Effective 13 August 2026
Controller
The controller for personal data collected through nexusatlas.app is “Nexus Atlas” Ltd, a single-member limited liability company registered in the Republic of Bulgaria, UIC (tax ID) 208756891, identified on the legal page and reachable at office@nexusatlas.io.
What we collect
What you type into the evaluation-build and contact forms: name, work email, organization, platform, and the message or test description you choose to give. The forms carry a honeypot field instead of a tracking script, and nothing is subscribed automatically.
Security and technical records needed to keep the site working: timestamps, request metadata, and abuse signals.
Analytics — Google Analytics and Microsoft Clarity — run only after you accept them in the consent notice; declining changes nothing else about the site, and the choice can be reopened at any time.
Purposes and legal basis
Evaluation and contact inquiries are processed to answer them and prepare the access you asked for — as steps taken at your request prior to a contract (GDPR Art. 6(1)(b)) and on our legitimate interest in responding (Art. 6(1)(f)). Analytics rest on consent (Art. 6(1)(a)); security records on our legitimate interest in protecting the service (Art. 6(1)(f)).
Recipients and transfers
Data is handled by authorized Nexus Atlas personnel and by processors bound by data-processing agreements: Google Cloud (hosting, EU region), Twilio SendGrid (delivery of form submissions to our inbox), and — only after consent — Google Analytics and Microsoft Clarity. SendGrid, Google and Microsoft may process data in the United States; those transfers rest on the EU–US Data Privacy Framework and standard contractual clauses.
We do not sell personal information and do not provide inquiry data to advertisers.
Retention and security
Inquiry correspondence is kept as long as the conversation and any engagement that follows require — as a rule no longer than 24 months after the last exchange, unless a contract or a legal obligation keeps it. Security records are kept up to 12 months. Access controls, encryption in transit and deletion procedures are proportionate to the information held; no website can promise absolute security.
Your rights
You may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interest; consent, once given, can be withdrawn at any time. Requests may require identity verification.
You may also complain to the Bulgarian supervisory authority — the Commission for Personal Data Protection, cpdp.bg — or to the authority in your own country of residence.
Contact and changes
Privacy questions and rights requests go to office@nexusatlas.io or through the contact page. Material changes to this policy are reflected by an updated effective date on this page.