1. INTRODUCTION
This Privacy Policy explains how Nuevexa ("Provider," "We," "Us," "Our"), the operator of BayX, collects, uses, processes, discloses, and safeguards personal data when You use the BayX platform (the "Platform"). Throughout this Policy, references to "BayX" or "Platform" refer to the software service, while "Provider," "We," "Us," and "Our" refer to Nuevexa as the legal entity operating BayX.
By accessing or using the Platform, You acknowledge that You have read, understood, and agree to be bound by this Privacy Policy.
2. DATA CONTROLLER AND PROCESSOR ROLES
2.1 Customer as Data Controller
For Personal Data uploaded by the Customer to the Platform, the Customer acts as the data controller and is responsible for ensuring lawful processing, obtaining necessary consents, providing required privacy notices, and responding to data subject requests.
2.2 Provider as Data Processor
We act as a data processor in relation to Customer Data. We process Customer Data solely on the Customer's behalf and in accordance with documented instructions.
2.3 Provider as Data Controller
For Personal Data collected directly by Us for account administration, billing, and platform operations, We act as the data controller.
3. PERSONAL DATA WE COLLECT
3.1 Information Provided Directly
We collect Personal Data that You provide when:
- Registering for an Account: Business name, contact name, email address, phone number, business address, and payment credentials.
- Using the Platform: Vehicle information, customer details, service records, communications, and business data.
- Contacting Support: Name, email address, and information provided in support requests.
3.2 Information Collected Automatically
We automatically collect certain information when You use the Platform, including:
- Usage Data: Features accessed, actions performed, and time stamps.
- Device Information: IP address, browser type, operating system, and device identifiers.
- Log Data: Access times, error logs, and system activity.
3.3 Information from Third Parties
We may receive information from payment processors, email delivery services, and other service providers necessary to operate the Platform.
4. HOW WE USE PERSONAL DATA
We use Personal Data for the following purposes:
- Service Provision: To provide, operate, and maintain the Platform and deliver requested Services;
- Account Management: To create and manage Accounts, process subscriptions, and authenticate users;
- Payment Processing: To process payments, issue invoices, and prevent fraud;
- Communications: To send transactional emails, system notifications, and respond to inquiries;
- Improvement and Analytics: To analyse usage patterns, improve features, and develop new functionality;
- Security: To detect, prevent, and address security incidents, fraud, and illegal activity;
- Legal Compliance: To comply with legal obligations, respond to lawful requests, and enforce our Terms.
5. LEGAL BASES FOR PROCESSING
We process Personal Data based on the following legal grounds:
- Contractual Necessity: Processing is necessary to perform our contract with You (Terms of Service);
- Legitimate Interests: We have a legitimate interest in operating, securing, and improving the Platform, preventing fraud, and enforcing our rights;
- Legal Obligation: Processing is necessary to comply with applicable laws and regulations;
- Consent: Where required by law, we obtain Your explicit consent before processing.
6. DATA SHARING AND DISCLOSURE
6.1 Third-Party Service Providers
We share Personal Data with third-party service providers who assist in operating the Platform, including cloud hosting providers, payment processors, email delivery services, and analytics providers. These providers are contractually obligated to protect data and use it only for specified purposes.
6.2 Business Transfers
In the event of a merger, acquisition, reorganisation, or sale of assets, Personal Data may be transferred to the successor entity.
6.3 Legal Requirements
We may disclose Personal Data when required by law, court order, legal process, or governmental request, or when necessary to protect our rights, prevent fraud, or ensure safety.
6.4 With Consent
We may share Personal Data for other purposes with Your explicit consent.
7. DATA RETENTION
We retain Personal Data for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.
Upon Account termination, Customer Data is retained for thirty (30) days to allow retrieval, after which it is permanently deleted unless legal obligations require longer retention.
Aggregated and anonymised data that cannot identify individuals may be retained indefinitely for analytics and research purposes.
8. DATA SECURITY
We implement industry-standard technical and organisational measures to protect Personal Data from unauthorised access, disclosure, alteration, and destruction. These measures include encryption, access controls, regular security assessments, and employee training.
However, no system is completely secure. We cannot guarantee absolute security, and You acknowledge the inherent risks of internet-based services.
9. INTERNATIONAL DATA TRANSFERS
Personal Data may be transferred to and processed in countries outside Your jurisdiction, including countries that may not provide equivalent data protection standards.
For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses or other lawful transfer mechanisms approved by relevant authorities.
10. YOUR RIGHTS
Depending on Your location, You may have the following rights regarding Your Personal Data:
- Access: Request copies of Your Personal Data;
- Rectification: Request correction of inaccurate or incomplete data;
- Erasure: Request deletion of Your Personal Data (subject to legal exceptions);
- Portability: Request transfer of Your data in a machine-readable format;
- Restriction: Request limitation of processing under certain circumstances;
- Objection: Object to processing based on legitimate interests;
- Withdraw Consent: Withdraw consent where processing is based on consent.
To exercise these rights, please contact us at privacy@bayx.app, We will respond within the timeframes required by applicable law (typically 30 days).
12. CHILDREN'S PRIVACY
The Platform is not intended for individuals under 18 years of age. We do not knowingly collect Personal Data from children. If we become aware of such collection, we will promptly delete the data.
13. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time. Material changes will be notified via email or prominent notice on the Platform at least thirty (30) days before taking effect. Continued use after changes become effective constitutes acceptance.
14. CONTACT INFORMATION
For questions or concerns about this Privacy Policy or data protection practices, please contact:
Nuevexa Data Protection
Email: privacy@bayx.app