GDPR Privacy Notice

1. Data controller

This notice explains how Nodesty LLC (8 The Green, Suite 21610, Dover, DE 19901, United States) processes the personal data of people in the European Economic Area (EEA). We have no establishment in the EU, but because we offer services to people in the EEA, we are subject to the Regulation under Article 3(2) GDPR.

For data that customers host on their servers, Nodesty is a processor within the meaning of Article 28 GDPR. The customer is the controller of that data and the relationship is governed by the Data Processing Agreement.

2. Data we process

• Account and contact details: name, email address, phone number and address.
• Order, invoice and payment details. Card details are processed by Stripe.
• Technical data: IP address, session and login records, browser and device information, system logs.
• Support requests and correspondence.
• Identity document and liveness check data for accounts asked for extra verification; student documents for Education Pack applications.
• Session recordings of site usage (on our own servers).
• Analytics and ad measurement data, if you consent.

3. Purposes and legal bases

• Performance of a contract (Article 6(1)(b)): account management, orders, providing services, billing and support.
• Legal obligation (Article 6(1)(c)): tax and accounting records, binding requests from authorities.
• Legitimate interests (Article 6(1)(f)): information security, DDoS protection, fraud prevention, troubleshooting, service improvement and defending legal claims. You can object to this processing under Article 21.
• Consent (Article 6(1)(a)): analytics and advertising cookies and the Meta Conversions API. You can withdraw consent at any time in the cookie preferences.
• Explicit consent (Article 9(2)(a)): identity verification involving biometric data, only if you start the verification.

4. Automated decision-making

At sign-up and checkout we use TrustAssessment, an AI-assisted risk assessment system. Based on the details you provide and technical signals, it may lead to your account being asked for extra verification or to some actions being restricted.

Under Article 22 you have the right to obtain human review of these decisions, to express your point of view and to contest the decision. Write to privacy@nodesty.com to do so.

5. Recipients

We share your data only with the service providers we work with to deliver our services. They are bound by contracts that meet Article 28. The current list is on the Sub-processors page. Where required by law, data may also be shared with competent authorities. We do not sell your personal data.

6. International transfers

Nodesty LLC is based in the United States. Collecting data directly from you is not itself a transfer, but your data may be processed in the US and in other countries outside the EEA.

For transfers outside the EEA we rely on the Standard Contractual Clauses (SCCs) adopted by European Commission Decision 2021/914 or, where the recipient is certified, on the EU-US Data Privacy Framework (DPF). You can request a copy of the relevant safeguards at privacy@nodesty.com.

7. Retention

We keep account data while your account is open and for at least 1 and at most 2 years after it is closed. Invoice and accounting records are kept for the statutory period, and Education Pack documents for at most 30 days after the review. Data whose retention period has ended is deleted or anonymized.

8. Your rights

• Access (Article 15): ask for a copy of your data.
• Rectification (Article 16): have inaccurate or incomplete data corrected.
• Erasure (Article 17): have your data deleted under certain conditions.
• Restriction (Article 18): have processing limited.
• Portability (Article 20): receive your data in a structured, machine-readable format.
• Objection (Article 21): object to processing based on legitimate interests and to direct marketing.
• Withdraw consent: stop processing based on consent at any time.
• Complaint: lodge a complaint with the data protection authority in your EU member state.

9. Exercising your rights

You can send your request to privacy@nodesty.com. Once we have verified your identity, we answer free of charge within one month. Depending on the complexity of the request, this period may be extended by two further months, in which case we will let you know.

10. Security

We protect your data with technical and organisational measures such as encrypted connections (TLS), access control, two-factor authentication, encrypted storage of sensitive documents, DDoS protection and security logging.

11. Children

Our services are not directed at people under 16 and we do not knowingly collect their data.