Privacy Policy

1. Who we are

NIS2Fill ("we", "us") provides a web application that helps suppliers answer customer security questionnaires. Our legal entity is NI2SFill, registered in The Netherlands under Chamber of Commerce (KVK) number 42124364, at Galvanistraat 1857,3029AD Rotterdam.

For any privacy question or request, contact us at dev.app.nis2@gmail.com. We aim to respond within 5 working days and in all cases within one month, as the GDPR requires.

2. Our two roles: controller and processor

It matters which hat we are wearing, because it changes your rights and our duties.

• As a CONTROLLER, we handle the limited personal data needed to run the service itself: your account details, and how you use the product. This policy governs that data.
• As a PROCESSOR, we handle the content you put into the tool (questionnaires, your answers, uploaded documents) on behalf of your organisation. Your organisation decides what goes in and why; we only act on its instructions. That relationship is governed by our Data Processing Agreement, not by this policy.

3. What we collect

We do not use tracking or advertising cookies, we do not build behavioural profiles, and we do not sell personal data to anyone. Ever.

3a. If you use the preview without an account

You can try the service on our website without signing up. This section is written for people who do exactly that, because at that point we have no account of yours and you have not agreed to anything as a customer.

• What we hold: only what you upload for the preview, what our software extracts from it, and a random session identifier. We do not ask for your name or email, and we do not link the upload to an identity.
• Where it goes: the same place any other document goes, including our AI sub-processor in the United States (see sections 6, 7 and 8). Please do not upload anything confidential you would not want processed that way.
• Why we are allowed to: legitimate interests (Article 6(1)(f)) - showing you what the product does on your own file, at your request, is the least intrusive way to do it. If you sign in and claim the result, the basis becomes performance of a contract.
• How long: the session stops working 24 hours after you create it, and the stored content is deleted automatically shortly after that. If you sign in and claim it, it becomes ordinary account content and the retention rules in section 9 apply instead.
• Your rights: they apply here too. Because we hold no identifying information about you, the fastest way to erase a preview is to not claim it and let it expire, or to clear the preview cookie. If you want us to delete it sooner, email us from the address described in section 11 and tell us roughly when you used it.
• Abuse prevention: we rate-limit these requests using a one-way hash of your IP address held only in server memory. The raw IP address is not written to our database.

5. Legal grounds for using your data

• Performance of a contract (Article 6(1)(b)) - to give you the service you signed up for, including your account and the drafting features.
• Legitimate interests (Article 6(1)(f)) - to keep the service secure, prevent abuse, diagnose faults, and improve the product. We have weighed these interests against your rights and use the least intrusive data that works.
• Consent (Article 6(1)(a)) - for optional feedback you choose to submit. You can withdraw consent at any time.
• Legal obligation (Article 6(1)(c)) - where we must retain records to comply with the law.

7. Who we share data with, and international transfers

We share data only with the service providers (sub-processors) that make the product work. We do not share your data with anyone else unless the law compels us to, and we will tell you if that happens unless we are legally forbidden from doing so.

8. Transfers outside the EU

Your application data is stored in the European Union (Ireland). However, OpenAI processes data in the United States, and Vercel is a US-established company.

For those transfers we rely on the European Commission's Standard Contractual Clauses together with each provider's Data Processing Addendum, and - where applicable - the EU, US Data Privacy Framework. You can request a copy of the relevant safeguards by emailing us.

9. How long we keep data

You can delete your organisation's data at any time from the Configuration page, or by emailing us. Deletion removes your answer library, questionnaires and uploaded files.

• Account and content data: for as long as your organisation has an active account, and for up to 30 days after deletion so an accidental deletion can be undone.
• Backups: encrypted backups may persist for up to 30 days after deletion, then they are overwritten.
• Technical and error logs: up to 12 months.
• Feedback responses: up to 24 months.
• Coverage previews used without an account: the session expires 24 hours after it is created and the stored content is deleted automatically by a daily job. If you sign in and claim the preview, the content becomes ordinary account content and the first bullet above applies instead.

10. How we protect data

• All traffic is encrypted in transit with TLS, and data is encrypted at rest by our hosting provider.
• Every organisation's data is isolated at the database level using PostgreSQL Row-Level Security, so one customer's data cannot be read by another. We test this isolation explicitly.
• Passwords are stored only as salted hashes - we cannot see them.
• Access to production data is limited to those who need it to operate the service.

11. Your rights

Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent where consent is the basis we rely on.

To exercise any of these, email dev.app.nis2@gmail.com. We will not charge you for a reasonable request and we will not treat you differently for making one.

If the data was submitted by your employer's account, we may need to refer your request to your organisation's administrator, because we act as processor for that content.

You also have the right to complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the authority where you live or work.

12. Changes to this policy

If we make a material change we will notify account administrators by email and update the date at the top of this page before the change takes effect. Continuing to use the service after that means you accept the updated policy.