This privacy policy explains how Nebuly S.r.l., with registered office at Piazza Carlo Emanuele II, 19, 10123 Turin, Italy (“Nebuly”), processes personal data as controller under Regulation (EU) 2016/679 (the “GDPR”) and Italian data protection law.

1. Scope

1.1 Controller. Nebuly is the controller of the personal data described in this policy. For contracts concluded by its subsidiary NebulyAI, Inc., 1800 West Loop South, Suite 1600, Houston, TX 77027, United States, NebulyAI, Inc. is the controller of the data described in Articles 2.3 to 2.5 that relate to those contracts. Both can be contacted as set out in Article 6.1.

1.2 Persons concerned. This policy applies to visitors of the website www.nebuly.com (the “Site”), to persons who contact Nebuly, to the authorised users of Nebuly’s software and services, and to the contact persons of Nebuly’s customers, prospective customers, suppliers and partners.

1.3 Customer data. Nebuly processes the personal data contained in the interaction records and other data that its customers submit to its software as processor, on behalf of each customer and under the data processing agreement with it. This policy does not apply to that processing: the customer is the controller and its own privacy notice applies. Requests concerning that data are forwarded to the customer.

2. Personal Data and Purposes

2.1 Website. When you visit the Site, Nebuly processes technical data, such as your IP address, device and browser data and the pages visited, to operate and secure the Site, on the basis of its legitimate interest (Article 6(1)(f) GDPR). Cookies are described in the cookie policy published on the Site; those that are not strictly necessary are used only with your consent.

2.2 Enquiries. When you contact Nebuly or request a demonstration, Nebuly processes your name, business contact details, organisation, role and request, to reply to you and follow up on your request, on the basis of its legitimate interest (Article 6(1)(f) GDPR).

2.3 Accounts and support. Where your organisation uses Nebuly’s software and services, Nebuly processes the data it receives depending on the deployment: your name, business email address, login and authentication data, data on your use of the software and your support requests. It uses them to give you access, administer the account, provide support, secure the services and send you service communications, on the basis of its legitimate interest in performing the contract with your organisation and in securing its services (Article 6(1)(f) GDPR).

2.4 Contracts and billing. Nebuly processes the names and contact details of the contact persons of its customers and suppliers, and contract, billing and payment data, to conclude and manage contracts and invoice and collect fees. The legal basis is its legitimate interest in managing its business relationships (Article 6(1)(f) GDPR) or, where you are personally a party to the contract, the contract (Article 6(1)(b) GDPR). Accounting and tax records are kept to comply with Nebuly’s legal obligations (Article 6(1)(c) GDPR). Card payments are processed by a payment provider, and Nebuly does not receive card numbers.

2.5 Marketplace purchases. Where your organisation purchases Nebuly’s software or services through a cloud marketplace, such as Google Cloud Marketplace, the marketplace operator provides Nebuly with information on the purchase, including the purchasing account and its identifier, the names and contact details of the persons concerned and the plan and usage purchased. Nebuly uses that information only to supply the software and services, administer the account and the purchase and comply with the law, on the legal bases set out in Articles 2.3 and 2.4. Nebuly does not use it for marketing, advertising or personalisation, and does not sell it or share it for cross-context behavioural advertising. The marketplace operator processes payment data under its own privacy policy.

2.6 Sources. Where Nebuly does not collect personal data from you, it receives it from the organisation you work for or from the marketplace operator under Article 2.5.

2.7 Provision of data. Data needed to create an account, conclude a contract or reply to a request is required for that purpose, and without it Nebuly cannot proceed. Nebuly takes no decision based solely on automated processing that produces legal or similarly significant effects on you.

3. Recipients and Transfers

3.1 Recipients. Personal data is processed by Nebuly’s authorised personnel and by service providers that process it on Nebuly’s behalf under written contracts, such as providers of hosting, email, authentication, customer relationship management and cookie consent services. It may also be disclosed to NebulyAI, Inc. and, where needed, to recipients that process it as separate controllers, such as payment providers, Nebuly’s professional advisers and auditors, the marketplace operator for purchases under Article 2.5 and public authorities where the law requires. Nebuly does not sell personal data.

3.2 Transfers. Where Nebuly hosts and operates its software for its customers, it does so in the European Union; this does not apply to software installed in a customer’s own environment. Some service providers and NebulyAI, Inc. are located in the United States, and transfers to them rely on the adequacy decision for the EU-U.S. Data Privacy Framework, where the recipient is certified under it, or otherwise on the standard contractual clauses adopted by the European Commission, a copy of which is available on request.

4. Retention

4.1 Retention periods. Nebuly keeps personal data only for as long as needed for the purposes for which it is processed:

(i) technical logs of the Site, for no more than twelve (12) months;

(ii) cookie data, for the periods stated in the cookie policy;

(iii) enquiry data, until the request has been dealt with and then for no more than twenty-four (24) months after the last contact with you;

(iv) account and support data, for as long as the account is active and for ninety (90) days after it is closed;

(v) contract data, for the term of the contract and then until claims arising from it can no longer be brought; and

(vi) invoices and accounting records, for the period required by the law applicable to the company concerned, which for Nebuly is ten (10) years.

Personal data may be kept for longer where needed to establish, exercise or defend legal claims.

5. Your Rights

5.1 Rights. Under the conditions set by the GDPR, you may request access to your personal data, its rectification or erasure, the restriction of its processing and its portability, and you may object to processing based on legitimate interest. Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of earlier processing.

5.2 Exercise. Requests may be sent to legal@nebuly.ai. Nebuly replies without undue delay and in any event within one month, which may be extended where permitted by Article 12(3) GDPR. Requests concerning customer data under Article 1.3 are forwarded to the customer concerned.

5.3 Complaints. You may lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the place where you live or work.

6. Contacts and Updates

6.1 Contacts. You can contact Nebuly and NebulyAI, Inc. at legal@nebuly.ai or at the addresses above, and Nebuly also by certified electronic mail at nebuly@pec.it.

6.2 Updates. Nebuly may update this policy by publishing a new version on the Site stating the date of its update.

Nebuly S.r.l. · Piazza Carlo Emanuele II, 19, 10123 Turin (TO), Italy · legal@nebuly.ai