Privacy Policy

1. Who we are

NoSix (“NoSix”, “we”, “us”) provides a carbon management platform for sport. We are based in the Netherlands.

This policy covers www.nosix.co, the NoSix app at app.nosix.co and our contact with you by email. For the personal data described here, NoSix is the controller.

When an organisation uses the app, the facility, equipment and emissions records it adds belong to that organisation. We handle that content on the organisation’s behalf under our Data Processing Agreement. If your question is about that content, please ask your organisation first.

2. The data we collect

• On the website: www.nosix.co sets no cookies and runs no analytics or advertising trackers. Like every website, the servers that deliver it process your IP address, your browser type and the pages you request, so the site can be delivered and kept secure.
• When you contact us: your name, email address, organisation and whatever you write to us.
• When you create an account: your first and last name, your work email address, the organisation you belong to, your role in it and your sign-in details.
• When you use the app: technical records such as sign-in times, device and browser type, IP address, the actions taken in your account and error reports. The app uses cookies or similar browser storage that are needed to keep you signed in and to keep the app secure.
• When your organisation pays for a plan: billing contact, billing address, VAT number, plan and payment status. Card details are processed by our payment provider. We do not store full card numbers.

We do not ask for special categories of personal data, and the service is not meant for them.

3. Why we use it

• To provide the service you or your organisation signed up for, including accounts, support and service messages. Legal basis: performance of a contract.
• To answer your enquiries. Legal basis: our legitimate interest in responding to you, or steps taken before entering a contract.
• To keep the website and the app secure, to find and fix faults and to improve the service. Legal basis: our legitimate interest in a secure and reliable service.
• To invoice, keep accounts and meet tax and other legal duties. Legal basis: legal obligation.
• To send product news, when you have asked for it or when the law allows. You can unsubscribe at any time. Legal basis: consent or our legitimate interest.

We do not sell personal data. We do not use it for automated decisions that have legal or similarly significant effects on you.

4. AI features

Some features of the app use AI models from a third-party provider to read the documents you upload and to answer questions. The content needed for a request is sent to that provider so it can return a result.

We do not use your organisation’s content to train AI models, and our agreement with the provider does not allow it to train its models on that content.

5. Who receives your data

• Service providers that work for us under contract: hosting, database and file storage, email delivery, error monitoring, payments and AI processing. The providers that handle customer content are listed in the Data Processing Agreement.
• Professional advisers, such as accountants and lawyers, where needed.
• Authorities, when the law requires it.
• A successor, if NoSix is reorganised or sold. This policy continues to apply to your data.

6. Where your data is processed

We host the data of the app in the European Union.

Some of our providers are based outside the European Economic Area, mainly in the United States. When personal data is transferred there, we rely on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or on the Commission’s standard contractual clauses.

7. How long we keep it

• Account data: for as long as your account is open. After an account is closed, we delete or anonymise it within 90 days.
• Enquiries: up to two years after our last contact.
• Invoices and accounting records: seven years, as Dutch tax law requires.
• Technical logs: up to 12 months.

Backups are overwritten on their normal cycle.

8. Security

We protect personal data with encryption in transit and at rest, role-based access in the app and access to production systems limited to the people who need it.

No system is fully secure. If a breach is likely to put you at risk, we tell you and the regulator as the law requires.

9. Your rights

Under the GDPR you can ask us to:

• give you a copy of your personal data;
• correct data that is wrong or incomplete;
• delete your data;
• restrict our use of your data, or object to it;
• hand your data over in a portable format.

Where we rely on your consent, you can withdraw it at any time.

Write to hello@nosix.co. We answer within one month. You can also complain to your data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

10. Children

The service is for organisations and their staff. It is not directed at children under 16, and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy. The date at the top shows the current version. If a change is significant, we tell account holders by email or in the app before it takes effect.

12. Contact

Questions about privacy go to hello@nosix.co.