Privacy Policy & Data Processing (GDPR)

• The Subscribing Firm is the “Data Controller”: For all personal records of borrowers, insured parties, and leads managed inside the platform. The firm determines processing purposes and lawful bases.

• Nynexium SAS is the “Data Processor”: Nynexium operates exclusively under documented instructions from the firm to store, back up, and secure files under the Data Processing Agreement (DPA).

• Nynexium SAS is the “Data Controller”: Strictly for administrative management, subscription billing, and technical support of firm user accounts.

When using Nynexium services, the following data categories may be processed:

• Firm Account Data: Advisor names, professional emails, phone numbers, billing credentials, and subscription history.

• Borrower File Data: Civil status, family situation, income documentation, tax returns, pay slips, bank statements, and identity documents.

• Technical Metadata: Access logs, IP addresses, eIDAS signature timestamps, and SHA-256 integrity hashes.

• Performance of SaaS Contract: Provision of the CRM workspace, borrower upload portal, underwriting calculators, and document storage.

• Legal & Regulatory Compliance: Traceability of brokerage mandates, anti-money laundering (AML) compliance, and 10-year evidentiary signature archives.

• System Security: Intrusion detection, document tampering prevention, and data loss prevention (DLP).

• AES-256 encryption at rest on secure cloud volumes with dedicated key management.

• TLS 1.3 encryption for all network traffic with Perfect Forward Secrecy.

• Mandatory two-factor authentication (2FA TOTP) for all advisor accounts.

• Sovereign dual-mirror backup and real-time replication between Nuremberg and Falkenstein, Germany (EU).

• Client deal files: Stored for the duration of the firm’s active subscription, then archived according to statutory limitation periods for financial intermediaries (5 to 10 years).

• Subscription invoicing data: Retained for 10 years per commercial accounting laws.

• System and security audit logs: Retained for 12 rolling months.

Pursuant to Articles 15 to 22 of the GDPR, data subjects have the right to access, rectify, erase, restrict, oppose, and port their personal data.

For borrower record requests, inquiries should be directed to the broker firm acting as Data Controller. For infrastructure inquiries, contact dpo@nynexium.com.