Nuvio Loyalty Privacy Policy

1. This Privacy Policy sets out the rules for processing personal data in connection with the use of the Nuvio Loyalty system, in particular registration, operation of the Client Account, subscription management, billing, technical support and integrations available in the system.
2. The controller of personal data is TRIKPAY SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Wrocław (52-326), ul. Eugeniusza Kwiatkowskiego 4/3, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000878223, NIP: 8943162789, REGON: 387922478 (the “Controller”).
3. This Policy applies to businesses entering into an agreement with the Controller, persons representing those businesses and persons authorised to use the Client Account.
4. Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and applicable national legislation.

§ 1 Scope of personal data processed

1. The Controller may process identification and contact data, in particular first and last name, e-mail address, telephone number, company name, business or registered-office address, country, NIP or EU VAT ID and the person’s role within the company.
2. In connection with the Client Account, user identifiers, login and authentication data, team-member roles and permissions, account-change history and information about active sessions may be processed.
3. In connection with entering into and performing the agreement, the Controller may process details of the selected plan, subscription status, billing history, invoice data, payment identifiers and payment status information. The Controller does not store full payment-card details handled by an external payment provider.
4. When technical support is used, data contained in tickets, messages and attachments may be processed, as well as the contact history and actions taken to resolve the ticket.
5. When the system is used, technical and security data may be processed, in particular the IP address, access date and time, device type, operating system, browser, session identifiers, login history, error logs and security events.
6. If the Client uses the affiliate programme, integrations or payment services, the Controller may process referral-attribution data, integration settings, connection status and identifiers assigned by an external provider.

§ 2 Purposes and legal bases of processing

1. Creation and operation of the Client Account, entering into and performing the agreement, providing system functionality and managing subscriptions and integrations — Article 6(1)(b) GDPR.
2. Verification of persons representing the Client and management of team-member access — Article 6(1)(f) GDPR, namely the legitimate interests of the Controller and the Client in properly conducting the cooperation and controlling access.
3. Billing, issuing and retaining accounting documents and compliance with tax obligations — Article 6(1)(c) GDPR in conjunction with applicable tax and accounting legislation.
4. Handling enquiries, technical tickets and complaints — Article 6(1)(b) or Article 6(1)(f) GDPR, depending on the nature of the matter.
5. Ensuring system security, preventing abuse, diagnosing errors, maintaining service continuity and establishing, pursuing or defending claims — Article 6(1)(f) GDPR.
6. Analysing how the system is used and developing its functionality — Article 6(1)(f) GDPR and, for technologies requiring consent, Article 6(1)(a) GDPR.
7. Sending commercial information or carrying out marketing activities — on the basis of consent where required by applicable law. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

§ 3 Recipients of personal data and external services

1. Data may be disclosed to entities supporting the Controller in providing the services, in particular providers of hosting, cloud infrastructure, databases, authentication, e-mail, security monitoring and technical support.
2. Payment and billing data may be disclosed to payment providers, in particular Stripe and, where the relevant services are enabled, Worldline, as well as to accounting and legal service providers.
3. Where functions connected with Apple Wallet or Google Wallet are used, necessary technical and configuration information may be disclosed to Apple or Google to the extent required for the selected service to operate.
4. Data may be disclosed to public authorities or other authorised entities where required by law.
5. Some providers may process data outside the European Economic Area. In such cases, the Controller uses mechanisms required by Chapter V GDPR, in particular adequacy decisions or standard contractual clauses, depending on the basis for the relevant transfer.

§ 4 Cookies, analytics and marketing technologies

1. The system uses cookies and similar technologies necessary for login, session maintenance, remembering settings, ensuring security and the correct operation of the Client Account.
2. Cookies may also be used to remember information about the referral and affiliate campaign from which the user accessed the system.
3. Google Ads and Meta Pixel may be used in the system to measure marketing effectiveness, analyse conversions and create statistics. Their providers may receive technical information, including IP address, device or browser identifiers and information about events in the system.
4. The user may restrict cookies in the browser settings. Disabling necessary cookies may prevent login or use of some system functions.

§ 5 Retention period

1. Data connected with the Client Account and performance of the agreement is retained for the term of the agreement and subsequently for the period necessary to settle the cooperation and defend against claims.
2. Accounting, tax and billing documents are retained for the period required by applicable law.
3. Ticket and correspondence data is retained until the matter is closed and subsequently for a period justified by the possibility of pursuing or defending claims.
4. Technical and security logs are retained for the period necessary to ensure security, diagnose incidents and prevent abuse.
5. Data processed on the basis of consent is retained until the consent is withdrawn or the purpose of processing ceases earlier, subject to retaining limited information needed to demonstrate the granting or withdrawal of consent.
6. Data may remain in backups for a limited period in accordance with their secure overwrite cycle.

§ 6 Rights of data subjects

1. To the extent provided for by the GDPR, the data subject has the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on Article 6(1)(f) GDPR.
2. Where processing is based on consent, it may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.
3. A request to exercise these rights may be sent to iod@nuvio.group. The Controller may verify the requester’s identity before fulfilling the request.
4. The data subject has the right to lodge a complaint with the President of the Polish Personal Data Protection Office or another competent supervisory authority in a Member State of the European Union.

§ 7 Voluntary provision of data and automated decisions

1. Providing data is voluntary, but data marked as required is necessary to create the Client Account, enter into or perform the agreement, complete billing or handle a ticket.
2. The Controller does not make decisions concerning Client Account users based solely on automated processing that produce legal effects or similarly significantly affect them.

§ 8 Changes to the Privacy Policy and contact

1. This Policy may be updated due to changes in law, the operation of the system or external services used. The current version is published on the Nuvio website.
2. Privacy questions should be sent to iod@nuvio.group, while other questions about the service should be sent to sales@nuvio.group.

Last updated: 24.02.2026