Privacy & Data Processing Policy

This Privacy Notice explains how Nuomy Technologies s.r.o. ("Controller", "we", "us") processes personal data of visitors of nuomy.com and users of the Nuomy platform.

Effective date: April 7, 2026

1. Data Controller

Nuomy Technologies s.r.o. Registered office: Nové sady 988/2, 602 00 Brno, Czech Republic Company ID (IČ): 24009857 VAT ID (DIČ): CZ24009857 Data box: cze3rjz Contact e-mail: hello@nuomy.com

2. Scope

This Notice applies to:

• nuomy.com (marketing website and platform)

3. What Personal Data We Process

Depending on whether you are a website visitor, a client representative or a diagnostic session participant, we may process:

3.1 Data You Provide to Us

• Identification and contact data (e.g., email, name, company name, job title)
• Communication content (support requests, emails, contact forms)
• Voice recordings and transcripts from diagnostic sessions

3.2 Data Generated by Using the Website/Platform

• Technical and operational data (IP address, user agent, device/browser identifiers, logs)
• Product usage data (in-app events and interactions), typically aggregated or pseudonymised
• Diagnostic session metadata (duration, completion status)
• AI-generated diagnostic outputs (scores, findings, assessments)
• Cookies and similar technologies (see Section 9)

4. Purposes and Legal Bases

4.1 Contact Form and Enquiries

Scope: Email address, name, company, message content, IP address/technical logs.

Purpose: Responding to enquiries about Nuomy's services, scheduling demonstrations and arranging contracts.

Legal basis: Legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR) and, where applicable, pre-contractual measures (Art. 6(1)(b)).

4.2 Website Analytics

Scope: Cookies/online identifiers, anonymised IP, technical data.

Purpose: Measuring website traffic, understanding visitor behaviour and improving content.

Legal basis: Consent for analytics cookies; legitimate interests for strictly necessary cookies.

4.3 Providing the Service

Purpose: Conducting diagnostic sessions, generating diagnostic outputs, delivering reports to clients, customer support.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest in secure and reliable operations (Art. 6(1)(f)).

4.4 Invoicing and Accounting

Purpose: Invoicing, accounting and financial record-keeping.

Legal basis: Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).

4.5 Product Analytics and Improvements

Purpose: Measuring platform usage, improving diagnostic methodologies, debugging and quality assurance.

Legal basis: Legitimate interest (Art. 6(1)(f)) and/or consent (Art. 6(1)(a)), depending on cookie/tracking settings.

4.6 AI Diagnostic Features

Purpose: Processing participant voice input and responses to conduct diagnostic sessions, generate scores and produce diagnostic reports.

Legal basis: Performance of a contract (Art. 6(1)(b)) — the diagnostic service is the core contractual obligation.

Special note on voice data: Voice recordings are processed in real time during the diagnostic session. Transcripts may be retained for the purpose of generating accurate diagnostic outputs. Voice recordings are not retained beyond the session unless explicitly agreed with the client.

5. Recipients and Processors (Sub-processors)

We share personal data only as necessary with vetted service providers (processors) and, where required by law, with public authorities.

6. International Transfers (Outside the EU/EEA)

Some providers may process data outside the EU/EEA (e.g., in the US). Where applicable, we ensure transfers comply with GDPR, typically via Standard Contractual Clauses (SCC) and, where needed, supplementary measures.

7. Retention Periods

7.1 Contact Enquiries

For the duration necessary to respond and follow up, then deleted or anonymised within 24 months.

7.2 Analytics

Raw events: 12 months. Aggregated/anonymised statistics: 24 months.

7.3 Logs and Security Records

• Application and infrastructure logs (operational): 90 days
• Security logs (auth, access, anomalies): 12 months
• Incident data / forensic exports: during the incident + 12 months after closure

7.4 Diagnostic Session Data

• Voice recordings: deleted after session processing unless otherwise agreed
• Transcripts and diagnostic outputs: for the duration of the contract, then deleted or anonymised within 90 days of contract completion
• Anonymised and aggregated diagnostic data may be retained indefinitely for improving diagnostic methodologies

7.5 Invoicing and Accounting

As required by applicable law.

8. Security

We implement appropriate technical and organisational measures (access control, least privilege, encryption in transit, logging, contractual safeguards with processors, etc.).

9. Cookies and Consent Management

We use cookies and similar technologies on nuomy.com:

• Strictly necessary — functionality, security (stored without consent)
• Analytics — measurement and improvement (stored only with consent)

You can change your cookie preferences at any time via the cookie settings link in the website footer.

10. Your Rights

You have the right to access, rectify, erase, restrict processing, data portability (where applicable), object, and withdraw consent (where processing is based on consent).

Requests should be sent to hello@nuomy.com.

You also have the right to lodge a complaint with a supervisory authority — in the Czech Republic: Úřad pro ochranu osobních údajů (uoou.cz).

11. Contact

Contact e-mail: hello@nuomy.com

Nuomy Technologies s.r.o. Nové sady 988/2, 602 00 Brno, Czech Republic Company ID (IČ): 24009857 VAT ID (DIČ): CZ24009857 Data box: cze3rjz IBAN: CZ36 0800 0000 0067 5882 5329 SWIFT: GIBACZPX