Privacy Policy
Last updated: September 2026
Data controller
The controller responsible for data processing under the EU General Data Protection Regulation (GDPR) is [COMPANY NAME], [Address]. You can reach us at contact@nexoffice.org.
What data we process
We process account data (name, email address, password hash), company and business data you enter (customers, invoices, products, accounting records), usage and log data (IP address, timestamps, browser), and payment data processed by our payment provider.
Purposes and legal basis
We process your data to provide the service and perform our contract with you (Art. 6(1)(b) GDPR), to comply with legal obligations such as accounting and tax retention (Art. 6(1)(c) GDPR), and on the basis of our legitimate interest in the security and improvement of the service (Art. 6(1)(f) GDPR).
Processors and third parties
Payments are processed by Stripe Payments Europe Ltd. Email is sent from our own mail infrastructure. The application is hosted on our server in the EU. These providers act as processors under data-processing agreements and only process data on our instructions. We do not sell your data.
Cookies
We use technically necessary cookies to keep you signed in and to operate the service. Our live-chat provider (Crisp) may set cookies when you open the chat. We do not use advertising cookies.
Data retention
We keep your data for as long as your account exists. Invoicing and accounting records are retained for the statutory retention periods. After deletion of your account, remaining data is erased unless a legal obligation requires further retention.
Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. You may withdraw consent at any time and lodge a complaint with your competent data protection supervisory authority. To exercise your rights, contact contact@nexoffice.org.
Data security
We use encryption in transit (TLS), hashed passwords and access controls to protect your data against unauthorised access, loss or misuse.