Privacy Policy

Controller

Registry code: 17465016
VAT ID: EE103023641
Email: nico@zsb-hg.de

NiCo Digital Technologies OÜ is the controller within the meaning of Article 4(7) GDPR where it determines the purposes and means of processing. Where NiCo processes personal data solely on documented instructions of a business customer, NiCo may act as processor under Article 28 GDPR.

Scope and categories of data

This policy applies to the public website, registration and login, customer and employee accounts, meeting rooms, chat and file functions, and billing. Depending on use, we process contact and master data, company and contract data, account and permission data, login/session data, IP and connection data, meeting and participant data, chat messages, uploaded files, payment and invoice data, and technical security/error data.

Website, hosting and server logs

When NiCo Meeting is accessed, technically necessary connection data may be processed, including IP address, time of access, requested resource, HTTP status, data volume, referrer, browser, operating system and technical error information. Processing is based on Article 6(1)(f) GDPR for secure and reliable operation, abuse prevention and IT security.

Selected hosting, infrastructure, maintenance and backup providers may be used as processors under Article 28 GDPR. Technical logs are retained only as long as needed for operation, troubleshooting and security, unless a security incident, legal duty or legal claim requires longer retention.

Registration, customer account and contract

For business registration we process company name, legal form, address, country, VAT/tax information, contact person, phone, email and authentication data. Passwords are stored using an appropriate one-way hash rather than in plain text.

The main legal basis is Article 6(1)(b) GDPR. Evidence of contract conclusion, acceptance of terms and invoices may additionally be retained under Article 6(1)(c) and (f) GDPR. Business administrators may create and manage employee accounts; the business customer remains responsible for the lawfulness of employee data it enters where it is the controller.

Meetings, camera, microphone and WebRTC

Meeting participation involves processing participant names, meeting/session identifiers, technical connection data and, after user permission, camera, microphone and screen data. Audio and video are currently transmitted through WebRTC between participating end devices. The NiCo server is used in particular for authentication, participant management and connection signalling.

No automatic permanent audio or video recording is made by the current system. Processing is based on Article 6(1)(b) GDPR for contracting users and may rely on Article 6(1)(f) GDPR or the legal basis determined by the inviting company for invited participants.

Google STUN for WebRTC connectivity

For determining suitable network routes, the current WebRTC configuration uses the STUN service stun.l.google.com:19302. During connection setup, the public IP address, port and technical network information may therefore be transmitted to the STUN service.

The provider in the EEA is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing within the Google group or transfers to third countries may take place under Google’s applicable safeguards. We rely on Article 6(1)(f) GDPR because STUN is technically used to provide reliable requested WebRTC connections across different networks.

Chat, participant lists and files

Chat messages may be stored with sender name, meeting assignment and timestamp so they can be delivered to meeting participants. Uploaded files may be stored with filename, size, technical type, sender and meeting assignment. The legal basis is Article 6(1)(b) or (f) GDPR depending on the relationship.

userss may upload only content they are entitled to process and share. Stored meeting content is deleted when it is no longer necessary for the service and no legal retention or evidence obligation applies; content in permanent company or personal rooms may remain while that room or customer account is used.

Screen sharing, photo and document camera

Where supported, NiCo Meeting permits screen sharing, presentation of still images and use of a camera as a document camera. These functions begin only after an active user action and device permission. Image and screen data are processed during the live WebRTC transmission; automatic permanent recording is not intended.

Session cookies and device access

NiCo Meeting uses technically necessary session mechanisms, especially PHP session cookies, for authentication, permissions and secure session state. Necessary storage or access on the end device is based on § 25(2) TDDDG where required to provide a digital service expressly requested by the user; subsequent personal-data processing is based in particular on Article 6(1)(b) or (f) GDPR.

NiCo Meeting currently does not require analytics or marketing cookies. If non-essential tracking technologies are introduced, any legally required consent will be obtained before activation.

Billing and PayPal

For invoicing and payment we process contract, billing, tax, payment-status and transaction information. Processing is based on Article 6(1)(b) and (c) GDPR. If PayPal is selected, necessary payment information is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal is responsible for its own payment-service processing under its privacy terms.

Processing on behalf of business customers

Where a business customer determines purposes and means of processing participant, employee or customer data and NiCo processes that data only on its instructions, the parties will conclude an Article 28 GDPR data processing agreement where required. The business customer remains responsible for its own legal bases, transparency duties and instructions.

Recipients and international transfers

Recipients may include hosting and infrastructure providers, IT and maintenance providers, email and payment providers, accountants/advisers and public authorities where legally required. Access is limited to what is necessary.

Transfers outside the EEA take place only where the conditions of Articles 44 et seq. GDPR are met, for example on the basis of an adequacy decision, Updatedard Contractual Clauses or another valid safeguard. The Google STUN use described above may involve such processing.

Retention periods

Personal data is retained only as long as necessary for the respective purpose. Contract and invoice information may be kept for statutory commercial and tax retention periods. Account, meeting, chat and file data is deleted or anonymised when no longer required, subject to legal duties, security requirements and the establishment, exercise or defence of legal claims.

Data security

We implement appropriate technical and organisational measures under Article 32 GDPR, including encrypted HTTPS/TLS transport, access controls, role and permission concepts, secure password hashing, security updates, backups and measures to protect systems against unauthorised access. Absolute security of electronic communication cannot be guaranteed.

Your rights

Subject to the statutory requirements, data subjects have rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection (Article 21 GDPR). Consent can be withdrawn at any time for the future under Article 7(3) GDPR.

Requests can be sent to nico@zsb-hg.de.

Right to lodge a complaint

Under Article 77 GDPR you may lodge a complaint with a competent supervisory authority, including the authority at your habitual residence, place of work or place of the alleged infringement. For our registered office, the competent authority is in particular Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia.

Automated decisions

Normal use of NiCo Meeting does not involve decisions based solely on automated processing that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.

Changes to this policy

This Privacy Policy may be updated where legal requirements, technical functions, service providers or processing operations change. The version published in the portal at the relevant time applies.