violation of applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority:
Österreichische Datenschutzbehörde (DSB)
Barichgasse 40–42
1030 Vienna, Austria
dsb.gv.at
You may also contact the supervisory authority in your country of residence or workplace within the EU/EEA.
13. Data Security
Nexufend implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or alteration. These measures include encryption in transit (TLS) and at rest, role-based access controls, multi-factor authentication for internal systems, and audit logging. A full description of our security measures is set out in the Technical and Organizational Measures Annex to our Data Processing Addendum.
No method of data transmission or storage is completely secure. If you become aware of a security concern relating to your account or data, contact us immediately at legal@nexufend.com.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify customers by email or via the management console at least 30 days before the changes take effect. The "Last updated" date at the top of this Policy reflects the most recent revision.
Continued use of the Service or nexufend.com after the effective date of a revised Policy constitutes acceptance of the changes.
15. Contact
For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact:
Nexufend GmbH legal@nexufend.com Office Park 2, 5. Stock, 1300 Wien Flughafen, Austria
Nexufend GmbH – nexufend.com – legal@nexufend.com