Privacy Policy

The controller of personal data under this Policy is KRIS CORRECT CONSULT 2006 LTD (in Bulgarian: КРИС КОРЕКТ КОНСУЛТ 2006 ЕООД), UIC (ЕИК) 206224007, with its registered office at 79 Louis Ayer Str., entr. B, apt. 4, Manastirski Livadi-Iztok, Triaditsa District, Sofia 1404, Bulgaria. The company trades as Nero Partners and provides NERO.

In this Policy:

• "Nero Partners" means the company named above;
• "NERO" means the business web application for collaboration between Nero Partners and its clients, which Nero Partners provides;
• "staff" means the employees and other team members of Nero Partners to whom it has given access to NERO;
• "client organisation" means a business that is a client of Nero Partners and whose authorised contacts are invited to NERO;
• "service agreement" means the separate agreement between Nero Partners and a client organisation that governs the services Nero Partners provides, including any agreement on the processing of personal data;
• "User" means a person who has an account in NERO: a member of the staff or an authorised contact of a client organisation;
• "workspace" means the projects, content and data that NERO holds for Nero Partners and the client organisation concerned;
• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation);
• "you" means the person whose personal data is concerned and who reads this Policy.

For questions about this Policy or the processing of your personal data, and to exercise your rights, write to k.georgiev@neropartners.bg. This is Nero Partners' single e-mail address for support, privacy and legal matters.

Letters may also be sent to the registered office stated in the section "Controller".

This Policy applies to the processing of personal data in connection with NERO: the data of Users, that is members of the staff and authorised contacts of client organisations, and, to the extent Nero Partners is responsible for it, the data of other people that appears in NERO.

NERO is a business application with access by invitation only. It is not intended for individuals acting outside their trade or profession and is not open to the public: nobody can register on their own. Staff accounts are created by Nero Partners, and contacts of client organisations join by a personal invitation from Nero Partners.

This Policy does not cover the website neropartners.bg or the other services of Nero Partners. For members of the staff, it supplements the information that Nero Partners gives them as their employer or as the party that engages them. The cookies and similar technologies that NERO uses are described in the Cookie Policy.

This Policy is issued under the GDPR and the Bulgarian Personal Data Protection Act.

Nero Partners is the controller of the personal data it processes to provide, administer and secure NERO, in particular:

• account data and the data needed for signing in and for managing access;
• data processed for security and the prevention of abuse, including logs;
• administration data, including invitations and the records of acceptance and acknowledgement of NERO's legal documents;
• its own business communications with Users and client organisations.

For personal data that a client organisation puts into its workspace, or that is put there on its behalf, such as data about its own customers, employees or contacts, or personal data contained in marketing data, Nero Partners may act as processor on behalf of that client organisation. Which role applies follows from who determines the purposes and means of the processing, as set out in the service agreement with the client organisation and in accordance with the applicable law. Where Nero Partners acts as processor, the client organisation is the controller: it determines the purposes and means of the processing, and Nero Partners processes the data only on its documented instructions, unless Union or Bulgarian law requires otherwise, as Article 28 GDPR provides.

Questions about personal data for which a client organisation is the controller should be addressed to that client organisation. If you contact Nero Partners about such data, it will forward your request to the client organisation and assist it in responding.

Depending on your role and on how you use NERO, Nero Partners processes the following personal data:

• Account and identity: name, business e-mail address, job title, interface language, text size preference, time zone, account status (active or deactivated) and, if you add them, phone number, location and profile picture.
• Authentication and sessions: the password you choose, which the authentication provider stores only in hashed form and which no one at Nero Partners can see; data about your sessions, including whether you chose "Remember me"; and, if you have set it up, a two-step verification factor (an authenticator application).
• Roles and access: membership of the organisation and the role in it, the role and status of a contact of a client organisation, project memberships and teams.
• Work and collaboration: projects, tasks and to-dos, message board posts, comments and reactions, direct and group chat messages, voice messages (recorded in the browser through the microphone only when you start a recording), documents and uploaded files and their versions, links, approvals, client requests, check-in answers and personal notes.
• Meetings and availability: meetings and meeting requests, calendar events, working days and hours, time zone and out-of-office periods.
• Use within NERO: notifications, reminders, bookmarks and preferences; read receipts, which show the staff when a contact of a client organisation has read an item (contacts of client organisations do not see when members of the staff have read an item); and workload views and person profiles, which show, for example, a person's active, overdue and recently completed tasks, projects, files, meetings and recent activity.
• Logs and administration records: audit events and activity logs, which record who did what and when, with the state before and after a change; invitation records (the e-mail address, a one-way hash of the invitation link, never the link itself, its expiry and who created it); and records of people leaving a team or a client.
• Records of legal documents: for each acceptance of the Terms of Use and each acknowledgement of this Policy and the Cookie Policy, the account and the organisation, the document, its version, the language in which it was shown, a SHA-256 hash of the exact text, the server time of the act and whether it was an acceptance or an acknowledgement. No IP address, browser fingerprint or password is recorded.
• Business data of client organisations, insofar as it contains personal data: names and legal names of clients, websites, internal notes, contracts, invoices, performance records and creatives.
• Reporting and integration data: marketing performance figures entered manually, imported from CSV or XLSX files or, where a connection has been configured for a client, read from a connected platform; and the details of such a connection (the platform, the account name and identifier, its status, who set it up and when, and the access credentials issued by the platform). These figures are mostly aggregated, but may contain personal data where their source does.
• Support communications: your messages to Nero Partners and its replies.
• Technical and security data: to limit abuse, NERO's server processes the IP address of a request transiently and stores, for a short period, only a keyed one-way hash (HMAC) of it and, for some requests, of the account or e-mail address concerned. The tables in which NERO keeps its own data store no IP address and no browser identification data. The authentication and hosting providers process technical data, such as IP addresses and browser and device information, in their own records and logs in order to provide and secure the service.

Your name and business e-mail address are needed to create your account, and without them you cannot use NERO. Phone number, location and profile picture are optional.

Nero Partners obtains personal data:

• from you, when you activate and use your account and when you contact Nero Partners;
• from your employer or the client organisation you represent, which has named you as its contact, and from other Users who enter information about you in the course of the work;
• from the staff of Nero Partners, who create staff accounts, invite contacts of client organisations and administer access;
• from connected services, only where a connection has been configured, for example figures read from an advertising platform for a client;
• from your use of NERO, which produces logs, read receipts, notifications and similar records.

Nero Partners processes personal data for the following purposes:

1. (a)Accounts and access: creating and administering accounts on invitation, signing in, and managing roles and access to the organisation, clients and projects.
2. (b)Providing NERO: projects and workspaces, tasks and to-dos, message boards, comments and chat, including voice messages, documents and files, links, approvals and client requests, meetings, calendar and availability, check-ins, notifications, reports, the creatives library and the client portal.
3. (c)Organising the work: planning and distributing the work of the staff and coordinating it with clients, through availability, workload views, person profiles and read receipts.
4. (d)Reporting: entering, importing and, where a connection is configured, reading marketing performance figures, and presenting them to the staff and to the client organisation.
5. (e)Security and prevention of abuse: protecting NERO, its Users and the data in it against unauthorised access, abuse and fraud, and investigating incidents.
6. (f)Legal documents: recording acceptance of the Terms of Use and acknowledgement of this Policy and the Cookie Policy, and being able to demonstrate them.
7. (g)Communications and support: messages about accounts, security and the operation of NERO, password-reset e-mails you request, and answers to your enquiries.
8. (h)Legal obligations: complying with obligations under applicable law, such as accounting and tax law, requests of competent authorities and requests under data protection law.
9. (i)Legal claims: establishing, exercising or defending legal claims.
10. (j)Continuity: restoring items from the Trash while they are kept there, and recovering the service from backups after an incident.

Nero Partners does not use personal data processed in NERO for advertising, for marketing through NERO or for purposes incompatible with those listed above.

Each purpose relies on a legal basis under Article 6(1) GDPR:

Processing based on legitimate interests may take place only where those interests are not overridden by your interests or fundamental rights and freedoms, and you have the right to object to it (see the section "Your rights").

None of the processing described in this Policy is based on consent. Accepting the Terms of Use and acknowledging this Policy are not consent to the processing of personal data. When a voice message is recorded, the microphone is used only when you start the recording and only after you have allowed it in your browser.

To keep NERO and the data in it secure, and to prevent abuse and fraud, Nero Partners processes personal data as follows:

• your identity is verified when you sign in and, if you have set it up, by two-step verification;
• the number of certain requests that can be made within a period is limited; for this purpose, NERO's server processes the IP address of a request transiently and stores, for a short period, only a keyed one-way hash of it;
• a session that is not remembered ends after 12 hours without use, signing out ends your sessions on all devices, and the sessions of an account that is deactivated are ended;
• audit events and activity logs are recorded, so that changes can be traced, incidents investigated and content restored;
• the authentication and hosting providers process technical data, such as IP addresses and browser and device information, in order to provide and secure the service.

A check for protection against automated programs (bots) may be enabled on the sign-in and invitation forms in future. Before it is enabled, the Cookie Policy will name its provider and this Policy will be updated.

These measures are described only in general terms, so as not to reduce their effectiveness. The measures that protect personal data are set out in the section "Security measures".

NERO itself sends only one kind of e-mail: the password-reset message, which is sent only when you request it, through the e-mail service used by the authentication provider.

Invitation and activation links, and any other sign-in details needed to activate an account, are given to you by Nero Partners through its own business channels. Within NERO, you receive notifications about activity that concerns you.

Messages about your account, its security and the operation of NERO are service messages. They are separate from marketing: they are sent because they are needed to provide NERO and keep it secure, and they do not depend on whether you have agreed to receive marketing. Nero Partners does not send marketing messages through NERO.

Users and client organisations may put into NERO personal data of other people, for example of a client organisation's customers, employees, contractors or contacts, in files, messages, reports or marketing data.

The client organisation or User who provides such data is responsible for ensuring that:

• they are entitled to provide the data and have a legal basis for doing so;
• the people concerned have been informed where the law requires it, including that their data will be processed in NERO;
• the data is accurate, limited to what the work requires and not made available in NERO more widely than necessary.

NERO is not intended for special categories of personal data (such as data concerning health, religious or philosophical beliefs or political opinions) or for personal data relating to criminal convictions and offences. Such data should not be entered unless this is necessary and lawful.

Where Nero Partners processes such data as processor, it does so on behalf of the client organisation as controller, as described in the section "Controller and processor roles".

Within NERO, personal data is available to other Users only to the extent their role and access allow: to members of the staff according to their role and the clients and projects they work on, and to the contacts of a client organisation for what concerns that client organisation and has been made available to them.

Nero Partners uses the following service providers, which process personal data on its behalf to the extent their service requires:

Personal data may also reach:

• connected platforms (Meta, Google Ads, Google Analytics 4, Klaviyo, Shopify, TikTok Ads, LinkedIn Ads and theMarketer and, where it is enabled, Google Calendar), only where a connection has been configured. NERO sends them the requests and access credentials needed to read data and performs only reads: it does not create, pause or change anything on those platforms. Each platform processes data under its own terms;
• websites whose icons or logos appear in NERO: when NERO shows a link card, or a logo set as a web address, your browser loads the icon or logo directly from that website, which, like any website, can see your IP address and browser information;
• a successor or acquirer of all or part of Nero Partners' business in the event of a reorganisation, merger or transfer of the business, which will continue to process the data in accordance with this Policy;
• professional advisers bound by confidentiality, such as lawyers, accountants and auditors, and courts and public authorities, where this is required by law or necessary to establish, exercise or defend legal claims.

No personal data is sent when NERO obtains currency reference rates from the European Central Bank. Nero Partners does not sell personal data and does not share it for advertising.

NERO's data is hosted with Supabase, and the application is run by its hosting provider, in the regions selected for the service. In the environment in which NERO is developed, data is hosted with Supabase in the European Union (Ireland).

Service providers or their sub-processors may process personal data outside the European Economic Area (EEA). Where personal data is transferred to a country outside the EEA, Nero Partners relies on the safeguards provided for in Chapter V GDPR: an adequacy decision of the European Commission, where one applies, or the Standard Contractual Clauses adopted by the European Commission.

When your browser loads an icon or logo from a website, it contacts that website directly, wherever that website is hosted.

You can obtain information about the safeguards used, and a copy of them, by writing to k.georgiev@neropartners.bg.

Nero Partners keeps personal data only for as long as is necessary for the purposes for which it is processed. The following periods apply:

Data needed to establish, exercise or defend legal claims may be kept for longer, but only for that purpose and for as long as necessary. Settings kept in your browser's local storage are described in the Cookie Policy.

The database is backed up as part of the backup cycle of the database provider. Data deleted from NERO may remain in a backup until that backup is replaced in the ordinary course of the cycle.

Backups are restored only where this is needed to recover the service, for example after a technical failure or a loss of data, and are not used for any other purpose.

Nero Partners applies technical and organisational measures appropriate to the risk, including:

• access control based on roles, so that each User sees and changes only what their role and access allow;
• access restrictions at the level of individual records in the database;
• encrypted connections between your browser and NERO;
• passwords kept by the authentication provider only in hashed form, and the option of two-step verification with an authenticator application;
• limits on repeated requests and the automatic ending of sessions;
• logging of significant actions in audit and activity logs.

No system is completely secure, and Nero Partners cannot guarantee absolute security. You can help protect your account by keeping your password confidential, using two-step verification where it is available, signing out on shared devices and informing Nero Partners without delay at k.georgiev@neropartners.bg if you suspect unauthorised access.

In the event of a personal data breach, Nero Partners notifies the Commission for Personal Data Protection and the persons affected where and as the GDPR requires; where it acts as processor, it informs the client organisation without undue delay.

Under the GDPR, and subject to the conditions it sets, you have the right:

• of access to your personal data and to a copy of it (Art. 15);
• to rectification of inaccurate or incomplete data (Art. 16); some details, such as your name, profile picture, phone number and location, you can change yourself in your settings in NERO;
• to erasure (Art. 17), where one of the grounds provided for applies and no exception does;
• to restriction of processing (Art. 18);
• to data portability (Art. 20), for data you have provided that is processed by automated means on the basis of a contract or consent;
• to object to processing (Art. 21), as described below.

Right to object. You may object at any time, on grounds relating to your particular situation, to processing based on the legitimate interests of Nero Partners or of a client organisation. Nero Partners will then no longer process the data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

To exercise your rights, write to k.georgiev@neropartners.bg. NERO has no function for downloading your own personal data, so requests are handled by e-mail. Nero Partners may ask for information needed to confirm your identity, for example that you write from the e-mail address of your account.

Nero Partners responds without undue delay and in any event within one month of receiving the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months, in which case you will be informed of the extension and the reasons for it within the first month. Exercising your rights is free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, Nero Partners may charge a reasonable fee or refuse to act on it, as the GDPR allows.

Where Nero Partners acts as processor for a client organisation, it forwards your request to that client organisation without undue delay and assists it in responding.

The right to withdraw consent applies only to processing based on consent. None of the processing described in this Policy is based on consent.

If Nero Partners asks for your consent for a specific purpose, it will do so separately from this Policy, and you may withdraw that consent at any time, as easily as you gave it, by writing to k.georgiev@neropartners.bg. Withdrawal does not affect the lawfulness of processing carried out before it.

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (Комисия за защита на личните данни), cpdp.bg.

You may also lodge a complaint in the EU Member State where you habitually reside or work or where the alleged infringement took place, and you have the right to an effective judicial remedy. Nero Partners would welcome the opportunity to address your concern first at k.georgiev@neropartners.bg, but this is not a condition for lodging a complaint.

NERO does not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

Workload views, person profiles, read receipts and reports are information for the people who use NERO. Decisions about the work and the business relationship are taken by people.

Nero Partners does not sell, rent or trade personal data and does not share it with third parties for advertising. NERO uses no advertising or analytics services, tracking pixels, social media plug-ins or session recording.

Nero Partners may amend this Policy to reflect changes in NERO, in the law or in the way personal data is processed. Each version is published with its number and the date on which it takes effect.

Where a change is material, Nero Partners informs Users of it in NERO or through its business channels, and the amended Policy may be presented to them for acknowledgement again when they next use NERO. Changes that are not material, such as corrections of wording, are published on this page.

This is version 1.0 of the Privacy Policy of NERO. It is effective from 19 October 2026. This Policy is published in Bulgarian and in English; in the event of a discrepancy between the two texts, the Bulgarian text prevails.

Questions about this Policy and requests concerning your personal data: k.georgiev@neropartners.bg. Controller: KRIS CORRECT CONSULT 2006 LTD, trading as Nero Partners, UIC 206224007, registered office: 79 Louis Ayer Str., entr. B, apt. 4, Manastirski Livadi-Iztok, Triaditsa District, Sofia 1404, Bulgaria.