Privacy Policy

This notice explains what personal data NEXIEL LIMITED collects and processes, why, who it is shared with, how long it is kept, and the rights you have over it. It covers both this website (in particular the Get started waiting list) and the personal data Nexiel processes through its Screen, Verify, and Age APIs on behalf of its clients.

Who is responsible (the data controller)

The controller for personal data processed through this site is Registered company number and office address are shown once this page finishes loading. Nexiel's infrastructure is hosted in the EU.

Nexiel's Data Protection Officer can be contacted at dpo [at] nexiel [dot] ie. For any privacy question, or to exercise the rights described below, contact the DPO at that address.

If you are an end user Nexiel's client screened or verified you

If a business used Nexiel Screen to run a sanctions/PEP check on you, or Nexiel Verify or Nexiel Age to verify your identity or age, that business is Nexiel's client, and in almost every case is itself the data controller for that check, not Nexiel. The client is the party that decided to run the check, that holds the legal basis for doing so (often a legal obligation under EU anti-money-laundering law), and that is responsible for what it does with the result. Nexiel processes your data on the client's instructions, as a processor, using the technical controls described under “How long we keep it” below. If you want to exercise a data-subject right over that specific check, contact the business that ran it first. It is best placed to identify which check was yours and to act on your request. You may also contact Nexiel's DPO directly and Nexiel will assist where it is able to.

What personal data we collect, and why

The one place on this site that collects personal data directly from you is the Get started waiting list form. When you join the list, we process:

• Your email address, so we can contact you when onboarding opens for your account.
• Your name and company name, if you choose to provide them, to personalize that contact.

This is the only personal data the form collects. Nexiel Verify's end-user identity flows (EUDI wallet) are a separate matter covered under “How long we keep it” below.

What happens if you are invited to onboard

Joining the waiting list does not by itself start an application. If we invite you to onboard, we will separately ask for company details (legal entity name, registry country and number) and beneficial owner/director details (name, and where relevant date of birth, nationality, ownership percentage, and basis of control). This is part of the customer due diligence that EU anti-money-laundering law requires us to perform. We will give you a further notice at that point covering that specific processing.

Purposes and legal bases

• Legitimate interest (GDPR Art. 6(1)(f)): maintaining a waiting list and contacting you about it, since you asked to join it.
• Contract, or steps prior to a contract (GDPR Art. 6(1)(b)): if you are later invited to onboard, handling that submission so you can become a Nexiel client, and running a check for a client once you are one.
• Legal obligation (GDPR Art. 6(1)(c)): retaining KYB/UBO customer due diligence records for the statutory period EU anti-money-laundering law requires, and responding to a lawful request from a supervisory or law-enforcement authority.

Automated decision-making

Nexiel's matching engine produces an automated CLEAR, POSSIBLE_MATCH, or CONFIRMED_MATCH classification for a sanctions or PEP screen. A POSSIBLE_MATCH result is never auto-cleared: a human at Nexiel's client always reviews it before any decision is made about you. Nexiel's own systems do not make a final adverse decision about you on a fully automated basis within the meaning of GDPR Art. 22; that decision is the client's, made by a person, not by Nexiel's software alone.

Who your data is shared with (recipients and sub-processors)

Nexiel does not sell personal data or share it for advertising. To operate the waiting list, the personal data above may be processed by the following sub-processors, each only for the purpose stated:

• ZeptoMail (Zoho): transactional email delivery, for any confirmation or follow-up email we send you.
• Hetzner: the hosting provider for Nexiel's servers (EU infrastructure).

If you are later invited to onboard, additional sub-processors apply to that separate processing: OpenSanctions for sanctions/PEP screening data, Stripe for billing, and Anthropic, which helps prepare parts of your application for a human reviewer to assess and never decides the outcome. We will name these in the further notice referenced above.

International transfers

Nexiel's own infrastructure is EU-hosted. Some sub-processors named above (for example Anthropic and Stripe) are US-headquartered, so certain processing may involve a transfer outside the EEA. Where that is the case, it is intended to rely on an appropriate GDPR transfer mechanism (such as the EU Standard Contractual Clauses or an adequacy decision). Nexiel is formalizing sub-processor data-processing agreements. This notice will be updated once that work is complete.

Cookies

This website (nexiel.eu) sets no cookies. Nexiel's customer dashboard (dashboard.nexiel.io), a separate, authenticated application, sets a strictly necessary session cookie once you sign in, to keep you signed in. That cookie is exempt from consent under Article 5(3) of the ePrivacy Directive because it is necessary to provide a service you explicitly requested (staying signed in), and it is not used for advertising or tracking across other sites.

How long we keep it (retention)

• Waiting list details are kept until we invite you to onboard, or until you ask to be removed, whichever comes first. You can ask to be removed at any time by contacting the DPO.
• Nexiel Verify transaction PII is deleted immediately. Raw personal data from an end-user identity or age check (name, DOB, address, document number, nationality) is never persisted beyond the single verification transaction. Deletion is enforced by TTL/cron, not a manual step. What remains afterward is only non-identifying records (session id, timestamps, boolean proofs, a SHA-256 hash of the presented token, and the screening result).
• For an AML-relevant Verify session or a Screen decision, Nexiel encrypts the substantive disclosed claim values and the decision itself into an evidence pack, delivers it once to a key the client controls (Nexiel never holds the private key), and reduces its own retention to a minimal audit row: session/request id, client id, timestamp, classification, the frozen decision artifact's hashes, and a hash of the delivered ciphertext as proof of handoff, never the substantive data itself.
• If you are onboarded as a client, KYB/UBO customer due-diligence records are retained for the statutory AML period. EU AML law requires an obliged entity to retain beneficial-ownership/CDD records for the life of the business relationship plus a statutory period after it ends. Deleting them on a short timer would breach that legal obligation rather than satisfy data minimisation. Nexiel retains this data for five years after the end of the business relationship (the floor set by Article 40 of Directive (EU) 2015/849, carried into Article 77 of the incoming AML Regulation (EU) 2024/1624, and matched by the national transpositions in the jurisdictions Nexiel operates registry checks against: Ireland, France, Finland, Norway). An automated purge job deletes this data once the retention period lapses.

Your rights

Under the GDPR you have the right to request access to your personal data and its rectification or erasure, to object to or restrict certain processing, to data portability, and, where processing relies on consent, to withdraw that consent at any time. These rights are not absolute: where Nexiel is under a legal obligation to retain CDD records (see “How long we keep it” above), an erasure request may be limited for the duration of that statutory retention period. To exercise any of these rights, contact dpo [at] nexiel [dot] ie.

Complaints

If you believe Nexiel has handled your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority. Nexiel is established in Ireland, so the relevant authority is the Irish Data Protection Commission (dataprotection.ie). You may also complain to the supervisory authority in your own EU/EEA country of residence.

See also the Terms of Service, the Data Processing Agreement, the legal disclaimer, and service levels.