• Types of Data Collected: We collect personal information directly from you when you fill out forms on our website or social media channels, interact with us in person, or communicate via telephone, email, or direct mail. This data includes your name, company, email address, telephone number, and other relevant information.
• Purpose: This data is used to respond to your requests for information, provide our services, facilitate product demos and gated content, manage your newsletter subscriptions, and enhance our customer relationship management. It also helps us tailor our communications based on your expressed interests.

• Types of Data Collected: We may obtain data such as your name, job title, company affiliation, contact information and other relevant professional information from publicly available sources, including business directories and databases.
• Purpose: This information helps us enrich our CRM records and identify potential business prospects. It is used to improve our business intelligence and tailor our marketing strategies to reach relevant audiences effectively.

• Types of Data Collected: We may obtain personal data such as your name, job title, company affiliation, contact information and other relevant professional information from Third Party platforms, including social media sites or professional networking platforms. We may also utilise Third Party B2B data providers and business intelligence platforms, such as Dun & Bradstreet Hoovers, ZoomInfo Technologies LLC (‘ZoomInfo’), and HubSpot, Inc. (‘HubSpot’, including its Breeze Intelligence features)
• Purpose: This information helps us enrich our CRM records, identify potential business prospects, understand organisational website visits, and gather inferred purchase intent signals based on online activity. For more information on the data practices of these providers, please review Dun & Bradstreet’s Privacy Policy, ZoomInfo’s Privacy Policy and HubSpot’s Privacy Policy. If you apply for a job we may also receive employment, identity and contact data from Third Party recruitment agencies.

• Types of Data Collected: We work with Third Party advertising platforms, such as Meta, LinkedIn, Google Ads and BrandGen.io these platforms may collect data such as IP addresses or cookie IDs. For more information on the data practices of these providers, please review Linkedin’s Privacy Policy, Meta’s Privacy Policy, Google’s Privacy Policy and BrandGen.io’s Privacy Policy.
• Purpose: Used to deliver targeted advertising campaigns to specific companies or professional contacts, based on our legitimate interests in reaching relevant business audiences.

• Types of Data Collected: We may use cookies and similar technologies to collect information about your interactions with our website and services, such as technical data about your equipment, browsing actions, traffic origin, pages visited and patterns. Some Third Party services we use, such as those for website analytics and identifying organisational visitors, may also utilise cookies or analyse technical data like IP addresses in connection with your visit to our website. For more details, please see our Cookie Policy.
• Purpose: To operate and improve our website, analyse how visitors use it (website analytics), understand traffic sources, identify visiting organisations for business purposes, and enhance overall user experience.

The data we collect may be shared with third parties as outlined in our Data Sharing section. Please visit the corresponding section to get more information on how we share your data.

5. How and Why Nezasa Uses Your Data (Purposes & Legal Basis)

5.1. Our Approach

Nezasa processes your personal data only for specific, explicit, and legitimate purposes. We ensure that for each purpose, we have a valid legal basis under applicable data protection laws (like GDPR and Swiss FADP). The primary legal bases we rely on are:

• Performance of a Contract: Processing necessary to fulfil our contractual obligations to you or to take steps at your request before entering into a contract.
• Legitimate Interests: Processing necessary for our legitimate business interests (or those of a Third Party), provided these interests are not overridden by your fundamental rights and freedoms. We conduct balancing tests for activities based on legitimate interests.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent for one or more specific purposes. You have the right to withdraw your consent at any time (see Section 11).
• Legal Obligation: Processing necessary to comply with a legal or regulatory requirement to which Nezasa is subject.

5.2. Processing Activities, Data Used, Purposes, and Legal Bases

The table below provides details on our main data processing activities concerning data collected via this website, the types of personal data typically involved (referencing categories defined in Section 4), the specific purposes, and the legal basis relied upon for each activity.

5.3. Important Notes on Processing

For each processing activity, we carefully consider the impact on your privacy and ensure compliance with applicable data protection laws. Please also note that:

• Multiple Bases: In some instances, we may rely on more than one legal basis for processing the same personal data.
• Failure to Provide Data: If we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract (e.g., provide you with services). We will notify you if this is the case at the time.
  If you have questions about the specific legal basis for a particular processing activity, please contact us using the details provided in section 2. You may withdraw your consent at any time.

6. Cookies and Tracking Technologies

6.1. Explanation of Cookies and Similar Technologies

Our website uses cookies and similar tracking technologies (such as pixels, web beacons, and local storage) to function effectively and gather information about your interaction with our services. Cookies are small text files placed on your computer, tablet, or mobile device when you visit a website. These technologies allow us and our Third Party partners to collect data as you navigate and interact with our site, including Technical Data and information about your Browse actions and patterns (as described in Section 4.2). This can involve both session cookies (which expire when you close your browser) and persistent cookies (which stay on your device for a set period).

6.2. Purposes of Use

We utilise these technologies for various purposes integral to our operations and service improvement, directly supporting the activities outlined in Section 5 (‘How and Why We Use Your Data’). Key purposes include:

• Essential Operations: Enabling core website functionality, security features, and network management. These are necessary for the website to work correctly.
• Performance and Analytics: Helping us understand how visitors use our website, measuring traffic sources and site performance, identifying technical issues, and gathering aggregated data to improve our content and services (relates to Purpose 5.3).
• Functionality and Preferences: Remembering choices you make (like language or region) to provide a more convenient and potentially personalised experience.
• Marketing and Advertising: Assessing the effectiveness of our marketing campaigns, supporting targeted advertising efforts (both on our site and potentially on Third Party sites), and gathering insights for business development (relates to Purpose 5.2).

6.3. Purposes of Use

This section provides a summary. For comprehensive and specific details about every cookie we use, the exact purpose and duration of each cookie, and information about the third parties who may place cookies via our site, please read our dedicated: Cookie Policy.

6.4. Managing Your Preferences and Consent

You have control over the use of non-essential cookies. You can typically manage your settings and consent preferences through the Cookie Consent Banner/Tool or through your Browser Settings. Please be aware that if you disable or refuse cookies, especially essential ones, some parts of this website may become inaccessible or not function properly.

7. 7. Data Sharing and Third Parties

7.1. Our Approach to Data Sharing

We value your privacy and do not sell, rent, or lease your personal data collected to third parties for their independent use.

However, we may need to share your personal data with certain trusted third parties to operate our website, provide our services, and achieve the specific purposes outlined in Section 5 (‘How and Why We Use Your Data’). We only share information necessary for these purposes and require third parties to respect the security of your personal data and treat it in accordance with the law.

7.2. Categories of Third Parties

We may share your personal data with the following categories of recipients:

• Service Providers: Companies that provide services on our behalf to help us operate our business and website. This includes providers of IT infrastructure (like cloud hosting), data analytics, security services, payment processing, customer support tools, and marketing/sales support platforms. These providers are only permitted to process your data based on our instructions and for the specific services they render to us.
• Marketing and Advertising Partners: We may work with Third Party advertising networks (e.g., LinkedIn, Google Ads, Meta), analytics providers, and other marketing partners to help us deliver targeted advertising, measure campaign effectiveness, and understand website traffic and user trends. This may involve sharing technical data, aggregated data, or potentially pseudonymised identifiers or targeted lists for specific campaigns (processed according to legal requirements).
• B2B Data Providers & Business Intelligence Services: As mentioned in Section 4 and 5, we use Third Party services (like Hoovers, ZoomInfo, HubSpot Intelligence features) to enrich our business contact data and gain insights into organisational interests. This primarily involves receiving data from them, but usage may involve interaction with their platforms.
• Business Partners: This may include affiliates or trusted partners providing complementary services or technology integrated with our offerings.
• Third Party Services You Integrate: If you, as a user of Nezasa’s software solutions, choose to integrate Third Party applications or services with our platform, data may be shared with those services based on your configuration and instructions. Their use of your data is governed by their respective privacy policies.
• Legal and Regulatory Authorities: We may disclose your personal data if required by law, regulation, legal process (like a court order or subpoena), or governmental request. We may also share data to protect our rights, property, or safety, or that of our users or the public, including for fraud prevention.
• Parties Involved in Corporate Transactions: In the event of a proposed or actual reorganisation, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock, your personal data may be shared with the relevant third parties (and their advisors) involved in the transaction, subject to confidentiality obligations.

7.3. Sub-processors

Where third parties are given access to Personal Data, we will take appropriate and necessary contractual, technical and organisational measures designed to ensure that personal information is processed only to the extent that such processing is necessary, consistent with this Privacy Policy, and in accordance with applicable law. Our current list of sub-processors is available here.

7.4. Protecting Your Data When Shared

We take steps to ensure that third parties receiving your personal data provide adequate protection. We require them, typically through contractual agreements, to safeguard the information, use it only for the specific purposes for which it was provided under our instructions, and not use it for their own direct marketing purposes unless you have separately consented with them. We employ appropriate contractual, technical, and organisational measures designed to ensure data protection when sharing information.

7.5. Protecting Your Data When Shared

Our website may contain links to other websites operated by third parties. This policy does not apply to those external sites. We recommend reviewing the privacy policies of any Third Party websites you visit.

8. International data transfers

Nezasa is a Swiss company that operates globally, processing data for individuals worldwide. To conduct our business, we may need to transfer your personal information outside of your state, province, or country, including to the United States. Additionally our Third Party service providers or subprocessors may be located outside the European Economic Area (EEA). When this is the case, their processing of your personal data involves a transfer of data outside the EEA.

This data may be subject to the laws of the countries where we send it. We take steps to protect your information when we send your information across borders. To ensure a consistent level of protection for your personal data, we employ the following safeguards whenever we transfer it outside the EEA:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For more information, please refer to the European Commission’s guidelines on the adequacy of data protection in non-EU countries.
• Where we use certain service providers not under the category above, including those located in the US, we may use specific contracts approved by the European Commission, known as Standard Contractual Clauses (SCCs), which give personal data an equivalent level of protection to which it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.

9. Data Security

The security of your personal information is a priority and we’ve put in place appropriate measures to prevent unauthorised access, alteration, disclosure, or loss of your information. Access to your data is restricted to employees, agents, contractors, and third parties who have a legitimate business need to know. These individuals are bound by confidentiality obligations and process your information on our behalf.

We have established procedures to address any suspected data breaches and will notify you and relevant regulators as required by law.

When transmitting sensitive information, such as credit card numbers, we employ encryption protocols like Secure Sockets Layer (SSL) to safeguard your data during transmission.

10. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements.

Retention periods will be determined by factors such as the volume, nature and sensitivity of the data, the risk of harm from unauthorised access, the purposes of the processing, alternative means of performance and legal obligations.

To inquire about retention periods for specific types of data, please contact us using the contact details provided in section 2.

11. Your Privacy Rights

11.1. Options regarding your personal data

• Access Your Data: Request a copy of the information we hold about you to verify its accuracy and processing basis.
• Correct Your Data: Request the correction of any inaccurate or incomplete data we hold about you.
• Delete Your Data: Ask us to delete your information if it’s no longer necessary for the purposes for which it was collected, or if you withdraw your consent. However, in some cases, legal obligations may prevent us from complying with this request.
• Object to Processing : Object to the use of your data for a particular purpose, especially if it affects your privacy. our data being used for a specific purpose, particularly if it impacts your privacy. We’ll weigh your request against the legitimate reasons we have for processing your data.
• Restrict Processing: Request us to temporarily pause processing your data under specific circumstances, such as verifying its accuracy, contesting its use, or needing it for legal reasons.
• Data Portability: Request a transfer of your data to you or a Third Party in a structured and commonly used format. This applies primarily to automated information you initially consented to us using or data used to fulfil a contract with you.

11.2. Withdraw Consent

You can withdraw your consent for us to process your data at any time. This doesn’t affect the legality of processing done before your withdrawal, and some services may become unavailable.

11.3. Right to Opt-Out of Marketing Communications

You have the right to request that we stop sending you marketing communications. To opt-out or unsubscribe, i.e. to stop receiving communications from us, you can follow the unsubscribe instructions included in any marketing email or contact us directly using the details provided in Chapter 2.

Please note that unsubscribing from operational communications may result in the loss of important information related to your account, such as: e.g., billing info, policy changes, service terms and conditions updates and product updates. We recommend that you consider this option carefully to ensure that you remain informed about matters relevant to your service.

If you have any questions or need assistance with opting out, please contact us.

11.4. Process for exercising rights

To exercise any of these rights, contact us at privacy@nezasa.com or use the contact details available in section 2.

When you exercise your legal rights:

• There’s typically no charge for accessing or managing your data. However, excessively repetitive or unfounded requests may incur a reasonable fee, or we may be unable to fulfil them.
• In order to ensure data security, we may ask for specific information. This helps prevent unauthorised access to your data. We might also contact you for additional details to process your request efficiently.
• We aim to respond to all legitimate requests within one month. Complex requests or multiple requests may take longer, but we’ll keep you informed in such cases.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, service offerings, business operations, or applicable laws and regulations.

When we make changes to this Privacy Policy, we will post the revised version on this website and update the “Effective Date” listed at the end [or top] of this document. We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your personal information.

Effective as of 5 May, 2025