Privacy
Privacy Notice
Version 2026-10
This notice explains, in plain language, which personal data Nadivix processes, for what purpose, on which legal basis, with whom it is shared, for how long it is kept and which rights you have. It applies to nadivix.com, to the Nadivix applications (ERP, AI Virtual Assistant, Document Automation, CRM, Customer Portal and B2B store, Sinervix and Nadivix Web Page) and to any form, chat or email you use to contact us. It complies with Panama's Law 81 of 26 March 2019 on Personal Data Protection and its regulation, Executive Decree 285 of 28 May 2021.
1. Who is responsible
- Data controller: Nadivix Software Solutions ("Nadivix"), a company incorporated in the Republic of Panama.
- Privacy contact: privacidad@nadivix.com. It is the only channel you need to exercise your rights; no form or lawyer is required.
- When you use a Nadivix application as a user of a customer company, or you write to the chat, form or store of a company that uses our applications, that company is the controller of your data and Nadivix acts as processor: we process it only to provide the service to that company, under contract and following its instructions. To exercise your rights over that data, contact that company; if you get no answer, write to us and we will help.
2. Which data we process and where it comes from
We only ask for what each purpose needs. We never ask for sensitive data (health, beliefs, ethnic origin, biometric data, sexual life, political or union affiliation) and we ask you not to write it in free-text fields.
| When | Which data | Source |
|---|---|---|
| You visit nadivix.com | Technical data of the visit (device and browser type, country, pages viewed) and, only if you accept analytics cookies, usage statistics. Your cookie choice is recorded with a random identifier, without name or email. | Your browser. |
| You book a video call | First name, last name, email, company, what you write about your challenge, chosen date and time, time zone, language; an irreversible hash of your IP address (to prevent abuse) and the device type. | You type it in the form. |
| You request a demo or create your access in an application | Name, email, company, language, role in the application; security data (password hash, encrypted authenticator, sessions, device type, country, IP hash); date, time and version of the notice you accepted. | You type it, or your company administrator invites you. |
| You buy a plan | Legal name, tax ID, address, country, phone, billing email, chosen plan, invoices and payments. | Your company provides it when contracting. |
| You write to a chat, form, interview or store of a company that uses our applications | What you write (name, email, phone, message, order, answers) and the record of your acceptance. | You type it. The company is the controller (see point 1). |
| You request support | Your name, email, the ticket and the messages exchanged. | You or your administrator. |
| You receive Nadivix newsletters | Email, name, company, where the permission came from and when, opens and unsubscribes. | Only if you are a customer or expressly asked for it. |
3. Why we use it and on which legal basis
| Purpose | Legal basis (Law 81, art. 6) | Data |
|---|---|---|
| Answer your request, hold the video call and follow up commercially | Your consent, given by ticking the box in the form | Booking data |
| Create and keep your account, provide the service and keep it secure | Your consent when creating the access and the performance of the service contract | Account and security data |
| Invoice and collect, keep accounts and meet tax obligations | Contract performance and legal obligation | Billing data |
| Send you operational emails (codes, invitations, sign-in alerts, service notices) | Contract performance and legitimate interest in security | Email and security data |
| Send you Nadivix news and offers | Your express consent or the ongoing business relationship with your company; you can unsubscribe in every email | Email, name and company |
| Measure how the site and the applications are used in order to improve them | Your consent (analytics cookies); without it we only use necessary cookies | Technical and statistical data |
| Handle your support tickets | Contract performance | Ticket data |
| Prevent fraud and abuse and respond to authorities | Legitimate interest and legal obligation | IP hashes, device, logs |
We do not sell your data, we do not use it for third-party advertising and we make no automated decisions with legal effects on you. The Virtual Assistant's replies are generated with artificial intelligence and you can always ask to be helped by a person.
4. Who receives your data
Within Nadivix only the staff who need your data for their work can access it, with their own user, two-step verification and an audit log of what they do. We also use providers that process data on our behalf (processors), under contracts or terms that oblige them to protect it and not to use it for other purposes:
| Provider | Service | Country | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database, bot protection and domain email | United States (worldwide network) | Service terms and online data processing agreement |
| Resend, Inc. | Transactional and newsletter email delivery | United States | Service terms and online data processing agreement |
| Google LLC | Google Calendar and Meet for the video calls; Google Analytics only if you accept analytics cookies | United States | Service terms and online data processing agreement |
We only hand data to authorities when a law or a valid order requires it, and only to the extent required.
5. International transfers
Our cloud and email providers process data in the United States and in their worldwide network of data centres. These transfers rely on the safeguards allowed by Law 81 (art. 33) and Decree 285 (arts. 51 to 53): each provider's contractual terms ensuring an equivalent level of protection, encryption in transit and at rest, and access controls. You can ask for details of the safeguards applied by writing to privacidad@nadivix.com.
6. How long we keep it
We keep each piece of data only as long as it is needed for the purpose we collected it for, or as long as a law obliges us to keep it. Afterwards it is deleted or anonymised. Current periods:
| Data | Period |
|---|---|
| Prospects that did not become customers | 2 years from the last contact |
| Customers: contacts, proposals and contracts | Duration of the relationship and 5 years afterwards |
| Invoices and accounting records | 5 years |
| Cookie choice (anonymous) | 3 years |
| Demo accounts that did not buy | Deleted automatically when the demo and the grace period expire |
The proof of your consent (who, when, which text and which version you accepted) is kept for the duration of the relationship and up to five (5) years afterwards, because the law requires us to be able to prove it.
7. Your rights and how to exercise them
You have the right to access your data, rectify it if inaccurate, cancel it (have it deleted) when no longer needed, object to a processing, request its portability in a commonly used format and withdraw your consent at any time, without affecting what was done before. For newsletters, the "Unsubscribe" link in every email is enough.
- How: write to privacidad@nadivix.com from the email you registered with, stating which right you exercise. If you write from another email, we will ask you to prove your identity before answering, to protect your data.
- Deadline: we answer within ten (10) business days of your request, as Law 81 requires. If the request cannot be granted, we will explain why.
- Free of charge: exercising your rights costs nothing.
- From the application: if you have an account in a Nadivix application, under "Privacy and data" you can download your data and delete your account without asking us.
- Complaint to the authority: if you believe we did not handle your request, you can go to the National Authority for Transparency and Access to Information (ANTAI), Panama's data protection authority (antai.gob.pa).
8. Cookies
nadivix.com and the applications use cookies that are necessary to work securely and, only if you accept them, analytics cookies. You can accept, reject or change your decision whenever you want. Full details are in the Cookie Policy and in the of each site.
9. How we protect your data
- Encryption in transit (HTTPS) and at rest; sensitive personal data in the applications is additionally encrypted with a key of its own for each company (AES-256-GCM), so a copy of the database cannot be read.
- Passwords are not stored: only an irreversible hash. IP addresses are stored anonymised.
- Two-step verification for administrators, role-based permissions, access and change logs, backups and restore tests.
- Every form, chat or user sign-up stores the record of your acceptance: date and time, version and SHA-256 fingerprint of the exact text you saw, and the channel through which you gave it.
- Should a security incident affect your data, we will inform you and notify ANTAI within the deadlines set by law.
10. Minors
Our services are aimed at companies and adults. We do not knowingly collect data from minors; if you believe a minor gave us their data, write to us and we will delete it.
11. Changes to this notice
Each version has a number and a date. If we change anything relevant (purposes, recipients, periods) we will publish it here and, where appropriate, ask for your acceptance again when you sign in. We keep the version history so we can prove which text was in force when you accepted.
See also the Cookie Policy.