Nexpand CRM — Privacy Policy
Last updated: 18 July 2026
This policy explains how Zsigmond Gergely, egyéni vállalkozó (sole proprietor, Hungary), registered seat: 1026 Budapest, Guyon köz 5., Hungary, sole-proprietor registration number: 59673189 ("we", "us") processes personal data in connection with the Nexpand CRM service at crm.nexpand.hu and the Nexpand desktop agent. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Hungarian data-protection law. Contact for privacy matters: gergely.zsigmond@prime4squad.com.
1. The three roles we act in
- Controller — your account. For the data of registered users of the Service (account, billing, usage), we are the data controller. Sections 2–4 apply.
- Processor — your CRM content. For the contacts, companies and messages our customers import into or collect through the Service ("Customer Data"), the customer is the controller and we are their processor under our Data Processing Agreement. Section 5 applies.
- Controller — shared enrichment cache. For a limited cache of publicly available professional attributes described in Section 6, we act as controller.
2. Data we process about users (as controller)
| Category | Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Account | Email address, display name, password (stored as a bcrypt hash), email-verification status | Providing the Service, authentication, essential service emails (verification, password reset) | (1)(b) contract |
| LinkedIn identity | The LinkedIn display name / public profile identifier of the profile you connect to the automation identity gate | Safety: the automation refuses to run on the wrong LinkedIn account | (1)(b) contract |
| Billing | Subscription status, billing periods, Stripe customer and subscription identifiers. Card data is processed by Stripe only — we never see full card numbers. | Charging subscriptions, invoicing, accounting | (1)(b) contract; (1)(c) legal obligation (accounting/tax) |
| Usage & logs | Action log of operations in your account, background-job records, agent check-ins (timestamps, device token identifiers), server logs incl. IP address | Operating, securing and debugging the Service, abuse prevention | (1)(f) legitimate interest (service security and operation) |
| Support | Emails you send us | Answering you | (1)(f) legitimate interest |
Providing account and billing data is a contractual requirement — without it we cannot provide the Service. We do not use your data for advertising, we do not sell it, and we make no automated decisions with legal effect about you.
3. Retention (as controller)
- Account data: for the life of the account and up to 30 days after deletion (removal from rolling backups).
- Billing and invoicing records: 8 years (Hungarian Accounting Act).
- Server and action logs: up to 12 months, unless needed longer for a specific security incident.
4. Recipients and transfers
We use the following processors / recipients:
| Recipient | Role | Location |
|---|---|---|
| Rackhost Zrt. (Szeged, Hungary) | Server hosting | EU (Hungary) |
| Stripe Payments Europe, Ltd. (and Stripe, Inc.) | Payment processing (Stripe acts as an independent controller for card processing) | EU / USA — EU–US Data Privacy Framework and SCCs |
| Resend (Plus Five Five, Inc.) | Sending transactional emails (verification, password reset, job-change digests) | USA — SCCs |
| HubSpot, Inc. | Only if you connect a HubSpot portal: data you choose to sync is sent to your HubSpot account at your direction | EU / USA — DPF |
Where data leaves the EEA, we rely on adequacy decisions (including the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses. The web pages load fonts and interface libraries from content-delivery networks (Google Fonts, jsDelivr); these providers see your IP address when your browser requests those files.
5. Customer Data — when we act as processor
Our customers store data about their business contacts in the Service: typically name, job title, employer, LinkedIn profile URL, professional attributes, notes, and LinkedIn message history with the customer. For this data the customer is the controller; we process it only on the customer's instructions, as set out in the Data Processing Agreement (including its subprocessor list and security annex).
If you believe you are in a customer's CRM database and want access, correction or deletion, please contact that customer (the business that has been in touch with you) — they are the controller. If you contact us instead, we will forward your request to the customer concerned and assist them in fulfilling it.
6. Shared enrichment cache
To reduce redundant lookups against LinkedIn, the Service keeps a cache of professional attributes as they appear on public LinkedIn profile and company pages (for people: name, title, employer, location, industry, connection/follower counts, and the profile's listed position history, education, skills and languages; for companies: name, industry, size, website). When one customer's account has looked up a profile, another customer who already has that same person in their CRM may have blank fields filled from the cache instead of triggering a new lookup, and a requested full-profile download may be served from the cache.
- We act as controller for this cache. Legal basis: Art. 6(1)(f) GDPR — our and our customers' legitimate interest in efficient, rate-limited processing of professional data that the persons concerned have made publicly available in a professional networking context. The cache contains no special-category data, no private contact details and no message content.
- You may object to this processing or request erasure from the cache at any time by emailing us (Section 8); we will remove the entries unless compelling legitimate grounds exist.
7. Security
Key measures: TLS encryption in transit; passwords stored as bcrypt hashes; per-tenant data isolation enforced in every query; token-based agent authentication with hashed tokens; role-restricted admin access; EU-located servers; rolling encrypted off-site backups; LinkedIn credentials are never transmitted to or stored on our servers (you log in locally in your own browser profile). Details are in Annex 3 of the DPA.
8. Your rights
Under the GDPR you have the right to access, rectify and erase your personal data, restrict or object to processing (including processing based on legitimate interest), and receive your data in a portable format. Contact: gergely.zsigmond@prime4squad.com. We respond within one month.
You also have the right to lodge a complaint with the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11; +36 1 391 1400; ugyfelszolgalat@naih.hu; naih.hu — or with the authority of your habitual residence, and to seek judicial remedy.
9. Cookies
The Service uses only strictly necessary cookies (login session). See the Cookie Policy.
10. Changes
We may update this policy; material changes are announced by email or in-app notice. The current version is always available at this address.
Log in · Create account · Part of the nexpand suite · nexpand.hu