Privacy Notice

Introduction

This Privacy Notice explains how Nex Global LLC, a limited liability company organized under the laws of the State of Wyoming, United States of America, with its registered office at 1621 Central Ave #69914, Cheyenne, WY 82001, USA, trading as "Nex Systems" ("Nex", "we", "us" or "our"), collects, uses, shares and protects personal data when it acts as a controller.

Who this notice applies to. This notice applies to personal data about:

1. visitors to our websites, including nex.systems and its sub-domains, and users of our free tools;
2. people who contact us, request a demo, a pilot or information, subscribe to our communications, or attend our events and webinars;
3. representatives and authorized users of our customers, prospective customers, authorized partners, referrers, suppliers and other business contacts, in relation to account administration, billing, support and the business relationship;
4. people who apply for a job or internship with us; and
5. individuals whose information appears in the sanctions, watchlist, politically exposed person ("PEP") and adverse media data that we compile and make available through Nex Screening ("Screening Data"), as explained in Section 4.

What this notice does not cover. When our customers use Nex eKYC, Nex Screening, Nex AML, Nex 360, Elodie or our APIs to process information about their own applicants, customers, counterparties and other individuals, our customer is the controller of that information and we process it only on their behalf, as their processor, under our Data Processing Agreement. If you have been verified, screened or monitored by one of our customers, please read that organization's privacy notice and contact it directly to exercise your rights. Section 1 explains this in more detail.

Business services only. Our services are designed for businesses, financial institutions, government bodies and non-profit organizations. They are not directed to consumers or to children.

How to read this notice. Each section has a short summary followed by the full detail. Capitalized terms that are not defined here have the meaning given in our Terms of Service. If you have any question about this notice, contact us at privacy@nex.systems.

1. Our Role: Controller and Processor

In short: we decide how your data is used for our own website, business relationships and Screening Data. For the data our customers put into our services, our customer decides, and we act on their instructions.

1.1 Nex as controller. Nex is the controller of the personal data described in this notice, which means that Nex decides why and how it is processed. This includes personal data processed through our websites, free tools, sales and marketing activities, customer and partner relationships, recruitment, security and fraud prevention, and the compilation of Screening Data.

1.2 Nex as processor. When a customer uses our services to verify, screen or monitor individuals, investigate cases or prepare reports, the customer is the controller and Nex is its processor. We process that information only on the customer's documented instructions, under our Data Processing Agreement, and we do not use it for our own purposes except as that agreement permits (for example, to secure our services). Typical examples are an applicant who completes an identity check in a bank's onboarding journey, a customer screened by an exchange house, or a transaction monitored by a payment company.

1.3 Requests about customer data. If we receive a request from an individual about personal data that we process for a customer, we will, where we can identify the customer and where the law allows, forward the request to that customer or ask you to contact it directly. We cannot respond to the substance of such a request without the customer's instructions.

1.4 Independent decisions by customers. Each customer decides independently whether to onboard, accept, decline, monitor, investigate or report any person, and on what basis. Nex does not make those decisions and is not responsible for them. If you disagree with a decision made by one of our customers, please contact that customer.

1.5 Data protection contact. Nex's privacy function can be reached at privacy@nex.systems for any question about this notice or the processing of your personal data.

2. Personal Data We Collect

In short: we collect what you give us, what our systems record when you use our websites and services, and limited information from business sources. The table shows what we collect for each type of relationship.

2.1 Categories by relationship.

2.2 Information you choose not to provide. Where we need personal data to provide a service, conclude a contract or comply with a legal obligation, and you do not provide it, we may be unable to provide that service or enter into that relationship.

2.3 Sensitive information. We do not ask for special categories of personal data through our websites or business relationships, and we ask you not to send them to us. Screening Data may include information that reveals political opinions (PEP status) or relates to alleged or proven criminal offenses; Section 4 explains how we handle it. Our free passport check does not accept document images or biometric data.

2.4 Information about others. If you provide personal data about another person, for example a colleague, a director or a referee, you confirm that you are entitled to do so and that you have informed that person about this notice where required.

3. How We Use Personal Data and Our Legal Bases

In short: we use personal data to run our websites and services, manage business relationships, keep our services secure, meet our legal obligations and, where you agree or the law allows, tell you about our products. We rely on the legal bases shown below.

3.1 Purposes and legal bases. Where data protection laws require a legal basis, we rely on the following:

3.2 Legitimate interests. Where we rely on legitimate interests, we have assessed that our interests, or those of our customers or the public, are not overridden by your interests and fundamental rights, taking into account the nature of the data, your reasonable expectations and the safeguards we apply. You can ask us for more information about this assessment and you may object, as explained in Section 10.

3.3 Consent. Where we rely on your consent, you can withdraw it at any time, without affecting the lawfulness of processing before withdrawal, by using the unsubscribe link in our emails, changing your cookie preferences or contacting privacy@nex.systems.

3.4 New purposes. We will use personal data for a new purpose only if it is compatible with the purpose for which it was collected, or if we have another legal basis for doing so, and we will inform you where the law requires.

3.5 No sale of personal data. We do not sell personal data, and we do not share it with third parties for cross-context behavioral advertising.

4. Notice to Individuals in Our Screening Data

In short: to help regulated organizations meet their legal duties to prevent money laundering, terrorist financing, sanctions evasion and fraud, we compile information about people who appear on official sanctions and watch lists, people who hold or have held prominent public positions, and people reported in the media in connection with financial crime. Being in our data does not mean that you have done anything wrong.

4.1 What Screening Data is. Screening Data is a structured database that Nex compiles from publicly available sources and makes available to its customers through Nex Screening and our free tools. Customers use it to check whether their customers, counterparties or transactions involve a sanctioned person, a PEP, or a person linked to reported financial crime, as AML/CFT and sanctions laws require them to do.

4.2 Who is in Screening Data. Screening Data may include information about: (a) individuals and entities designated on sanctions, embargo, export-control, law-enforcement, regulatory and other official lists published by governments and international bodies; (b) politically exposed persons, meaning individuals who hold or have held prominent public functions, and, where relevant, their family members and close associates; and (c) individuals named in news and media reports, court records or regulatory publications in connection with financial crime, corruption, fraud, terrorism, organized crime or other serious misconduct.

4.3 Categories of personal data. Depending on the source, Screening Data may include: names, aliases and name variants; date and place of birth; nationality and country of residence; gender; positions, roles and titles held and their dates; relationships with other listed persons or entities; identification numbers published by an official source (such as passport numbers in a sanctions listing); addresses published by an official source; the listing authority, program, reason and date of listing; links to and short excerpts from the source publications; and photographs where published by an official source. It may also include information that reveals political opinions (PEP status) or relates to alleged or proven criminal offenses.

4.4 Sources. We collect Screening Data only from sources that are publicly available, using our own collection, crawling and structuring systems and tools. In particular: (a) sanctions, embargo and other official list data is collected directly from the official websites and publications of the governments, regulators and intergovernmental bodies that issue those lists; (b) PEP data is compiled from open sources on the internet, including official government and parliamentary websites, public registers and open knowledge databases such as Wikidata; and (c) adverse media data is identified from publicly available news and media sources, using advanced AI-supported tools to search, filter, classify and summarize the results by relevance and risk. We do not collect Screening Data from private social media accounts or other closed sources, and we do not purchase it from data brokers. Because open sources and AI-supported filtering may contain errors, omissions or out-of-date information, Screening Data reflects what our sources publish and is provided to customers as an indicator for their own review, as explained in Sections 4.6 to 4.8 and Section 5.

4.5 Purposes and legal bases. We compile and provide Screening Data to support the prevention and detection of money laundering, terrorist financing, proliferation financing, sanctions evasion, bribery, corruption and fraud. We rely on: (a) our legitimate interests, and those of our customers and society, in preventing financial crime and enabling regulated organizations to meet their legal obligations; (b) for information revealing political opinions, the processing being necessary for reasons of substantial public interest, or relating to data manifestly made public by the individual, as permitted by data protection laws; and (c) for criminal-offense data, the conditions and authorizations that data protection laws provide for preventing or detecting unlawful acts and for regulatory compliance. We do not rely on consent for Screening Data.

4.6 What inclusion means. Inclusion in Screening Data does not mean, and must not be taken to mean, that you are or have been involved in money laundering, terrorism, corruption or any other wrongdoing, or that Nex has formed any opinion about you. Being a PEP indicates only that you hold or have held a prominent position, or are connected to someone who does. Media reports may contain allegations that have not been proven; our customers are required to treat such allegations as unproven and to make their own independent checks before making any decision. A match generated by our services is only a potential match that our customer must review.

4.7 Decisions are made by our customers. Nex does not decide whether any person may open an account, carry out a transaction or receive a service. Those decisions are made by our customers, using their own policies and human review. Nex does not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

4.8 Accuracy and corrections. We aim to keep Screening Data accurate and up to date, reflecting the content of our sources. If you believe that information about you is inaccurate, out of date or incomplete, contact privacy@nex.systems with details. We will review your request and, where appropriate, correct, update, annotate or remove the information. We are not able to remove information that accurately reflects a current official listing or publication, but we can add a note, for example that a listing has been removed by the issuing authority or that a reported allegation was later withdrawn.

4.9 Limits on certain rights. Your rights described in Section 10 apply to Screening Data, subject to the limits that data protection laws allow where their exercise would seriously impair the prevention or detection of crime or the ability of regulated organizations to meet their legal obligations. For example, we may not be able to erase accurate information about a current sanctions designation or a current PEP position. We will not tell you which of our customers has screened you, because that information belongs to our customers and may be protected by anti-money laundering "tipping-off" rules.

4.10 Retention of Screening Data. We keep Screening Data for as long as it remains relevant to the purposes in Section 4.5, for example while a designation is active or while a person holds a prominent position, and for a further period afterwards to allow our customers to meet their record-keeping and look-back obligations, after which it is deleted or anonymized. See Section 8.

4.11 Why we may not be able to notify you directly. Because Screening Data is collected from public sources about a very large number of people and is used to prevent crime, informing each individual directly would be impossible, would involve a disproportionate effort or would seriously impair the purpose of the processing. This Section 4 is our way of providing transparent information to the public, as data protection laws permit.

5. Automated Processing and Artificial Intelligence

In short: our services use automated matching, scoring and AI to help our customers' staff, but people make the decisions.

5.1 Automated tools in our services. Our services use automated techniques, including name matching, document and image analysis, risk scoring and AI assistance (including our assistant, Elodie), to help our customers' trained personnel review information more efficiently. These tools produce indicators, scores and suggestions that our customers review.

5.2 No solely automated decisions by Nex. Nex does not make decisions about individuals that are based solely on automated processing and that produce legal effects or similarly significant effects. Our customers are responsible for ensuring that their own decisions involve meaningful human review where the law requires it.

5.3 Our own use of automated tools. We may use automated tools to detect fraud, abuse and security threats on our websites and services, for example to block repeated automated queries to our free tools. Where such a measure significantly affects you, you can contact us to request human review.

5.4 AI providers. Where our services use third-party AI model providers, they act as our service providers and are not permitted to use personal data for their own purposes or to train their models.

5.5 Accuracy. We make substantial efforts to train and test our models for accuracy and bias, but no automated system is perfect. Automated and AI outputs are supportive tools only: they may be incomplete, inaccurate or out of date, are not a decision or a finding about any person, and must be reviewed by our customers' trained personnel before they are relied on. If you believe an automated output has affected you unfairly, contact the organization that made the decision about you, or contact us at privacy@nex.systems for matters within our control.

5.6 Biometric information. Nex eKYC may compare a face image or video with the photograph on an identity document and check that a live person is present. In doing so, Nex processes biometric information only as a processor on behalf of the customer that requested the verification, and only for identity verification, fraud prevention and liveness detection. The customer is responsible for providing any notice and obtaining any consent or written release that the law requires before biometric information is collected, including under the Illinois Biometric Information Privacy Act, Texas Business and Commerce Code Section 503.001 and Washington RCW 19.375. Nex does not sell, lease, trade or otherwise profit from biometric information, does not use it to train models, and does not disclose it except to the customer, to Sub-processors bound by written terms, or where required by law. Biometric information is retained only as long as the customer instructs, and in any case is destroyed when the initial purpose of collection has been satisfied, or within three (3) years of the individual's last interaction with the customer, whichever occurs first, unless a longer period is required by law or a valid legal process. Questions about a verification should be sent to the customer that carried it out.

6. Sharing and Recipients

In short: we share personal data only with service providers who help us run our business, with our customers where this is the purpose of the service, with authorized partners involved in your relationship, and where the law requires. We do not sell it.

6.1 Recipients. We may share personal data with:

1. Service providers who process personal data on our behalf and under our instructions, such as cloud hosting providers, AI model providers, email, communication and customer support tools, payment processors, professional advisers and IT security providers. They are bound by written contracts that require them to protect personal data and to use it only to provide services to us. A list of the service providers that process customer data is available on request at privacy@nex.systems.
2. Our customers, to the extent that providing Screening Data or results to them is the purpose of our services, and, for authorized users, the customer organization that administers your account.
3. Authorized partners and referrers who introduced you or your organization to us or who provide support to you, to the extent necessary for that relationship.
4. Affiliates of Nex Global LLC, where any exist now or in the future, for the purposes described in this notice.
5. Public authorities, regulators, courts and law-enforcement agencies, where we are required to do so by law, to respond to a lawful request, or where we believe in good faith that disclosure is necessary to prevent or detect crime, protect our rights, property or safety, or those of our customers or others.
6. Professional advisers, such as lawyers, auditors, accountants and insurers, under confidentiality obligations.
7. A buyer, investor or successor, in connection with a proposed or actual merger, acquisition, financing, reorganization, sale of assets or similar transaction, subject to confidentiality obligations, in which case personal data may be transferred as part of the transaction.

6.2 Government requests. We review requests from public authorities for personal data carefully and disclose only what the law requires. Where we process data on behalf of a customer, we will redirect the authority to that customer and notify the customer where the law allows.

6.3 Aggregated and de-identified information. We may share aggregated or de-identified information that does not identify any individual, for example statistics about the use of our services.

7. International Transfers

In short: we are a U.S. company and use global service providers, so your data may be processed outside your country. Where the law requires, we use approved safeguards.

7.1 Where we process data. Nex Global LLC is established in the United States. We and our service providers may process personal data in the United States and in other countries where they or their hosting providers operate. These countries may not offer the same level of data protection as your own.

7.2 Safeguards. Where data protection laws restrict transfers of personal data outside your country, we rely on an appropriate safeguard, such as: an adequacy decision or equivalent recognition by the competent authority; the European Commission's Standard Contractual Clauses; the UK International Data Transfer Addendum or Agreement; standard clauses adopted by other competent authorities; or another mechanism or exception permitted by the applicable law, such as where the transfer is necessary for a contract with you or at your request.

7.3 Supplementary measures. We apply technical and organizational measures, including encryption in transit and access controls, to protect transferred data, and we assess requests from public authorities as described in Section 6.2.

7.4 More information. You can request information about the safeguards we use, and a copy of the relevant clauses, by contacting privacy@nex.systems. Commercial terms may be removed.

8. Retention

In short: we keep personal data only for as long as we need it for the purposes in this notice, or as the law requires, and then delete or anonymize it.

8.1 Retention periods. We determine retention periods based on the purpose of the processing, the nature and sensitivity of the data, our legal obligations, limitation periods for legal claims and the risk of harm. Our standard periods are:

8.2 Longer retention. We may keep personal data for longer where required by law, a court order or a regulator, or where necessary to establish, exercise or defend legal claims, in which case we restrict its use to that purpose.

8.3 Customer data. Personal data that we process for our customers is retained in accordance with our customers' instructions and our Data Processing Agreement, not this Section 8.

9. Security and Data Breaches

In short: we work with reliable, certified service providers and partners, and we use robust security tools to protect personal data. No system is 100% secure, but if a breach occurs we act quickly to contain it, investigate it, and notify the authorities and you where the law requires.

9.1 Reliable, certified providers and partners. We host and process personal data using established infrastructure, cloud and technology providers that we select for their reliability and security. Our core hosting and cloud infrastructure providers hold recognized certifications or independent attestations, such as ISO/IEC 27001 certification and SOC 2 reports. Before engaging a service provider or partner that will process personal data, we carry out due diligence proportionate to the risk, and we bind it by written terms that require it to keep the data confidential, protect it with appropriate security measures, use it only on our instructions and tell us promptly about any security incident. We review these providers and partners periodically.

9.2 Our security measures. We apply reasonable and appropriate technical and organizational measures, designed with reference to the risk, the nature of the data and the state of the art, to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Our information security program is aligned with ISO/IEC 27001, and our measures include encryption of data in transit, additional encryption of sensitive fields, role-based and least-privilege access to production systems, multi-factor authentication options, logical separation of each customer's data, audit logging, code review before releases, and confidentiality obligations and training for our personnel. We keep these measures under review and update them as threats and technology evolve. Our Trust Centre describes them in more detail, and further information is available to customers on request at privacy@nex.systems.

9.3 No system is completely secure. That said, no method of transmission over the internet, no method of electronic storage and no security measure is 100% secure, and risks arising from sophisticated attacks, new vulnerabilities, human error or failures of third-party systems cannot be eliminated entirely. We therefore cannot guarantee that unauthorized access, loss, disclosure or other compromise of personal data will never occur. To the extent permitted by applicable law, Nex is not responsible for any such event that occurs despite the measures described in this Section 9, or that results from causes outside its reasonable control, including the acts of third parties or the failure of a user to protect its own credentials or systems. Nothing in this Section limits any right that you have under data protection laws and that cannot be limited by agreement.

9.4 If a personal data breach occurs. If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data for which Nex is the controller, we will: (a) act promptly to contain the breach and limit its effects; (b) investigate what happened, which data and which people are affected, and the likely consequences; (c) take steps to remediate the cause and prevent a recurrence; (d) notify the competent data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it, where the law requires us to do so; (e) inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, or where the law otherwise requires; and (f) keep a record of the breach, its effects and our response.

9.5 What we will tell you. Where we are required to inform you of a breach, we will do so in clear and plain language, by email or other direct communication where we can, and will describe the nature of the breach, the likely consequences, the measures we have taken or propose to take, the steps you can take to protect yourself, and how to contact us for more information. Where individual communication would involve disproportionate effort, or the law permits it, we may instead make a public communication or use a similarly effective measure. We may delay or limit a notification where a law-enforcement or other competent authority requires it, or where necessary to complete our investigation or contain the breach.

9.6 Breaches affecting customer data. Where a breach affects personal data that we process on behalf of a customer, we notify that customer without undue delay in accordance with our Data Processing Agreement. The customer, as controller, is responsible for deciding whether and how to notify supervisory authorities and affected individuals, and Nex provides reasonable assistance as that agreement provides.

9.7 Report a concern. If you suspect that your personal data, or our Services, have been compromised, or you have found a security vulnerability, contact security@nex.systems immediately with as much detail as you can. Please do not access, change, copy or delete other people's data, disrupt our Services or disclose the vulnerability publicly while we investigate.

9.8 Your role. Security is a shared responsibility. You are responsible for keeping your account credentials, API keys and devices secure, using strong passwords and multi-factor authentication where available, limiting access within your organization to those who need it, and telling us promptly if you suspect unauthorized access to your account.

9.9 Phishing and impersonation. Nex will never ask you by email, telephone or chat to disclose your password, multi-factor authentication codes or API keys. If you receive a message that claims to come from Nex and asks for such information, or that uses a domain other than nex.systems, do not respond, and forward it to security@nex.systems. Nex is not responsible for loss caused by communications that did not come from Nex or by credentials that a user discloses to a third party.

9.10 Leaked or exposed data. If you become aware that personal data processed by Nex, or information about our Services, has been published, offered for sale or otherwise exposed without authorization, please report it to security@nex.systems with any details you hold. Do not download, copy, use or share the data. We will investigate, take reasonable steps to have it removed and follow the process in Section 9.4.

10. Your Rights and How to Exercise Them

In short: depending on where you live, you may have rights to access, correct, delete, restrict or object to the use of your personal data, and to complain to a regulator. Email privacy@nex.systems to use them.

10.1 Your rights. Subject to the conditions and exceptions in the data protection laws that apply to you, you may have the right to:

1. Access: obtain confirmation of whether we process personal data about you and a copy of it, with information about how we use it;
2. Rectification: have inaccurate personal data corrected and incomplete data completed;
3. Erasure: have your personal data deleted, for example where it is no longer necessary or where you have withdrawn consent and no other legal basis applies;
4. Restriction: ask us to limit the use of your personal data, for example while we verify its accuracy;
5. Objection: object to processing based on legitimate interests, and object at any time to direct marketing;
6. Portability: receive personal data you provided to us in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means;
7. Withdraw consent: at any time, where we rely on consent;
8. Automated decisions: not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to obtain human review; and
9. Complain: lodge a complaint with a data protection authority, in particular where you live or work or where an alleged infringement took place.

10.2 How to make a request. Email privacy@nex.systems with the subject "Privacy request", describing the right you wish to exercise and the information concerned. You may use an authorized agent where the law allows; we may ask for proof of the agent's authority.

10.3 Verification. To protect your information, we will take reasonable steps to verify your identity before responding, which may include asking you to confirm information we already hold or to provide a copy of an identification document. We use verification information only for that purpose.

10.4 Timing and cost. We will respond within one month of receiving a verified request, or within any shorter period the law requires. We may extend this period by up to two further months where requests are complex or numerous, and we will tell you if we do. We do not charge a fee, unless a request is manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable fee or decline the request, as the law permits.

10.5 Limits on rights. Rights are not absolute. We may refuse or limit a request where the law permits, for example where complying would adversely affect the rights of others, reveal confidential information of our customers, prejudice the prevention or detection of crime, breach anti-money laundering "tipping-off" rules, or where we need the data to comply with a legal obligation or to establish, exercise or defend legal claims. Section 4.9 explains specific limits for Screening Data. If we refuse a request, we will explain why, unless the law prevents us from doing so.

10.6 Requests about customer data. If your request concerns personal data that we process on behalf of a customer, Section 1.3 applies.

10.7 No discrimination. We will not treat you less favorably because you exercise your privacy rights.

11. Region-Specific Information

In short: some laws give extra rights or require extra information. This section adds what applies in particular regions; the rest of this notice applies everywhere.

11.1 European Economic Area, United Kingdom and Switzerland. Where the EU GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies: (a) Nex Global LLC is the controller of the personal data described in this notice; (b) the legal bases we rely on are set out in Section 3 and Section 4.5; (c) international transfers are safeguarded as described in Section 7; and (d) you have the rights described in Section 10, including the right to object to processing based on legitimate interests and the right to lodge a complaint with your local supervisory authority, such as the data protection authority of your EU Member State, the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner.

11.2 United States. To the extent that the California Consumer Privacy Act, as amended ("CCPA"), or a similar U.S. state privacy law applies to our processing of your personal information:

1. Categories collected. In the past 12 months we may have collected the following categories of personal information described in the CCPA: identifiers (such as name, email address and IP address); professional or employment-related information; commercial information (such as records of services requested); internet or other electronic network activity information; approximate geolocation; inferences drawn for business purposes; and, for Screening Data, categories of publicly available information and information about criminal matters published by official or media sources. The sources, purposes and recipients of each category are described in Sections 2, 3, 4 and 6.
2. Sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA, such as providing the services you request and ensuring security and integrity.
3. No sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16 years of age.
4. Your rights. You may have the right to know what personal information we have collected about you, to access it, to delete it, to correct it, to opt out of its sale or sharing, and to limit the use of sensitive personal information, as well as the right not to be discriminated against for exercising these rights. To exercise them, use the process in Section 10.2. We will confirm receipt within 10 business days and respond within 45 days, which we may extend by a further 45 days where reasonably necessary.
5. Appeals. If we decline your request, you may appeal by replying to our decision or emailing privacy@nex.systems with the subject "Privacy appeal". We will respond within the period required by the applicable state law. If your appeal is denied, you may contact your state attorney general.
6. Retention. Our retention periods are described in Section 8.
7. Publicly available information. Information that is lawfully made available from government records, or that is made available to the general public by the individual or widely distributed media, may be excluded from the definition of personal information under certain state laws.

11.3 Africa, the Middle East, Asia and other regions. Where other data protection laws apply, for example South Africa's Protection of Personal Information Act, Nigeria's Data Protection Act 2023 or Kenya's Data Protection Act 2019, you have the rights those laws provide, which are generally similar to the rights in Section 10, including the right to complain to the competent data protection authority or Information Regulator. Where those laws require us to register with an authority or provide additional information, we will do so and update this notice accordingly.

12. Cookies, Marketing, Children and Third-Party Links

In short: we use cookies and similar technologies as described in our Cookie Policy; we send business marketing only where the law allows, and you can opt out at any time; our services are not intended for children; and we are not responsible for third-party websites.

12.1 Cookies and similar technologies. Our websites use only strictly necessary cookies and similar technologies (together, "cookies"), which are needed to operate the website, keep it secure, prevent abuse of our Free Tools and support login to the Services. They are placed because they are strictly necessary for a service you have requested or on the basis of our legitimate interests, and do not require consent. We do not use cookies for analytics, advertising, cross-site tracking or profiling, and we do not use cookies to collect email addresses or other contact details. If we decide to introduce any other type of cookie in the future, we will do so only where permitted by applicable law and with your prior consent where the law requires it, and we will update our Cookie Policy before doing so. The cookies we use, their purposes and their duration are described in our Cookie Policy at nex.systems/legal, which forms part of this Privacy Notice.

12.2 Managing cookies. If we use cookies that require consent, you may accept, reject or withdraw consent at any time through the cookie settings we provide. You may also control cookies through your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. If you block strictly necessary cookies, parts of the website or the Services may not function properly.

12.3 Browser signals. Where required by applicable law, we treat a recognized opt-out preference signal sent by your browser, such as Global Privacy Control, as a valid request to opt out of any processing that applicable law treats as a sale of personal information or sharing for cross-context behavioral advertising, for the browser or device that sends the signal. We do not sell personal information.

12.4 Business marketing. We may send marketing communications about our Services, events, publications and regulatory updates to business contacts, customers and prospective customers. We do so (a) on the basis of our legitimate interests in promoting our business to professional audiences, where applicable law permits business-to-business marketing without prior consent; or (b) with your consent, where applicable law requires it. We never use Screening Data, or any personal data that we process as a processor on behalf of our customers, for marketing.

12.5 Opting out. You may opt out of marketing communications at any time by using the unsubscribe link in any marketing email, by updating your preferences where that option is available, or by writing to privacy@nex.systems. We will act on your request promptly and within any period required by law. After you opt out, we may keep a minimal record of your contact details on a suppression list so that we do not contact you again, and we will continue to send service, security, billing, legal and other transactional communications that are necessary for your account or relationship with us.

12.6 Events and webinars. If you register for an event or webinar that we organize or co-host, we use your registration details to manage your participation. Where an event is co-hosted with a partner, we will tell you at registration if your details will be shared with that partner, and the partner's own privacy notice will apply to its use of them.

12.7 Children. Our websites and Services are intended for businesses and professional users and are not directed to children. We do not knowingly collect personal data through our websites, Free Tools or account registration from anyone under the age of eighteen (18), or any higher age required by applicable law. If you believe that a child has provided personal data to us through these channels, please contact privacy@nex.systems and we will take reasonable steps to delete it. This Section does not apply to personal data relating to minors that may be included in Screening Data, or in Customer Data that our customers process using the Services as controllers; that processing is described in Section 4 or is governed by our customers' own privacy notices and the Data Processing Agreement.

12.8 Third-party websites and services. Our websites and Services may contain links to, or integrations with, websites, applications and services operated by third parties, including identity providers, cloud services and other tools that customers choose to connect. We do not control those third parties and are not responsible for their content, security or privacy practices. When you follow a link or enable an integration, the third party's own terms and privacy notice apply to its processing of your personal data, and we encourage you to read them. The appearance of a third-party name or logo on our websites does not mean that the third party endorses us or that we endorse it.

12.9 Social media. If you interact with our pages on professional networks or social media platforms, the operator of that platform processes your personal data under its own privacy notice. Where we and the platform operator act as joint controllers for page statistics or similar features, the platform's terms describe how responsibilities are allocated, and you may exercise your rights with the platform operator or with us.

13. Changes, Contact and Complaints

In short: we may update this Privacy Notice and will publish each version with its date; please check it regularly. Contact privacy@nex.systems with any question or request, and security@nex.systems to report a security concern. You may also complain to a data protection authority.

13.1 Changes to this Privacy Notice. We may update this Privacy Notice from time to time to reflect changes in our Services, our processing activities, legal or regulatory requirements, or guidance from supervisory authorities. The current version is published at nex.systems/legal, and previous versions are available on request. Where we make a material change, we will take reasonable steps to bring it to your attention before it takes effect, for example by a notice on our website, within the Services or by email to account holders. Where applicable law requires your consent to a change, we will ask for it. We encourage you to review this Privacy Notice regularly.

13.2 Relationship with other documents. This Privacy Notice should be read together with our Cookie Policy and, for customers, our Terms of Service and Data Processing Agreement. It does not create contractual rights or obligations between you and Nex beyond those provided by applicable law. If this Privacy Notice conflicts with the Data Processing Agreement concerning personal data that we process on behalf of a customer, the Data Processing Agreement prevails as between Nex and that customer.

13.3 How to contact us. For any question about this Privacy Notice, or to exercise your rights under Section 10, please contact:

• Privacy and data protection: privacy@nex.systems
• Security incidents and vulnerability reports: security@nex.systems
• Legal notices: legal@nex.systems
• Postal address: Nex Global LLC, Attn: Privacy, 1621 Central Ave #69914, Cheyenne, WY 82001, United States of America

Please include enough information for us to identify you and understand your request, but do not send identity documents or other sensitive information unless we ask for them through a secure channel.

13.4 Privacy function. Nex has designated a privacy function responsible for overseeing compliance with this Privacy Notice and for handling questions, requests and complaints about the processing of personal data. It can be reached at privacy@nex.systems.

13.5 Complaints to us. If you are concerned about how we have handled your personal data, please contact us first at privacy@nex.systems so that we can try to resolve your concern. We will acknowledge your complaint, investigate it and respond within the period required by applicable law, and in any case within one (1) month where the GDPR or the UK GDPR applies, extendable where permitted by law.

13.6 Complaints to a supervisory authority. You have the right to lodge a complaint with a data protection supervisory authority at any time, without affecting any other administrative or judicial remedy. In particular:

• in the European Economic Area, with the supervisory authority of the Member State in which you live, work or where the alleged infringement took place;
• in the United Kingdom, with the Information Commissioner's Office (ico.org.uk);
• in Switzerland, with the Federal Data Protection and Information Commissioner (edoeb.admin.ch);
• in South Africa, with the Information Regulator;
• in Nigeria, with the Nigeria Data Protection Commission;
• in Kenya, with the Office of the Data Protection Commissioner; and
• in any other country, with the data protection authority that has jurisdiction over your personal data.

In the United States, you may contact the privacy regulator or Attorney General of your state of residence where your state's law provides for this.

13.7 Language. This Privacy Notice is written in English. If we provide a translation, the English version prevails to the extent permitted by applicable law.

Nex Global LLC, trading as Nex Systems, 1621 Central Ave #69914, Cheyenne, WY 82001, USA.

End of Nex Systems Privacy Notice.