Privacy Policy

Your privacy matters to us. This Privacy Policy explains how NOS d.o.o. collects, uses, stores and protects the personal data of users of the NOS AI platform and website, as well as of individuals who contact us through the contact form, a demo request or a partner programme application.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Croatian Act on the Implementation of the General Data Protection Regulation and other applicable personal data protection legislation.

1. Who is responsible for processing your data?

The controller of personal data is:

NOS d.o.o. za usluge
Ljubljanska ulica 2/A
10431 Sveta Nedelja
Croatia
OIB: 92523020599
E-mail: info@nos.hr
Web: www.nos.hr

For any questions regarding the processing of personal data and the exercise of your rights, you can contact us at info@nos.hr.

2. What personal data do we collect?

The type of data we process depends on how you use our website and the NOS AI platform.

Demo requests and contact

When you request a demo of the NOS AI platform through our website or send us an enquiry, we may process:

• full name
• business e-mail address
• company name
• the process you wish to automate
• any additional information you voluntarily enter in the form
• the content of further business communication related to your request.

Partner programme applications

When you fill in the application form for the NOS AI partner programme, we may process:

• full name
• business e-mail address
• company name
• company website
• the country or market in which you operate
• the partnership model you selected
• a description of your business and of the cooperation you propose
• the content of further business communication related to your application.

Please do not use the free-text fields to send special categories of personal data or any other data that is not necessary for handling your enquiry or application.

Use of the website

When you access the website, certain technical data required for its secure and correct operation may be processed automatically, for example:

• IP address
• device and browser type
• operating system
• date and time of access
• pages visited
• technical logs of operation and any errors.

We use marketing cookies (Google Ads) only if you accept them in the cookie banner. See section 13, Cookies and ad measurement, for details.

3. Why do we process personal data?

We process personal data only where there is a specific purpose and an appropriate legal basis for doing so.

Handling demo requests and business enquiries

We use the data you enter in the "Request a demo" form in order to:

• receive and process your request
• contact you regarding the requested demo
• understand the business process you wish to automate
• assess which NOS AI solutions match your needs
• arrange a meeting, presentation or further steps
• prepare an offer or take other steps you have asked of us prior to entering into a possible business relationship.

The legal basis for this processing is taking steps at your request prior to entering into a contract or, depending on the circumstances, our legitimate interest in responding to business enquiries and communicating with prospective and existing business customers.

Handling partner programme applications

We use the data you enter in the partner programme application form in order to receive and assess your application, contact you regarding the partnership model you selected and agree on the next steps of a possible cooperation.

The legal basis for this processing is taking steps at your request prior to entering into a contract or, depending on the circumstances, our legitimate interest in communicating with prospective business partners.

Business communication

If you enter into a business relationship with us, we may process personal data for the purpose of:

• performing the contract
• providing the agreed services
• customer support
• administrative and financial communication
• meeting legal and accounting obligations.

The legal basis may be performance of a contract, compliance with a legal obligation or legitimate interest, depending on the specific processing activity.

Security and operation of the website

We may process technical data in order to:

• keep the website running securely
• prevent misuse and unauthorised access
• detect and resolve technical issues
• protect our systems and data.

Such processing is based on our legitimate interest in maintaining the security and reliability of our digital services.

Measuring ad performance (Google Ads)

We use the Google tag for Google Ads on this website to measure how many visitors who came through our ads went on to submit a demo request (a so-called conversion). This lets us assess how well our ads perform and make decisions about advertising.

The Google tag uses Google Consent Mode. By default, before you make a choice, ad_storage, ad_user_data, ad_personalization and analytics_storage are set to "denied".

Before you make a choice, and if you reject cookies, the Google tag does not store advertising cookies, but Google may receive limited signals without advertising cookies, in line with how Consent Mode works (for example that a page was visited or that a demo request was submitted, your consent status, and technical data that the browser sends with every request, such as IP address, browser type and time).

If you choose "Accept" in the banner, the marketing consent signals (ad_storage, ad_user_data, ad_personalization) change to "granted". analytics_storage remains "denied", as we do not use analytics cookies.

You can reject cookies, and change your choice at any time later via the "Cookie settings" link at the bottom of every page.

We do not use Google Enhanced Conversions: we do not send Google the data you enter in the "Request a demo" form (name, e-mail, company, message, etc.).

Marketing

If we wish to send you marketing messages for which consent is required under applicable rules, we will send such messages only if you have given the appropriate consent.

You may withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

Requesting a demo of the NOS AI platform does not in itself constitute an automatic subscription to marketing messages.

4. Is providing data mandatory?

The data marked as mandatory in the form is required so that we can process your request and respond to you.

If you do not provide the mandatory data, we may not be able to process your demo request or reply to your enquiry.

Any additional information not marked as mandatory is provided voluntarily.

5. Who may we disclose personal data to?

We do not sell personal data.

Personal data may be accessed by NOS employees and associates who need it to perform their duties, subject to appropriate authorisations and confidentiality obligations.

Where necessary, we may entrust personal data to trusted service providers acting as processors, for example providers of:

• hosting and infrastructure
• business e-mail
• technical support
• systems for managing business relationships and enquiries
• security and IT services
• analytics services, if used and where an appropriate legal basis exists for them.

Such providers may process the data only in accordance with our instructions and subject to appropriate data protection measures.

For measuring ad performance, the data described in section 3 (Measuring ad performance) is shared with Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes it in accordance with its terms and privacy policy.

We may also disclose personal data to competent public authorities where we are required to do so by law or by a binding request from a competent authority.

6. Transfers of data outside the European Economic Area

If any of the service providers we use processes personal data outside the European Union or the European Economic Area, we will ensure that an appropriate legal mechanism and the safeguards required by the GDPR are in place for such a transfer.

This may include an adequacy decision of the European Commission, the European Commission's standard contractual clauses or another permitted transfer mechanism.

Google may also process Google Ads data in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision.

7. How long do we keep personal data?

We keep personal data only for as long as is necessary to achieve the purpose for which it was collected, unless the law requires longer retention.

Data received through a demo request, a partner programme application or a business enquiry is kept for the period necessary to handle the request and for further business communication. If no business relationship follows the communication, the data is deleted or anonymised once our internal retention period expires, unless another legal basis exists for keeping it.

If a business relationship is established, the relevant data may be kept for the duration of that relationship and, after it ends, for the periods required to meet legal, accounting, tax and other obligations or to protect legal claims.

Technical security logs are kept for as long as is reasonably necessary for system security, problem detection and protection against misuse.

8. How do we protect personal data?

We apply appropriate technical and organisational measures to protect personal data against:

• unauthorised access
• unauthorised disclosure
• accidental or unlawful loss
• alteration
• destruction
• misuse.

Access to personal data is limited to those who need it to perform their duties.

Although we apply appropriate security measures, no method of transmitting or storing data over the internet can be guaranteed to be completely secure.

9. Your rights

Under the GDPR, and depending on the circumstances of the processing, you may have the right to:

• request access to your personal data
• request the rectification of inaccurate or incomplete data
• request the erasure of personal data
• request the restriction of processing
• object to processing based on legitimate interest
• request data portability where the statutory conditions are met
• withdraw your consent at any time where processing is based on consent
• not be subject to a decision based solely on automated processing where such a decision produces legal or similarly significant effects, except in cases permitted by law.

To exercise your rights, you can send us a request at info@nos.hr.

In order to protect your data, we may ask for additional information needed to verify the identity of the person making the request before acting on it.

We will respond to your request within the time limits prescribed by the applicable personal data protection legislation.

10. Right to lodge a complaint

If you believe that your personal data is being processed contrary to the applicable rules, you have the right to contact us so that we can try to resolve the issue.

You also have the right to lodge a complaint with the competent supervisory authority:

Agencija za zaštitu osobnih podataka (AZOP)
Croatian Personal Data Protection Agency
Selska cesta 136
10000 Zagreb
Croatia

The Agency's current contact details are available on its official website azop.hr.

11. Automated decision-making

We do not use the personal data submitted through the "Request a demo" form to make decisions based solely on automated processing that would produce legal or similarly significant effects for you.

Should the way we process data change in the future, we will inform you in advance in accordance with the applicable legislation.

12. Links to other websites

Our website may contain links to third-party websites or services.

NOS does not control the privacy practices of those third parties. We recommend that you read their privacy policies before providing personal data on other websites.

13. Cookies and ad measurement

Cookies are small files that a website stores in your browser. On this website we distinguish two kinds:

Strictly necessary storage

When you choose "Accept" or "Reject" in the banner, we store your choice in your browser's local storage (localStorage, under the name nos-kolacici) so that the banner does not ask you again on every page. This entry contains no personal data, is not sent to anyone and remains until you delete it in your browser settings. No consent is required for this storage, as it is necessary to respect your choice.

Marketing cookies (Google Ads)

If you accept marketing cookies, the Google tag may store advertising cookies such as _gcl_au and other cookies whose name starts with _gcl_ (lasting up to 90 days), and Google may also use its own cookies on its own domains. They are used to link a demo request to a click on our ad.

How consent works (Google Consent Mode)

Until you make a choice, and if you choose "Reject", all of these consent settings remain "denied": advertising cookies are not stored, and ad click identifiers are not sent to Google. Google may then receive only the limited signals without advertising cookies described in section 3. We do not use analytics cookies, even after you accept.

By choosing "Accept", the marketing consent signals change to "granted": the Google tag may then store advertising cookies and send conversion data to Google for ad measurement.

Changing your choice and withdrawing consent

You can change your choice at any time via the Cookie settings link at the bottom of every page. If you withdraw consent, we stop using marketing cookies and delete the _gcl_ cookies the website has stored. You can also delete cookies yourself in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

14. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time to reflect changes in our services, technology, business processes or legal requirements.

The current version will always be published on this page, together with the date of the last update.

If the changes significantly affect the way we process your personal data, we will notify you in an appropriate manner.

15. Contact

For any questions regarding privacy and the processing of personal data, please contact us:

NOS d.o.o. za usluge
Ljubljanska ulica 2/A
10431 Sveta Nedelja
Croatia
E-mail: info@nos.hr
Web: www.nos.hr