NIZU OÜ — NIZU WorkSpace GDPR Policy

General Data Protection Regulation (GDPR) Compliance Framework

Table of Contents

1. Scope, Purpose and Legal Framework
2. Scope of This Policy — Exclusions and Boundaries
3. Client Administrator Responsibility
4. Lawful Bases and Categories of Data Processed by NIZU
5. Data Subject Rights
6. Transfers of Personal Data
7. Data Security
8. Cookies and Tracking Technologies
9. Data Protection Officer
10. Amendments to This Policy
11. Governing Law and Dispute Resolution
12. Contact Information

1. Scope, Purpose and Legal Framework

1.1 Purpose

This Data Protection and Privacy Policy (hereinafter: "GDPR Policy" or "Policy") is issued by NIZU OÜ (hereinafter: "NIZU", "Company", "we", or "Data Controller"), a private limited company duly incorporated under the laws of the Republic of Estonia.

This Policy governs the processing of personal data of users of the NIZU WorkSpace platform (hereinafter: the "Platform" or "Service"), strictly in the capacity of individual end-users interacting with the Platform interface. It establishes the rights, obligations and protections afforded exclusively to such users under applicable law.

1.2 Governing Legal Framework

This Policy is drafted and enforced exclusively in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation — GDPR);
• Directive 2002/58/EC (ePrivacy Directive), as amended;
• Estonian Personal Data Protection Act (isikuandmete kaitse seadus — IKS), as in force;
• Estonian Information Society Services Act (infoühiskonna teenuse seadus);
• Any binding guidance issued by the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon — AKI);
• Any binding decisions or guidelines of the European Data Protection Board (EDPB).

⚠️ JURISDICTIONAL LIMITATION — IMPORTANT

NIZU OÜ is incorporated in and operates under the legal framework of the Republic of Estonia and the European Union. No other national legal system, foreign court, foreign regulatory authority, or foreign legislative framework is recognised as governing, supplementary, or persuasive in relation to this Policy or any dispute arising therefrom. Any reference to, or claim arising from, any foreign jurisdiction is hereby expressly excluded.

1.3 Definitions

For the purposes of this Policy, the following definitions apply:

• "Client" means any legal entity or natural person (acting in a commercial capacity) that has entered into a service agreement with NIZU for the use of NIZU WorkSpace;
• "Client Workspace" means the isolated, subscription-based digital environment provisioned to a Client within the Platform;
• "Client Administrator" means the individual(s) designated by a Client to manage and configure its Client Workspace, including all data protection settings therein;
• "End-User" or "User" means a natural person who accesses the Platform directly through the NIZU-provided interface, whether as a registered individual or as an invited member of a Client Workspace;
• "Personal Data" has the meaning ascribed to it under Article 4(1) GDPR;
• "Processing" has the meaning ascribed to it under Article 4(2) GDPR;
• "Data Controller" means NIZU OÜ, in its capacity as the entity determining the purposes and means of processing personal data at the platform level;
• "Data Processor" means an entity processing personal data on behalf of a Controller;
• "Sub-processor" means any third-party processor engaged by NIZU in connection with the delivery of the Service.

2. Scope of This Policy — Exclusions and Boundaries

2.1 What This Policy Covers

This Policy applies exclusively to the processing of personal data of End-Users at the platform level, specifically:

• Account registration and authentication data;
• Platform usage data (log-ins, session metadata, feature interactions);
• Communications submitted through NIZU-operated support channels;
• Technical identifiers necessary for Platform security and service delivery.

2.2 Explicit Exclusions

⚠️ THIS POLICY EXPRESSLY DOES NOT APPLY TO THE FOLLOWING:

• Fiscal, financial, tax or billing information of any Client or User. Such data is governed by applicable tax and accounting law and separate contractual arrangements;
• Data processed within a Client Workspace by the Client or Client Administrator. The Client is the sole Data Controller for all data processed within its Workspace;
• GDPR settings, data retention configurations, or consent management mechanisms activated, deactivated or modified by a Client Administrator within the Client's Workspace;
• The personal data of Client employees, contractors, or third parties processed by the Client through the Platform in the capacity of a Controller.

NIZU does not access, review, modify or take responsibility for any data processed by a Client within a Client Workspace, except where strictly necessary to maintain Platform security, integrity or legal compliance, and solely in its capacity as a Data Processor acting on documented instructions.

3. Client Administrator Responsibility

3.1 The Client as Independent Data Controller

Where a Client activates, configures or operates any data processing feature, GDPR compliance toggle, retention policy, consent mechanism or other privacy-relevant setting within its Client Workspace, the Client acts as an independent Data Controller for the purposes of the GDPR.

In such circumstances, NIZU acts solely as a Data Processor under Article 28 GDPR, processing personal data strictly on the instructions of the Client, as documented in the Data Processing Agreement (hereinafter: "DPA") concluded between NIZU and the Client.

3.2 Client Administrator's Sole Responsibility

The Client Administrator bears sole and exclusive legal responsibility for:

• All GDPR-related settings activated or deactivated within the Client Workspace;
• The lawfulness of any personal data processing carried out by or through the Client Workspace;
• Ensuring that appropriate legal bases under Article 6 GDPR (and, where applicable, Article 9 GDPR) exist for all processing operations conducted within the Workspace;
• Providing required notices and obtaining necessary consents from End-Users added to the Client Workspace;
• Ensuring data retention, deletion and portability obligations are fulfilled in respect of data processed within the Workspace;
• Any compliance failures, regulatory sanctions, third-party claims or damages arising from the configuration or use of GDPR-related settings within the Client Workspace.

★ NIZU LIABILITY EXCLUSION

NIZU OÜ accepts no liability, whether contractual, tortious or statutory, for any failure by a Client or Client Administrator to comply with applicable data protection law in relation to the configuration or use of a Client Workspace. Any regulatory investigation, penalty or civil claim arising from Client Workspace data processing is the sole responsibility of the Client.

4. Lawful Bases and Categories of Data Processed by NIZU

4.1 Data Processed at Platform Level

NIZU processes the following categories of personal data of End-Users at the platform level:

4.2 Special Categories of Data

NIZU does not intentionally collect or process special categories of personal data as defined in Article 9 GDPR (including but not limited to health data, biometric data, racial or ethnic origin, political opinions, or religious beliefs) at the platform level. Users must not submit such data through platform-level interfaces. Any such data submitted without authorisation by a User is processed exclusively on the basis of explicit consent under Article 9(2)(a) GDPR, and may be deleted upon identification.

5. Data Subject Rights

5.1 Rights of End-Users

End-Users whose personal data is processed by NIZU at the platform level are entitled to exercise the following rights under the GDPR:

1. Right of Access (Art. 15 GDPR): Users may request confirmation of whether personal data is processed and, if so, obtain a copy thereof.
2. Right to Rectification (Art. 16 GDPR): Users may request correction of inaccurate personal data without undue delay.
3. Right to Erasure (Art. 17 GDPR): Users may request deletion of personal data where the processing no longer has a lawful basis, subject to statutory retention obligations.
4. Right to Restriction (Art. 18 GDPR): Users may request restriction of processing in specified circumstances.
5. Right to Data Portability (Art. 20 GDPR): Where processing is based on consent or contract and carried out by automated means, Users may receive their data in a structured, commonly used, machine-readable format.
6. Right to Object (Art. 21 GDPR): Users may object to processing based on legitimate interests, including profiling.
7. Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on consent, Users may withdraw consent at any time without affecting the lawfulness of prior processing.
8. Right to Lodge a Complaint: Users may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia; or any other competent supervisory authority within the EU/EEA.

5.2 Scope Limitation of User Rights

⚠️ IMPORTANT LIMITATION ON USER RIGHTS

The rights enumerated in Section 5.1 apply exclusively to personal data processed by NIZU OÜ at the platform level. User rights in relation to personal data processed within a Client Workspace must be directed to the relevant Client Administrator, who acts as the Data Controller for such processing. NIZU is not in a position to fulfil such requests directly and accepts no liability for a Client's failure to respond to data subject rights requests.

5.3 Exercising Rights

Requests to exercise data subject rights in relation to NIZU platform-level processing must be submitted to:

• Email: legal@nizu.io
• Subject line: GDPR Data Subject Request

NIZU shall respond to verified requests within one (1) calendar month of receipt. This period may be extended by a further two (2) months where necessary, in accordance with Article 12(3) GDPR, with notification to the requester.

6. Transfers of Personal Data

6.1 Intra-EEA Processing

To the extent possible, NIZU processes personal data within the European Economic Area (EEA). Where data is transferred to sub-processors, such transfers are subject to appropriate contractual safeguards in accordance with Chapter V GDPR.

6.2 Third-Country Transfers

Where personal data is transferred to a third country (outside the EEA), NIZU ensures that an appropriate transfer mechanism is in place, including but not limited to:

• An adequacy decision by the European Commission pursuant to Article 45 GDPR;
• Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Article 46(2)(c) GDPR;
• Binding Corporate Rules approved in accordance with Article 47 GDPR.

No transfer of personal data shall be made to a third country in the absence of an appropriate safeguard. A list of third-country sub-processors and applicable transfer mechanisms is available upon written request to legal@nizu.io.

7. Data Security

7.1 Technical and Organisational Measures

NIZU implements appropriate technical and organisational measures pursuant to Article 32 GDPR to ensure a level of security appropriate to the risk of processing, including:

• Encryption of personal data at rest and in transit (minimum TLS 1.2);
• Access controls and authentication mechanisms, including multi-factor authentication for administrative access;
• Regular testing and evaluation of the effectiveness of security measures;
• Pseudonymisation where technically feasible and appropriate;
• Business continuity and disaster recovery procedures.

7.2 Data Breach Notification

In the event of a personal data breach as defined in Article 4(12) GDPR, NIZU shall:

• Notify the Estonian Data Protection Inspectorate (AKI) without undue delay, and where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR;
• Notify affected End-Users without undue delay where the breach is likely to result in a high risk to their rights and freedoms, in accordance with Article 34 GDPR;
• Maintain internal records of all personal data breaches, including facts, effects and remedial actions, in accordance with Article 33(5) GDPR.

8. Cookies and Tracking Technologies

NIZU uses cookies and similar tracking technologies on the Platform in accordance with the ePrivacy Directive and applicable Estonian law. Cookies used by NIZU are limited to:

• Strictly necessary cookies: Required for the operation of the Platform and exempt from consent requirements;
• Analytical cookies: Used to measure platform performance and improve service quality, deployed only upon User consent;
• Functional cookies: Used to enable personalised features, deployed only upon User consent.

Users may manage cookie preferences through the platform-level cookie management interface. Third-party or advertising cookies are not used by NIZU at the platform level.

9. Data Protection Officer

NIZU has designated a Data Protection Officer (DPO) in accordance with Article 37 GDPR. The DPO may be contacted at:

The DPO is independent of business operations and reports directly to the highest management level of NIZU OÜ.

10. Amendments to This Policy

NIZU reserves the right to amend this Policy at any time. Material amendments shall be notified to registered End-Users by email or via an in-platform notification at least thirty (30) days prior to the effective date of such amendments. Continued use of the Platform following the effective date of an amendment constitutes acceptance of the amended Policy.

The current version of this Policy is always available at [URL]. Prior versions are archived and available upon written request to legal@nizu.io.

11. Governing Law and Dispute Resolution

This Policy is governed by and construed exclusively in accordance with the laws of the Republic of Estonia and applicable European Union law. Any dispute arising in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts of the Republic of Estonia, seated in Tallinn.

⚠️ EXCLUSIVE JURISDICTION

No foreign court, arbitral body, regulatory authority or legal framework outside the Republic of Estonia and the European Union has jurisdiction over any matter arising from or related to this Policy. Any attempt to assert foreign jurisdiction is hereby expressly rejected by NIZU OÜ.

12. Contact Information

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon — AKI):

— END OF DOCUMENT —

NIZU OÜ GDPR Policy v1.0 · Tallinn, Estonia · 01-01-2026