Privacy Policy

1. Who We Are (Data Controller)

Nuro CX OÜ ("Nuro CX", "we", "our", or "us") is a company registered in Estonia and is the data controller responsible for the personal data described in this policy. We provide an AI-powered, omni-channel contact-centre platform. We are committed to protecting your privacy and handling personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Estonian law.

For any privacy matter, contact us at privacy@nurocx.com.

2. Information We Collect

We collect the following categories of personal data:

• Account information: name, email address, phone number, and login credentials.
• Communication content: records of calls, messages, chats and conversations processed through our platform on behalf of our business customers.
• Usage data: how you interact with our services, including access times and features used.
• Device and technical data: browser type, IP address, and device identifiers.
• Contact information: details of contacts you add to manage communications.

3. How We Use Your Information

We use personal data to:

• provide, operate, and maintain our services;
• process and manage communications routed through the platform;
• improve and personalise your experience;
• respond to enquiries and provide customer support;
• send service-related communications and updates;
• ensure security, prevent fraud, and protect our platform;
• comply with legal obligations.

4. Legal Basis for Processing

Under the GDPR (Article 6), we rely on the following legal bases:

• Performance of a contract — to deliver the services you or your organisation have signed up for.
• Legitimate interests — to operate, secure, and improve our platform, where not overridden by your rights.
• Consent — where required, for example certain cookies or optional communications; you may withdraw consent at any time.
• Legal obligation — to comply with laws to which we are subject.

Where Nuro CX processes communication content on behalf of a business customer, that customer is the controller and Nuro CX acts as a processor under a data processing agreement.

5. Where Your Data Is Stored

Your data is hosted on secure cloud infrastructure in the European Union (Google Cloud, Frankfurt — europe-west3). AI inference for messaging channels is performed on EU-resident infrastructure, and providers are configured not to train their models on your data. We implement appropriate technical and organisational measures — including encryption in transit and at rest, access controls, and regular security assessments — to protect personal data against unauthorised access, alteration, disclosure, or destruction.

6. Third-Party Sub-Processors

We work with trusted sub-processors to operate the platform — for example cloud infrastructure, AI conversation and voice services, telephony/messaging connectivity, and workflow automation. Sub-processors are contractually bound to protect your data and to process it only on our documented instructions. A current list of sub-processors is available on request.

7. International Transfers

Some sub-processors may process data outside the European Economic Area (EEA). Where that occurs, we ensure an appropriate safeguard is in place — such as an adequacy decision or the European Commission's Standard Contractual Clauses (SCCs) — so that your data continues to receive a level of protection consistent with the GDPR.

8. Data Retention

We retain personal data only for as long as necessary to provide our services and fulfil the purposes described in this policy, or as required by law. Retention periods vary by data category and by the instructions of our business customers. When data is no longer required, we securely delete or anonymise it. You may request deletion at any time, subject to legal retention requirements.

9. Your Rights

Subject to applicable law, you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data.
• Restriction — request that we restrict processing in certain circumstances.
• Portability — receive your data in a portable format or have it transferred.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent.

To exercise any of these rights, contact privacy@nurocx.com. Where Nuro CX acts as a processor for a business customer, we will direct your request to the relevant controller.

10. Right to Lodge a Complaint

If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with your local supervisory authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee. We would, however, appreciate the chance to address your concerns first — please contact us before doing so.

11. Cookies and Tracking

We use cookies and similar technologies to enable the platform to function, to analyse usage, and to improve our services. Essential cookies are necessary for the platform to operate. You can manage non-essential cookie preferences through your browser settings.

12. Children's Privacy

Our services are intended for business use and are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, please contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy here, bump the version, and update the "Last updated" date. Material changes will be communicated where required.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

Nuro CX OÜ
Email: privacy@nurocx.com
Website: nurocx.com