Privacy policy
1. Who we are
NEXERA PXM is a product experience management platform operated by DEED B.V. (DEED Vision division), a private company with limited liability incorporated in the Netherlands. We are the controller for personal data we collect through this website and the data controller jointly with our customers (where they remain controller of their own end-user data) for data processed in the platform.
Registered office: Boven de Wolfskuil 20, 6049 LZ Herten, Netherlands
KVK (Dutch Chamber of Commerce): 73419583
2. What we collect
You give us
- Form submissions, name, email, company, role, message (book-a-demo and contact forms).
- Account data when you sign up, name, email, password (hashed), workspace details.
- Billing data when you subscribe, handled by Stripe; we never see your card number.
- Catalog data you import, product titles, attributes, images and any other content you place in the platform.
We collect automatically
- Standard server logs, IP address, browser, OS, referrer, pages viewed. Used for security, performance and abuse prevention.
- Analytics events (with your consent), page views, button clicks, session duration, and sampled, privacy-masked session replay (a partial recording of on-page interactions to diagnose UX issues). All analytics load only after you choose “Accept all”. We do not use cross-site tracking.
3. How we use it
- To deliver and operate the service you've signed up for.
- To respond to demo requests, support questions and other communications.
- To send service notices (changes, outages, security) and, only with your consent, occasional product updates.
- To detect, prevent and respond to fraud or abuse.
- To comply with our legal obligations (tax, accounting, court orders).
We do not sell your personal data and we do not use it for automated decision-making with legal effects.
4. Lawful basis (GDPR Art. 6)
| Purpose | Lawful basis |
|---|---|
| Delivering the service to subscribers | Performance of a contract (Art. 6(1)(b)) |
| Responding to your inquiries | Legitimate interest / pre-contract (Art. 6(1)(f) / 6(1)(b)) |
| Marketing emails | Consent (Art. 6(1)(a)) |
| Analytics cookies | Consent (Art. 6(1)(a)) |
| Security & abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Tax & accounting records | Legal obligation (Art. 6(1)(c)) |
5. Cookies
We use a small number of cookies and similar storage:
- Essential, session, theme preference, language selection, consent state. These cannot be turned off; without them the site doesn't work.
- Analytics (only with your consent), to understand how visitors use the site. Stored for up to 12 months.
You can review or change your choice via the consent banner. You can also clear cookies in your browser at any time.
6. Sharing & sub-processors
We share personal data only with carefully selected sub-processors that help us run the service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Subscription billing | US (SCCs) |
| Anthropic PBC | AI content generation (Claude) | US (SCCs) |
| Cloudflare, Inc. | CDN, R2 object storage, DDoS protection | EU / US (SCCs) |
| Resend, Inc. | Transactional email | US (SCCs) |
| Sentry (Functional Software, Inc.) | Error tracking | US (SCCs) |
| Anthropic / OpenAI / xAI | AI for content generation | US (SCCs) |
We do not sell or share personal data with advertising networks. We may disclose data when legally required.
7. International transfers
Some sub-processors above are based in the United States. Where personal data leaves the European Economic Area, we rely on European Commission Standard Contractual Clauses (SCCs) and additional safeguards (encryption in transit and at rest, minimization, access controls). You can request a copy of the relevant SCCs by emailing privacy@nexerapxm.com.
8. Retention
- Form submissions: 24 months after last contact, unless we have a longer legal obligation.
- Account data: for the lifetime of your subscription plus 90 days, then deleted or anonymized.
- Billing & invoicing records: 7 years (Dutch tax law).
- Server logs: 30 days for general logs; up to 12 months for security-relevant events.
- Backups: rolling 30 days, then automatically removed.
9. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten") where applicable.
- Restrict or object to processing.
- Data portability, receive your data in a structured, machine-readable format.
- Withdraw consent at any time, without affecting the lawfulness of prior processing.
- Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or your local supervisory authority.
Email privacy@nexerapxm.com to exercise any of these rights. We respond within 30 days.
10. Security
We protect personal data with industry-standard safeguards: TLS in transit, AES-256 at rest, hashed passwords, row-level isolation between customer tenants, principle-of-least-privilege access controls, regular dependency patching, and audit logging on destructive actions. We aim to notify customers within 72 hours of becoming aware of a personal data breach affecting them.
11. Changes to this policy
We may update this policy from time to time. Material changes will be notified via email (for account holders) or via a banner on the site. The "Last updated" date at the top reflects the latest revision.
12. Contact
Questions about this policy or your data?
Email: privacy@nexerapxm.com
Post: DEED B.V., Boven de Wolfskuil 20, 6049 LZ Herten, Netherlands