Privacy Policy

1. Controller

The data controller responsible for processing is OnDuty AI Solutions GmbH, Werdertorgasse 15/9, 1010 Wien, Austria. Contact: contact@nisura.eu. Full company details are in our Imprint.

We have not appointed a Data Protection Officer, as we are not required to under Art. 37 GDPR. For any privacy or data-protection matter, contact us at contact@nisura.eu.

2. What data we process

• Simulation inputs — the industry, revenue, headquarters country and perimeter technologies you enter into the risk simulator. These are processed to compute your estimate and are not personal data unless you add identifying information.
• Account & contact data — name, business email and message when you contact sales or register for the full platform.
• Technical data — IP address, browser type, and request logs, processed to operate and secure the service.
• Free Rapid Assessment requests — when you run the anonymous domain scan, we store the requester's IP address alongside the scan for a maximum of 90 days, solely to enforce rate limits and prevent abuse of the free tool (Art. 6(1)(f) GDPR; see § 5). After 90 days the IP is permanently erased. The scan result itself describes a domain's public technical exposure, contains no personal data, and is retained as a non-personal record.

3. Purposes & legal bases

• Providing the simulator and platform — performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR).
• Responding to sales and support enquiries — our legitimate interest in answering you (Art. 6(1)(f) GDPR).
• Security, fraud prevention and service integrity — legitimate interest (Art. 6(1)(f) GDPR).
• Legal and accounting obligations — compliance with a legal obligation (Art. 6(1)(c) GDPR).

4. Data residency & hosting

Nisura is engineered for EU data sovereignty. Personal data is stored and processed within the European Union (Vienna, Austria). We do not transfer personal data outside the EU/EEA unless an adequacy decision or appropriate safeguards under Chapter V GDPR are in place. See our EU Sovereignty Commitment.

5. Retention

We keep personal data only as long as necessary for the purposes above, or as required by law:

• Sales & support enquiries — up to 24 months after our last contact, then deleted.
• Account & contract data — for the duration of the business relationship and as long as claims may arise from it.
• Invoicing & accounting records — 7 years, per the Austrian retention obligation (§ 132 BAO / § 212 UGB).
• Server & security logs — up to 90 days.
• Free Rapid Assessment requester IP — up to 90 days, then automatically purged. The associated scan result (non-personal) is retained separately.
• Simulator inputs — computed in your browser and not retained on our servers beyond your session.

6. Recipients & processors

We share data only with processors acting on our instructions under Art. 28 GDPR data-processing agreements. Our current sub-processors (hosting, email delivery, analytics) are documented in our Trust Center. We do not sell personal data.

7. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interests. To exercise any right, contact contact@nisura.eu. You also have the right to lodge a complaint with a supervisory authority — in Austria, the Datenschutzbehörde (dsb.gv.at).

8. Cookies

We use Cookiebot to manage cookie consent. The declaration below lists the cookies used on this site and their purposes, and updates automatically as our cookie usage changes.

9. Changes

We may update this policy; the "last updated" date above reflects the current version. Material changes will be communicated where required.