xDesk Privacy Policy

Last updated: 16 August 2023 · Controller: Nas-Tech · info@nas-tech.com

This Privacy Policy describes our policies and procedures on the collection, use and disclosure of your information when you use the Service, and tells you about your privacy rights and how the law protects you. We use your personal data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and definitions

Words with an initial capital letter have meanings defined under the following conditions. The following definitions have the same meaning regardless of whether they appear in singular or plural.

• Account: a unique account created for you to access our Service or parts of it.
• Business (for the purpose of the CCPA): the legal entity that collects Consumers' personal information and determines the purposes and means of processing it, doing business in the State of California.
• Company (“the Company”, “We”, “Us”, “Our”): the developer of xDesk. For the purpose of the GDPR, the Company is the Data Controller.
• Consumer (for the purpose of the CCPA): a natural person who is a California resident, as defined by law.
• Country: Italy.
• Data Controller (for the purpose of the GDPR): the Company, as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.
• Device: any device that can access the Service, such as a computer, a mobile phone or a digital tablet.
• Do Not Track (DNT): a concept promoted by US regulatory authorities, in particular the Federal Trade Commission, for the Internet industry to develop a mechanism letting users control the tracking of their online activities.
• Personal Data: any information relating to an identified or identifiable natural person — a name, an identification number, location data, an online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity (GDPR); for the purpose of the CCPA, any information that identifies, relates to, describes or could reasonably be linked, directly or indirectly, with you.
• Sale (for the purpose of the CCPA): selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating a Consumer's personal information to another business or a third party for monetary or other valuable consideration.
• You: the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service. Under the GDPR you may be referred to as the Data Subject.

Collecting and using your personal data

Personal data

While using our xDesk App, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. It may include, but is not limited to:

• Email address
• First name and last name
• Phone number
• Username
• Usage data

Usage data

Usage Data is collected automatically while using the xDesk App and serves only to improve the usability and performance of the application. It may include diagnostic data, usage times and crash logs.

Tracking technologies and cookies

We do not use cookies or tracking technologies. Location services are used only when a particular position needs to be saved in the user's data: the location is stored only in your private database and we cannot access it.

Use of personal data

The only use xDesk makes of personal data such as email address, phone number, first and last name and username is to enable the sharing features of xDesk. Of these, only the username is mandatory; all the others are entirely optional.

The username is used only to identify who shared a given piece of data, who wrote a note, who edited a value, and it is linked to a unique identifier that is generated automatically and is not directly linked to the user.

Diagnostic data and crash logs are used for the sole purpose of improving xDesk. We may share diagnostic data with our engineers to find bugs and improve our software.

Retention and transfer of your personal data

xDesk does not keep any of your data in a database accessible to us: your data resides exclusively in your own private cloud database and is not accessible to us in any way.

Your information, including Personal Data, is stored on Apple CloudKit Services. This means that such information may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction, where data protection laws may differ from those of your jurisdiction. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

Disclosure of your personal data

Business transactions

If the Company is involved in a merger, acquisition or asset sale, your Personal Data may be transferred to other external cloud storage. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement and other legal requirements

Under certain circumstances, the Company may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency). The Company may also disclose your Personal Data in the good faith belief that such action is necessary to:

• comply with a legal obligation;
• protect and defend the rights or property of the Company;
• prevent or investigate possible wrongdoing in connection with xDesk;
• protect the personal safety of users of xDesk or of the public;
• protect against legal liability.

Security and processing information

The security of your personal data is important to us, but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

The service providers we use may have access to your Personal Data. These third-party vendors collect, store, use, process and transfer information about your activity on our Service in accordance with their own Privacy Policies.

Email marketing

xDesk does not use your personal data for email marketing.

Payments

We may provide paid products and/or services within the Service. In that case, we may use third-party services for payment processing. We will not store or collect your payment card details: that information is provided directly to our third-party payment processors, whose use of your personal information is governed by their Privacy Policy. Our payment system relies entirely on in-app subscriptions through Apple's App Store.

GDPR privacy

Legal basis for processing personal data

We may process Personal Data under the following conditions:

• Consent: you have given consent to processing for one or more specific purposes.
• Performance of a contract: provision of Personal Data is necessary for the performance of an agreement with you and/or for any pre-contractual obligations.
• Legal obligations: processing is necessary to comply with a legal obligation to which the Company is subject.
• Vital interests: processing is necessary to protect your vital interests or those of another natural person.
• Public interests: processing is related to a task carried out in the public interest or in the exercise of official authority vested in the Company.
• Legitimate interests: processing is necessary for the purposes of the legitimate interests pursued by the Company.

In any case, the Company will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Your rights under the GDPR

The Company undertakes to respect the confidentiality of your Personal Data and to guarantee you can exercise your rights. If you are within the EU, you have the right to:

• Request access to your Personal Data: access, update or delete the information we hold about you, and receive a copy of it. Where possible you can do this directly in the settings; if you are unable to, please contact us and we will assist you.
• Request correction of any incomplete or inaccurate information we hold about you.
• Object to processing of your Personal Data where we rely on a legitimate interest, and in any case to processing for direct marketing purposes.
• Request erasure of your Personal Data where there is no good reason for us to continue processing it.
• Request the transfer of your Personal Data, to you or to a third party you have chosen, in a structured, commonly used, machine-readable format. This right applies to automated information which you initially consented for us to use, or where we used the information to perform a contract with you.
• Withdraw your consent to the use of your Personal Data. If you withdraw your consent, we may not be able to provide you with access to certain specific features of the Service.

You may exercise your rights of access, rectification, erasure and objection by contacting us. We may ask you to verify your identity before responding to such requests. We will do our best to respond as soon as possible. You also have the right to complain to a Data Protection Authority about our collection and use of your Personal Data: if you are in the European Economic Area, please contact your local data protection authority.

CCPA privacy

This section supplements the information contained in our Privacy Policy and applies solely to visitors, users and others who reside in the State of California.

Categories of personal information collected

Below are the categories defined by the CCPA and our good-faith indication of which may have been collected in the past twelve (12) months.

• Category A — Identifiers (real name, alias, postal address, unique or online identifier, IP address, email address, account name and similar). Collected: yes.
• Category B — Information under Cal. Civ. Code § 1798.80(e) (name, signature, physical characteristics, address, phone number, identity documents, financial, medical or health insurance information). Collected: no.
• Category C — Protected classification characteristics (age, race, ancestry, national origin, religion, marital status, disability, sex, sexual orientation, veteran or military status, genetic information). Collected: no.
• Category D — Commercial information (records and history of products or services purchased or considered). Collected: yes.
• Category E — Biometric information (physiological or behavioural characteristics, sleep, health or exercise data). Collected: yes.
• Category F — Internet or other similar network activity (interaction with our Service or advertisement). Collected: no.
• Category G — Geolocation data (approximate physical location). Collected: yes.
• Category H — Sensory data (audio, electronic, visual and similar information). Collected: yes.
• Category I — Professional or employment-related information. Collected: no.
• Category J — Non-public education information (FERPA). Collected: no.
• Category K — Inferences drawn from other personal information (profiles reflecting preferences, characteristics, behaviour, attitudes). Collected: no.

Under the CCPA, personal information does not include publicly available information from government records, deidentified or aggregated consumer information, or information excluded from the CCPA's scope (for example information covered by HIPAA and the CMIA, clinical trial data, or information covered by the FCRA, GLBA, FIPA and the Driver's Privacy Protection Act of 1994).

Sources of personal information

We obtain the categories listed above directly from you: for example from forms you complete in xDesk to enable the data sharing feature. Biometric data, audio recording, image capture and location are used only through your use of xDesk.

Use for business or commercial purposes

• To operate our Service and provide it to you.
• To provide support and respond to your requests, investigate and address your concerns, monitor and improve our Service.
• To fulfil or meet the reason you provided the information.
• To respond to law enforcement requests and as required by applicable law, court order or governmental regulations.
• For internal administrative and auditing purposes.
• To detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity.

Should we decide to collect additional categories of personal information, or use the personal information we collected for materially different, unrelated or incompatible purposes, we will update this Privacy Policy.

Your rights under the CCPA

• The right to notice: to be informed which categories of personal data are collected and the purposes for which they are used.
• The right to request: disclosure of information about the collection, use, sale, disclosure for business purposes and sharing of personal information, including the categories collected, the sources, the purposes, the categories of third parties and the specific pieces of information collected.
• The right to opt out of the sale of personal data.
• The right to delete personal data, subject to certain exceptions (completing a transaction, detecting security incidents, debugging, free speech, public-interest research, legal obligations and other lawful internal uses compatible with the context in which you provided the information).
• The right not to be discriminated against for exercising your rights, including through denying goods or services, charging different prices or rates, providing a different level or quality of goods or services.

Exercising your CCPA data protection rights

To exercise any of your rights, and if you are a California resident, you can contact us by email at info@nas-tech.com. Only you, or a person registered with the California Secretary of State whom you authorise to act on your behalf, may make a verifiable request. The request must provide sufficient information to allow us to reasonably verify your identity, and describe the request with enough detail for us to understand, evaluate and respond to it.

The requested information will be disclosed and delivered free of charge within 45 days of receipt of your verifiable request. That period may be extended once by a further 45 days when reasonably necessary and with notice. The information provided will cover only the 12-month period preceding the request. For data portability requests, we will select a readily usable format that allows the information to be transmitted from one entity to another without hindrance.

Do not sell my personal information

You have the right to opt out of the sale of your personal information. Once we receive and confirm a verifiable consumer request, we will stop selling your personal data; to exercise this right, please contact us. Opting out is specific to the browser you use: you may need to opt out on every browser you use.

Children's privacy

xDesk does not address anyone under the age of 13, and we do not knowingly collect personally identifiable information from anyone under 13. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us: if we become aware that we have collected Personal Data from anyone under 13 without verification of parental consent, we take steps to remove that information from our servers. If we need to rely on consent as a legal basis for processing your information and your country requires consent from a parent, we may require your parent's consent before we collect and use that information.

California residents' rights

“Shine the Light” law

Under California Civil Code Section 1798, California residents with an established business relationship with us can request information once a year about sharing their Personal Data with third parties for those third parties' direct marketing purposes. To request further information, you can contact us at the addresses below.

Users under 18 (California Business and Professions Code Section 22581)

California residents under the age of 18 who are registered users of online sites, services or applications may request and obtain removal of content or information they have publicly posted. To request removal, contact us including the email address associated with your account. The request does not ensure complete or comprehensive removal of the content, and the law may not permit or require removal in certain circumstances.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page, with notice by email and/or a prominent notice on our Service before the change becomes effective, and we will update the “Last updated” date at the top of this page. You are advised to review this Privacy Policy periodically: changes are effective when they are posted here.

Contact us

If you have any questions about this Privacy Policy, you can write to us at info@nas-tech.com.