Nashua B.V. and Nashua Cloud B.V. are the controllers for the Personal Data described in this policy where we determine the purposes and means of processing. You can reach us at Lichttoren 32, 5611 BJ Eindhoven, the Netherlands, at info@nashua.nl, or for privacy matters at privacy@nashua.nl.

This policy covers Personal Data we process as a controller: data about visitors to our website, prospective and actual clients and their staff, candidates, suppliers and business contacts. Where we process Personal Data on behalf of a client, for example when a client uses the Platform or our managed services, the client is the controller and we act as processor. That processing is governed by our Data Processing Agreement rather than by this policy.

It matters in which role we act. As a controller we decide why and how Personal Data is processed, for example for our own marketing, recruitment and administration. As a processor we process Personal Data only on the documented instructions of our client, under the Nashua Data Processing Agreement, which sets out the subject matter, the security measures, the use of sub-processors, international transfers, breach notification and the assistance we provide. Where you are an individual whose data a client processes on the Platform, please address your requests to that client as controller.

As a controller we may process: identity and contact details (name, role, employer, email, telephone); correspondence and the content of enquiries; contractual and financial data for clients and suppliers; recruitment data for candidates (such as a CV and application correspondence); and technical data from our website, such as IP address, device and browser information and interaction data. We do not seek to collect special categories of Personal Data through our website and ask that you do not send such data to us unsolicited.

We process Personal Data to: enter into and perform agreements (Article 6(1)(b) GDPR); pursue our legitimate interests in operating, securing and marketing our business, always weighed against your interests (Article 6(1)(f)); comply with legal obligations such as tax and accounting duties (Article 6(1)(c)); and, where required, on the basis of your consent, which you may withdraw at any time (Article 6(1)(a)). We send commercial communications only where permitted, and every marketing message offers an easy way to opt out.

Our website uses functional cookies that are necessary for it to work, and, where you consent, analytics that help us understand and improve how the site is used. You can manage cookies through your browser settings. Where analytics or third-party services set non-essential cookies, we ask for your consent first, in line with the Dutch Telecommunications Act and the GDPR.

We share Personal Data only where necessary: with service providers that support our business (such as hosting, communication and administration providers), who process it on our behalf under written agreements; with professional advisers; and with authorities where we are legally required to do so. We do not sell Personal Data. Where a provider processes Personal Data on our behalf, we bind it to obligations equivalent to those in Article 28 GDPR.

We prefer to keep Personal Data within the European Economic Area and host on infrastructure located in the Netherlands and the EEA. Where a transfer outside the EEA is unavoidable, we rely on an adequacy decision of the European Commission or on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses together with any additional measures required, and we make information about such transfers available on request.

We keep Personal Data no longer than necessary for the purposes for which it was collected, or as required by law. Contractual and financial records are kept for the statutory retention period, which for tax purposes in the Netherlands is seven years. Recruitment data is kept for the duration of a procedure and, with consent, for a limited period thereafter. Website and analytics data is kept for a limited period and then deleted or aggregated.

We maintain a documented information-security programme with technical and organisational measures appropriate to the risk, aligned to ISO/IEC 27001 and to the SOC 2 Trust Services Criteria, and we are preparing for formal certification and attestation across the relevant SOC 2 report types. Our measures include access control and least privilege, encryption in transit and at rest, network segmentation, logging and monitoring, secure development and change management, vulnerability management, backup and tested recovery, and staff awareness. As a provider of digital services we take account of our obligations under the Digital Operational Resilience Act (DORA) and the NIS2 Directive as implemented in Dutch law, including operational resilience, supplier risk management and incident reporting.

The Nashua 360 Enterprise Platform includes AI capabilities that operate under human oversight and within defined permissions. We do not subject individuals to decisions based solely on automated processing that produce legal or similarly significant effects without a lawful basis and appropriate safeguards. Where AI is used to assist our own processes, a human remains accountable for the outcome.

Under the GDPR you have the right to access your Personal Data and to obtain a copy; to rectification of inaccurate data; to erasure in certain circumstances; to restriction of processing; to data portability; and to object to processing based on our legitimate interests or to direct marketing. Where processing is based on consent, you may withdraw it at any time without affecting prior processing. To exercise a right, contact privacy@nashua.nl. We respond within one month, and may ask for information to verify your identity.

If you have a concern about how we handle your Personal Data, please contact us first so we can help. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your country of residence or work.

We may update this policy to reflect changes in our processing or in the law. The current version, with its date, is published at this address. Material changes will be brought to your attention where appropriate.

For any question about this policy or about how we process your Personal Data, contact us at privacy@nashua.nl or by post at Lichttoren 32, 5611 BJ Eindhoven, the Netherlands.