Your data belongs to your family and nobody else

The controller of personal data is:

KorynLabs S.L.
Tax ID (NIF): B23895097
Address: Carrer d'Emili Juncadella, 36, 08950 Esplugues de Llobregat, Barcelona, Spain
Email: privacy@nidovo.com
Website: https://www.nidovo.com

This policy explains how personal data is processed on the Nidovo public website and, when their features become available, in its apps and family spaces.

It applies to visitors, registered users, administrators, family members, people who contact support and third parties whose data is added to the service, including minors.

Nidovo is aimed at the European Union market and applies the General Data Protection Regulation (GDPR), the complementary Spanish legislation and any other applicable provisions.

Nidovo is designed to organise family memories and information in private environments.

Family spaces are private by default and access to their contents depends on the permissions granted.

We do not sell personal data or family content to advertisers.

We do not use private memories or child profiles for personalised advertising.

Processing will be limited to specified, explicit and legitimate purposes, using the data that is adequate and necessary for each of them.

4.1. Visitor data

When you visit the public site, technical data necessary to deliver the pages, maintain security and diagnose incidents may be processed, such as IP addresses, basic browser information, the date and time of requests and technical server logs.

4.2. Account data

Once the corresponding features are enabled, name, email address, user identifiers, authentication information, account status and functional preferences may be processed.

4.3. Family data

Names of family spaces, identifiers, members, invitations, roles, permissions and declared family relationships may be processed.

The same person may belong to several families. Permissions in one family will not grant access to another.

4.4. Child profiles

Authorised adult members may create profiles relating to minors, which may contain name, relevant dates, photographs, memories and other family data.

Minors do not have their own account or independent access to Nidovo.

Child profiles are information managed by adults, not accounts registered by minors.

4.5. Family content

Photographs, documents, texts, memories and other information added by authorised members may be processed.

This content may include data about people who are not registered and, on occasion, especially sensitive information.

Adding health data, intimate information or other special categories of data requires particular care and an appropriate lawful basis where applicable.

4.6. Support data

Contact details, communications, requests, documents provided to resolve incidents and support records may be processed.

4.7. Subscription data

When payments are enabled, plan data, purchase identifiers, subscription status, renewal dates, amounts and references necessary for contract management may be processed.

Payment data will be processed in accordance with the functions and responsibilities of the relevant provider.

4.8. Security data

Access logs, technical identifiers, IP addresses, security events and information necessary to prevent abuse and protect the service may be processed.

Data may be obtained directly from users, from administrators or members who add family information, from authentication providers, from payment platforms and from the technical systems used to provide the service.

Where data comes from third parties, the applicable information obligations under the GDPR will be assessed.

• Handling enquiries received through the website: pre-contractual measures, legitimate interest or legal obligation, as the case may be.
• Maintaining and protecting the public site: legitimate interest and applicable legal obligations.
• Creating and maintaining adult accounts: performance of the contract.
• Managing families, invitations and permissions: performance of the contract with regard to users and the applicable lawful basis for third-party data.
• Storing family content: performance of the contract with regard to users, without prejudice to the bases required for other people's data.
• Managing child profiles: the lawful basis applicable to the specific processing, taking into account the rights of the minor and the entitlement of the person providing the data.
• Managing subscriptions and billing: contractual performance and legal obligations.
• Handling data protection rights requests: legal obligation.
• Preventing fraud and unauthorised access: legitimate interest, subject to the corresponding balancing test, or legal obligation.
• Carrying out optional analytics: consent where required.
• Sending advertising by email: consent or another specific legal authorisation, with the possibility to object or unsubscribe.

Accepting the terms of use does not constitute general consent to any processing of data.

Nidovo allows memories of minors to be organised through family profiles.

Only adult members with permission to manage profiles can create and manage these profiles.

Minors cannot register or sign in independently.

The adult who adds data about a minor must have sufficient legal entitlement to do so and must respect the minor's best interests, privacy, image and other rights.

Being a Nidovo administrator does not amount to proving parental authority or guardianship.

Where processing requires the consent of the minor or of their legal representatives, the rules applicable in the relevant Member State and to the specific purpose will apply.

In Spain, Article 7 of Organic Law 3/2018 (LOPDGDD) sets out specific rules on the consent of minors in data protection matters. These rules do not replace other legal requirements relating to the image, representation or protection of the minor.

Nidovo may restrict processing, request clarification or handle complaints where there are reasonable doubts about the legitimacy of a profile.

Family memories may contain information about people who do not use Nidovo.

These people retain their data protection rights.

The addition of information by a family member does not remove the obligations that apply to KorynLabs S.L. nor does it guarantee that any given processing is lawful.

Where applicable, the information required by Article 14 of the GDPR will be provided, taking into account the circumstances and the legal exceptions.

Family content is private by default.

Access is limited to authorised members and to the powers associated with their roles.

Belonging to several families does not mean that information is automatically shared between them.

Administrators can manage permissions, but they must respect the individual rights of members and of the people represented in the content.

Technical access by authorised staff or providers must be limited to what is necessary for the corresponding legitimate functions.

Data may be disclosed or made available to:

• Authorised family members, in accordance with the permissions.
• Hosting and infrastructure providers.
• Authentication providers used by the users.
• Subscription and payment management providers, when active.
• Support, maintenance, security and advisory providers subject to the applicable obligations.
• Public administrations, authorities or courts where there is a legal obligation or authorisation.

We do not sell family information to third parties.

Processors must offer adequate guarantees and, where applicable, be bound by the agreements required by Article 28 of the GDPR.

Nidovo's infrastructure envisages OVHcloud hosting services.

The emails sent by the service are delivered through the SMTP service of DonDominio.

Nidovo plans to store photographs and attached files in an S3-compatible object storage service. At the date of this policy this service has not been activated and no specific provider is declared; the provider will be disclosed before file uploads are enabled.

The apps may incorporate Google or Apple authentication services and mobile subscription management through RevenueCat, depending on the features actually used.

Nidovo plans to integrate Stripe for future web payments. As of the date of this policy, web subscription purchases are not offered, so Stripe is not presented as an already operational web payment processor.

Cloudflare is planned as a possible protection and delivery service, but it is not declared active as of the publication date.

Google Analytics 4 and Google Tag Manager are planned for a later phase. They are not declared to be installed or operating on the public website as of the publication date.

Nidovo plans to serve its typefaces from its own infrastructure, without relying on remote requests to Google Fonts during the ordinary loading of the public website. This configuration must be verified before launch.

The list of providers will be updated when the actual processing changes.

Some technology providers may be established outside the European Economic Area or may allow access from third countries.

Where international transfers subject to the GDPR take place, the corresponding legal mechanisms will be used, such as adequacy decisions or appropriate safeguards.

Where necessary, the specific conditions of the transfer and any supplementary measures will be assessed.

Data subjects may request information about the safeguards applied by writing to privacy@nidovo.com.

It is not assumed that all data remain exclusively within the European Union by virtue of KorynLabs S.L. being established in Spain.

Personal data will be retained only for as long as necessary for the corresponding purposes and for the periods required by applicable law.

The following criteria will apply:

Visits and technical logs: for the period that is proportionate and necessary for operation, diagnostics and security.

Enquiries and support: while the request is being handled and, afterwards, for the time necessary to meet obligations or address possible liabilities.

Accounts: while they remain active and during the handling of their closure, without prejudice to retention obligations. When an account is deleted, its credentials and access data are removed, and the person's profile in each family is unlinked and archived (see section 14).

Deleted families: a deleted family stops being available to its members but is kept archived until a request for definitive erasure is handled or the law requires otherwise.

Family content: while it is legitimately kept within the family space and is necessary to provide the service, subject to erasure requests and the rights of third parties.

Child profiles: while an appropriate purpose and lawful basis exist, paying particular attention to the minor's best interests and to legitimate requests.

Billing: for the tax, accounting and contractual periods required once payments are enabled.

Backups: according to documented retention and deletion cycles, with restricted access.

This policy does not set numerical deletion periods that have not yet been technically verified. Data subjects may request information on the criteria and periods that apply to their data.

Users can delete their account from the app and may request the closure of their account and the deletion of their data by writing to privacy@nidovo.com.

By default Nidovo applies logical deletion, not automatic physical deletion:

• When an account is deleted, its credentials, external sign-ins and sessions are removed. That person's profile in each family is unlinked from the account and archived, so it is no longer accessible as a member. Families in which the person was the only member are deleted.
• When a family is deleted (only its owners can do so), the family and its content stop being available to all its members, but they are kept archived.
• Definitive physical deletion of a family or of a person's data is not automatic: it can be requested at privacy@nidovo.com and will be assessed in line with section 16 and the legal exceptions.

Deleting an account does not necessarily mean that all memories contributed to a family must disappear automatically.

Each request will be assessed taking into account the identity of the person making it, the rights of other people, legal obligations and the legitimacy of retaining certain content.

Where appropriate, the data concerned will be deleted, restricted or anonymised.

The fact that content is shared does not automatically rule out the right to erasure.

Requests for access, export and portability will initially be handled through support.

Where the right to data portability applies, the data will be provided in a structured, commonly used and machine-readable format.

The export must respect the rights and freedoms of other people.

A proportionate identity check may be requested where necessary.

Individuals may exercise, in the cases provided for by law, the rights to:

• Access.
• Rectification.
• Erasure.
• Object.
• Restriction of processing.
• Data portability.
• Withdraw consent.
• Not to be subject to certain decisions based solely on automated processing.

Requests must be sent to privacy@nidovo.com.

Nidovo will respond without undue delay and, as a general rule, within a maximum of one month from receipt, without prejudice to the extensions permitted by the GDPR.

Withdrawal of consent will not affect the lawfulness of processing carried out before it was withdrawn.

Minors retain their data protection rights even if they do not have their own account.

Their legal representatives may act where appropriate under the applicable rules.

Nidovo will take into account the minor's age, capacity and best interests, and possible conflicts of representation.

Being a family administrator will not by itself be sufficient to prove entitlement to exercise all rights on behalf of a minor.

KorynLabs S.L. will adopt technical and organisational measures appropriate to the risks of the processing.

Depending on the architecture and the features actually available, these measures will include access controls, protection of communications, credential management, separation of permissions, backups and incident response procedures.

The complete absence of risk is not guaranteed.

Personal data breaches will be documented and, where appropriate, notified to the competent authority and to the affected individuals in accordance with the GDPR.

The public site may use technologies that are strictly necessary for its operation and security.

The apps may use local storage to manage sessions, preferences and technical functions.

An app's local storage is not necessarily equivalent to a browser cookie.

Information about these technologies and the available controls can be found at:

https://www.nidovo.com/cookies

As of the effective date of this policy, Nidovo does not declare that Google Analytics 4 or Google Tag Manager are active on its public website.

If analytics tools requiring consent are added later, they will not be activated before a valid choice has been obtained.

Nidovo plans to limit analytics to public browsing statistics and aggregated measurement, without deliberately sending identifying data about accounts, families, minors or private content.

The use of Google Signals, remarketing or behavioural advertising is not envisaged in the planned configuration.

The Cookie Policy will be updated before or at the same time as any activation.

Nidovo may send communications necessary to respond to requests, manage accounts, report security incidents or comply with contractual obligations.

Commercial communications will be subject to the lawful basis and the specific requirements that apply.

Child profile data will not be used for personalised advertising.

Nidovo does not plan to make decisions based solely on automated processing that produce legal effects or similarly significantly affect data subjects, within the meaning of Article 22 of the GDPR.

Should this change, the information and safeguards required by law would be provided.

Data subjects may contact Nidovo to resolve privacy questions or incidents.

They may also lodge a complaint with the competent supervisory authority.

The reference authority in Spain is the Agencia Española de Protección de Datos (AEPD) (the Spanish Data Protection Agency):

https://www.aepd.es

Residents of other Member States may contact the competent authorities in accordance with the GDPR.

This policy may be amended to reflect legislative or functional changes or changes in the actual processing.

Significant changes will be communicated appropriately.

Where new processing requires consent, it will be requested before the processing begins.

The current version is available at https://www.nidovo.com/privacy.

KorynLabs S.L.
Carrer d'Emili Juncadella, 36
08950 Esplugues de Llobregat, Barcelona, Spain
privacy@nidovo.com

Related documents:

• Terms and Conditions: https://www.nidovo.com/terms
• Cookie and Local Storage Policy: https://www.nidovo.com/cookies