Privacy Policy

1. INTRODUCTION

NX10.ME LTD (“NX10”, “we”, “us” or “our”) provides analytics and insights services (“Services”) to our clients (“Clients”) who integrate our technology into their mobile applications (“Apps”).

This privacy policy (“Privacy Policy”) applies if you are an end user of such Apps (“End User”). It explains what personal data we collect from your device, how we use it, and the rights available to you.

We may update this Privacy Policy from time to time to reflect any changes or proposed changes to our use of personal data, or to comply with changes in applicable law or regulatory requirements. We encourage End Users to review this Privacy Policy periodically to keep up to date.

2. WHO WE ARE AND CONTACTING US

We are NX10.ME LTD, a company registered in England and Wales under company number 13746822. Our registered office is at Africa House, 70 Kingsway, London, United Kingdom, WC2B 6AH.

NX10.ME LTD is the data controller responsible for your personal data and is registered with the Information Commissioner’s Office (Registration No: ZC135635).

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about our use of personal data, you can contact us at:

3. ABOUT OUR TECHNOLOGY AND OUR APPROACH TO PRIVACY

NX10 provides an analytics and insights platform and software development kit (“SDK”) that Clients integrate into their Apps. Our SDK collects limited technical information from End User devices for the purposes described in this Privacy Policy.

We care about the privacy of End Users and want to be clear about the nature and limits of our data collection:

4. WHAT DATA WE COLLECT AND WHY

We process the following categories of data in connection with our Services:

We process the data described above for the following purposes:

• Generating analytical insights – to generate insights about End Users' interaction patterns, including by analysing data collected by our SDK in combination with any Contextual Application Data received from the Client. Outputs may include indices and scores relating to patterns of device handling, interaction intensity, and behavioural context – for example, identifying whether an End User's pattern of interaction suggests a shift from relaxed engagement to a more agitated or impulsive state.
• Providing Services to Clients – analytical outputs relating to End Users' use of an App are made available to the Client whose App End Users are using, so that the Client can make informed decisions about its App and its End Users. For example, a Client may use the information that we provide to adjust the experience for one or more End Users. NX10 does not decide what action, if any, the Client takes.
• Improving our technology - to train and improve our machine learning models and analytics platform, including to develop new features and enhance the accuracy of our analytical outputs, including by using aggregated and pseudonymised data to improve our models generally.
• Business administration and legal compliance – to comply with our legal and regulatory obligations, to enforce our legal rights, to defend against legal claims, to protect the rights of third parties, or to facilitate a business transition such as a merger, reorganisation, acquisition by another company, or sale of any of our assets.

5. OUR LEGAL BASIS

We rely on the following legal bases for processing your personal data for the purposes described above:

6. SHARING PERSONAL DATA

We only share personal data with third parties when we are legally permitted to do so. When we share personal data with others, we put contractual arrangements in place to protect the personal data and to maintain the confidentiality and security of it. We do not sell personal data to third parties.

The circumstances where we may typically share personal data are set out below, though there may be other circumstances where we need to share personal data that are not set out below:

• The Client – we share analytical outputs (such as indices, scores, and behavioural context indicators), together with the unique identifier assigned to the End User's device, with the Client whose App End Users are using, as necessary for the provision of our Services. Where we have received Contextual Application Data, that data may also be presented back to the Client alongside our analytical outputs. We do not share the underlying raw data collected by our SDK (such as raw sensor telemetry) with the Client.

  Note, the Client may use the information that we share with it in accordance with its own privacy policy. NX10 does not control how the Client uses this information and is not responsible for the Client's privacy practices.

• Third-party suppliers who provide applications, functionality, data processing or IT services – we share personal data with third parties who support us in providing our Services and help provide, run and manage our internal IT systems. Such third parties may include providers of information technology services, cloud-based infrastructure, hosting and storage providers, data processing and system monitoring services. See the International Transfers of Personal Data section for more information about where personal data is processed.
• Auditors, lawyers, accountants and other professional advisers – we share personal data with professional services firms who advise and assist us in relation to the lawful and effective management of our organisation and in relation to any disputes we may become involved in.
• Law enforcement or other government and regulatory agencies and bodies – we share personal data with law enforcement or other government and regulatory agencies or other third parties as required by, and in accordance with, applicable law or regulation.
• Business partners – we may also disclose personal data to third parties if we sell or buy any business or assets, in which case we may disclose personal data to the prospective seller or buyer of such business or assets, or if we or substantially all our assets are acquired by a third party, in which case personal data held by us will be one of the transferred assets.
• Other third parties - occasionally, we may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, or to establish, exercise or defend legal rights. We will only fulfil requests for personal data where we are permitted to do so in accordance with applicable law or regulation.

7. INTERNATIONAL TRANSFERS OF PERSONAL DATA

We are based in the UK, and the data collected through our technology is hosted and processed on cloud infrastructure located in the European Union. The UK recognises the EU as providing an adequate level of protection for personal data, so these transfers do not need additional safeguards.

Occasionally, personal data may be transferred to third parties (as described in the Sharing personal data section) that are located in countries that do not have data protection laws that protect personal data to the same standard as the data protection laws that apply to us in the UK. These third countries may not give you the same rights as those described in the Your rights section, and may not have a data protection supervisory authority to help you if you have any concerns.

When transferring personal data to third countries, we usually rely on one of the following:

• Adequacy decisions – we may transfer your personal data to countries or organisations that have been deemed to provide an adequate level of protection for personal data by the UK Government or any other relevant government body. This may include transfers to organisations that participate in the Data Privacy Framework listed here.
• Contractual safeguards – we may use specific contracts approved by the UK Government or any other relevant governmental body to safeguard personal data. The contracts that we usually rely on are referred to as “Standard Contractual Clauses” or “SCCs”, although we may from time to time use other approved mechanisms. To find out more about the SCCs we use, please see here (UK) and here (EU). You can also contact us using the contact details set out in the Who we are and contacting us section.

8. PERSONAL DATA OF CHILDREN

We do not intentionally collect personal data from children (individuals under the age of 18). However, due to the nature of our business and our Clients’ Apps, we may process personal data relating to children. If you are a parent or guardian and believe we have collected personal data from a child, you can contact us using the details in the Who we are and contacting us section.

9. INFORMATION SECURITY

We are committed to keeping personal data secure and we have implemented information security policies, rules and technical and organisational measures to protect personal data under our control from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction or accidental loss.

In particular we have implemented the following:

In addition, our personnel and any third parties that process personal data on our behalf are required to respect the confidentiality of personal data that we are responsible for.

10. HOW LONG WE KEEP YOUR PERSONAL DATA

Data collected through our SDK is retained for as long as reasonably necessary for the purposes described in this Privacy Policy. In most instances, this period will not exceed ten years, but we may delete or anonymise data sooner where it is no longer needed. Where data has been used to train or improve our machine learning models, it may not be possible to remove its influence from those models after training.

We may retain data for longer periods where reasonably necessary to comply with legal obligations, resolve disputes, enforce agreements, or maintain security.

When data is no longer needed, we securely delete it or anonymise it in accordance with our policies. Aggregated and anonymised information may be retained for longer because it no longer relates to an identifiable individual.

11. YOUR RIGHTS

You have the following rights in relation to your personal data:

• Your right of access – if you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may charge a reasonable fee for producing those additional copies.
• Your right to rectification – if the personal data we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If we have shared your personal data with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we will also tell you who we’ve shared your personal data with so that you can contact them.
• Your right to erasure – you can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it or where you withdraw your consent (where applicable). If we have shared your personal data with others, we will let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we will also tell you who we have shared your personal data with so that you can contact them directly.
• Your right to restrict processing – you can ask us to “block” or suppress the processing of your personal data in certain circumstances such as where you contest the accuracy of that personal data or you object to us processing it for a particular purpose. This may not mean that we will stop storing your personal data but, where we do keep it, we will tell you if we remove any restriction that we have placed on your personal data to stop us processing it further. If we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.
• Your right to data portability – you have the right, in certain circumstances, to obtain personal data you have provided to us (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer it to your chosen third party.
• Your right to object – you can ask us to stop processing your personal data, and we will do so, if we are: (i) relying on our own or someone else’s legitimate interest to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or (ii) processing your personal data for direct marketing purposes.
• Your rights in relation to automated decision-making and profiling – to the extent we make a decision about you based solely on automated processing, including profiling, that has a legal or other similarly significant effect on you, we will provide you with meaningful information about how any such decision is reached and what it means for you. We will only make such decisions where we are permitted by law to do so. Where we do, you will have the right to obtain meaningful human involvement, to express your point of view, and to contest the decision.
• Your right to withdraw consent – if we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time by using the consent mechanism made available through the Client's App. If you withdraw your consent, we will stop collecting data from your device in connection with that Client's App. If you use other Apps that also integrate our technology, your consent in relation to those Apps is managed separately.
• Your right to complain to us – if you believe that our processing of your personal data does not comply with applicable privacy laws or you otherwise have a concern about the way we have handled your personal data, you have the right to complain to us. Once we receive your complaint, we will acknowledge receipt within 30 days. We will then take appropriate steps to investigate the matters you have raised and will keep you informed of our progress. We will notify you of the outcome of your complaint without undue delay.
• Your right to complain to a supervisory authority – in addition to your right to complain to us, you have the right to complain to a supervisory authority if you believe our processing of your data does not comply with applicable data protection law. As we are incorporated in the United Kingdom, our main supervisory authority is the Information Commissioner’s Office (“ICO”). You can complain to the ICO by visiting https://ico.org.uk/make-a-complaint/. If you are located, or believe our infringement took place, in the European Economic Area, you can also complain to a national supervisory authority of the Member State in which you either reside or where the infringement took place. You can find a list of contact details for EEA supervisory authorities at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.