App privacy
This page covers the four Nexur applications: Nexur Sell (the point of sale), Nexur Make (the production lab), Nexur Team (the staff app) and Nexur Hub (the management console). The website has a separate privacy notice, and cookies are covered by the cookie policy.
Version 3, updated on 5 October 2026.
The reference version of this notice is the Italian one; this is a courtesy translation, and if the two ever differ the Italian text applies.
In short
- No advertising, no profiling, no data sold. The apps contain no third-party analytics or tracking tools.
- Staff and customer data belong to the gelato shop. We process them on its behalf; the shop is the controller, and its privacy notice is the one that applies.
- The data is stored in Europe, on Amazon Web Services servers in the Stockholm region.
- Nexur Team reads your location only when you clock in or out, and sends it with the clock-in. It does not follow you during your shift.
- Some data cannot be deleted: the law requires invoices and sales records to be kept for ten years.
Who decides what happens to the data
A gelato shop uses the apps to run its business, and two kinds of data pass through them, with different owners.
- Data about the people who use the apps for the gelato shop — the location’s account, access to the console, the contract with us. For this data the controller is Nexur Group S.r.l..
- Data about the gelato shop’s staff and customers — clock-ins, shifts, holidays, invoices, receipts. For this data the controller is the gelato shop, and we process it on the shop’s behalf as a processor (Article 28 GDPR), following its instructions.
If you work for or buy from a gelato shop, the one to ask about your data is the gelato shop: it decides why it collects the data and how long it keeps it, and it owes you its own privacy notice. If you write to us, we pass the request on to the shop and help it answer you.
Who we are
Nexur Group S.r.l., Via Piave 18, 20039 Canegrate (MI). VAT no. 14821860963. You can reach us at support@nexurgroup.com, and, if you have a certified email address (PEC), also at nexurgroup@pec.nexurgroup.com.
Data we are the controller of
Access to the Nexur Hub console
The email and password of whoever signs in to the console. The password is handled by Amazon Cognito, the authentication service we use: we never see it. So you don't have to sign in on every visit, the browser keeps an encrypted session token in its own storage.
Why: To let you into the service the gelato shop subscribed to: performance of the contract (Article 6(1)(b) GDPR).
How long: The account for as long as the contract lasts. The session token is valid for 30 days.
The gelato shop's devices (Sell and Make)
The number that identifies the gelato shop, an access token kept in the device's protected storage (Keychain on iOS, Keystore on Android) and, if you set a PIN for the device, its encrypted fingerprint together with the count of failed attempts. The PIN itself is never stored anywhere. For a sole trader, the shop number can be linked to a person.
Why: To run the service (Article 6(1)(b)) and, for the PIN, to protect the device from people who shouldn't use it, which is a legitimate interest of ours and of the shop (Article 6(1)(f)).
How long: The access token stays valid for up to ten years, as long as the device stays connected: if a tablet is lost or stolen, write to us and we disconnect it. In Nexur Make it leaves the device when you sign out. The PIN fingerprint stays for as long as the device is linked to the shop.
Password recovery
If you use «Forgot password?» in the Nexur Hub console, in Nexur Sell or in Nexur Make: what you type in the form (your email in Hub, the shop number on the devices), the language and, on our servers, the IP address the request comes from, stored as an encrypted fingerprint rather than in plain text. The link to choose a new password is sent with Amazon SES; for the devices it goes to the email of the shop's owner, because a device has no address of its own. The answer is the same whether the account exists or not: the form does not reveal which accounts exist.
Why: To let you back into the service the gelato shop subscribed to (Article 6(1)(b)).
How long: Nothing stays in the apps: the data lives in the form while it is open. On our servers the request deletes itself after 30 days. The link is valid for one hour and can be used once. An email already sent stays in the recipient's mailbox.
Tax details of whoever issues documents in Nexur Make
VAT number, tax code, business name, registered office, REA number and tax regime of the issuer shown on documents. For a sole trader these are personal data of the owner.
Why: To issue documents correctly (Article 6(1)(b)).
How long: Today they only stay in the app's memory while it is open: they are not saved or sent, and are entered again at every launch.
The contract between the gelato shop and us
The shop's business name, VAT number, tax code, address, certified email (PEC) and e-invoicing recipient code; name, email and phone number of the contact person; name, position, tax code and email of the legal representative; the signatures, meaning the date, the version of the terms accepted, the date the data processing agreement was accepted and the specific approval of clauses under Article 1341 of the Italian Civil Code.
Why: To enter into and manage the contract (Article 6(1)(b)) and to meet tax and accounting obligations (Article 6(1)(c)).
How long: For the whole length of the contract. Tax data, legal representative data and signatures are then kept for ten years from the last entry (Article 2220 of the Italian Civil Code). The contact person's details end with the contract.
Demo requests from the website
People who fill in the demo form on nexurgroup.com: name, business, contact details (email or phone), message, the configuration chosen in the pricing calculator and the language. We read them in the Nexur Hub console, where only Nexur sees them and no gelato shop does. The website privacy notice covers the rest.
Why: To get back to whoever asked us for a demo: pre-contractual measures requested by the person writing (Article 6(1)(b) GDPR).
How long: 12 months from the request, then it deletes itself. Before that, on request, we delete it ourselves from the console.
The emails we send you
The addresses we send sign-in details and contract signing links to, sent with Amazon SES. If a message is not delivered, the bounce notice reaches one of our mailboxes at the email provider of nexurgroup.com. Amazon SES also keeps a list of addresses where delivery failed or that reported the message as unwanted, with the reason and the date, and stops writing to them.
Why: To send you service messages (Article 6(1)(b)) and to stop writing to addresses that refuse mail, so we are not treated as an unwanted sender: a legitimate interest of ours (Article 6(1)(f)).
How long: The addresses follow the contract. For bounce notices in our mailbox and for the Amazon SES list we have not set a retention period yet: today they stay until we remove them.
The devices of each location
Which devices are connected to each location.
Why: To manage the service (Article 6(1)(b)).
How long: We have not set a retention period yet.
Data we process on behalf of the gelato shop
Below, app by app. The legal basis for this processing is chosen by the gelato shop, as controller: we give the usual one, but the shop’s own notice is the one that applies.
Nexur Sell — the point of sale
The gelato shop's till. It handles the details of customers who ask for an invoice, payment data and the names of whoever signs off hygiene checks.
Details of a customer who asks for an invoice
Business name, VAT number, tax code, address, e-invoicing recipient code and certified email (PEC). The till keeps no customer address book: these details leave inside documents — the sales journal on our servers and the electronic invoice, which goes to the Italian Revenue Agency's exchange system (Sistema di Interscambio).
Why: To issue the invoice, which is a legal obligation (Article 6(1)(c)).
How long: For the whole length of the contract and then ten years from the last entry (Article 2220 of the Italian Civil Code). An invoice that has been sent and archived cannot be deleted.
Purchases
The receipt lines (products, quantities, discounts, VAT rates), the payment method and, if the customer asks, their receipt lottery code (Lotteria degli scontrini).
Why: To record sales, which is a legal obligation, and to enter the customer in the receipt lottery if they ask.
How long: Ten years from the last entry. A local copy of the journal also stays on the tablet, and today it is not deleted after our servers have confirmed it.
Card payments
The last four digits of the card, the card scheme, the authorisation code, the transaction reference, the terminal and the reading mode. The full card number is never stored: the payment is carried out by the POS terminal, and the card data is handled by its provider.
Why: To reconcile takings and print the receipt.
How long: They follow the sales journal: ten years.
Shifts and attendance
The till shows staff shifts and attendance, which come from Nexur Team. It only reads them: it does not change them or keep a copy.
Why: To know who is on duty (Article 6(1)(b), for the employment contract).
How long: See Nexur Team.
Who signs off hygiene checks (HACCP)
The name of whoever carried out a cleaning task, in the HACCP log.
Why: To keep the log required by food hygiene rules (Regulation (EC) 852/2004; Article 6(1)(c)).
How long: We have not set a retention period yet.
Device permissions: local network (to talk to the fiscal printer, the printer and the POS terminal), camera (QR codes, delivery notes, product photos) and photo library. The app package also declares location, but the till never reads it.
Nexur Make — the production lab
The production lab's app. It has no connection to our servers for working data: what goes into it stays on the device.
Who signs off cleaning tasks
The name of whoever carried out a cleaning task, with date, time, product used and an optional note.
Why: To keep the hygiene log required by the rules (Article 6(1)(c)).
How long: Today it stays in the app's memory while it is open, and then disappears: it is not saved or sent.
Suppliers' delivery notes
The photo or PDF of a delivery note. If the supplier is a sole trader, it may contain data about a person.
Why: To record incoming goods (Article 6(1)(b) and (c)).
How long: Only while the document is open on screen: it is not saved or sent.
Device permissions: camera and photo library, to capture delivery notes.
Nexur Team — the staff app
The app staff use to clock in and out, see their shifts and ask for holidays and leave. The controller of this data is the gelato shop, that is, the employer.
Who you are
Name, role, staff number and location. You sign in with an account handled by Amazon Cognito; an access token stays on the phone, in the device's protected storage.
Why: To manage the employment relationship (Article 6(1)(b)).
How long: The access token is valid for up to ten years, until you sign out of the app. On our servers, the profile has no retention period set yet.
Your location when you clock in
When you clock in or out, the app reads the phone's location, works out how far you are from the shop and whether you are inside the area, and sends the exact coordinates, the distance and the result to our servers with the clock-in. It sends them at every clock-in, even when you are outside the area. It does not read your location at any other time: not during your shift and not in the background.
Why: To check that clocking in happens at the shop. In Italy, using the location of people at work requires the employer to comply with Article 4 of the Workers' Statute (Law 300/1970) — a union agreement or an authorisation from the Labour Inspectorate, before starting. This is the gelato shop's obligation, and its privacy notice must tell you the legal basis.
How long: The coordinates stay on our servers with the clock-in. No retention period has been set yet: today they stay until they are removed.
Clock-ins, shifts and hours
Clock-ins and clock-outs, planned shifts and the resulting hours.
Why: To manage the employment relationship (Article 6(1)(b)) and the employer's attendance obligations (Article 6(1)(c)).
How long: On the phone only while the app is open. On our servers, with no retention period set yet.
The phone's code
A code the app creates once on the phone, to tie your account to a single device. A copy is also kept on your account at Amazon Cognito.
Why: To stop someone clocking in for you from another phone: a legitimate interest of the employer (Article 6(1)(f)).
How long: It stays on the phone even when you sign out — on purpose, otherwise the link would be worthless — and goes away when you uninstall the app.
Notifications
The notices that concern you (shifts, swaps, announcements) and whether you have read them. The app downloads them from our servers: there are no push notifications, and nothing goes through Apple or Google.
Why: To keep you informed about your work (Article 6(1)(b)).
How long: On the phone only while the app is open. On our servers they stay: «read» does not mean deleted.
Holidays and leave
The type of request, the dates and a note you write yourself. Do not write anything about your health in the note: the app is not built to hold it, and for a medical appointment it is enough to ask for leave.
Why: To manage absences (Article 6(1)(b)).
How long: On our servers, with no retention period set yet.
Which privacy notice you have seen
When this page changes in substance, the app will show you at launch and let you carry on. Recording which version was shown, to whom and when, does not happen yet: when it does, it will be written here.
Why: To be able to show what was communicated (Article 5(2) GDPR).
How long: Not applicable yet.
Device permissions: location (only when clocking in or out) and camera (to read the barcodes on goods: images are not saved).
Nexur Hub — the management console
The web console the shop manager uses to organise the work. On top of the sign-in and contract data described above, it handles staff shifts on behalf of the gelato shop and, if the shop allows it, what the lab that supplies it can see.
Staff shifts and requests
The list of staff at each location, their shifts — which can be created, moved and deleted from the console — and shift swap requests, which can be approved or refused. It is the same data staff see in Nexur Team.
Why: To organise the work (Article 6(1)(b), for the employment contract).
How long: See Nexur Team.
The link with the lab
If the gelato shop agrees to link up with the lab that supplies it, the lab sees in the console the consumption from the evening closings, the tubs put to temper and the ones left in the display case — only for the flavours that lab has delivered to the shop in the last 90 days. Never sales, receipts, prices, customers or staff. When the lab asks to link up, the shop's owner receives an email.
Why: To plan the lab's production. The gelato shop decides, as the controller of this data: without its yes the lab sees nothing.
How long: The lab keeps no copy: it reads the data live for as long as the link is active. The shop or the lab can revoke it, and from that moment reading stops. A record of the link remains: who asked for it and who accepted it, when, and any revocation.
Device permissions: none: it is a web page.
Where the data is kept, and who else sees it
- Servers. The data that leaves the apps goes to Amazon Web Services, in the Stockholm region (European Union): sign-in with Amazon Cognito, the services and the database. Amazon Web Services is our data processor.
- The Nexur Hub console is delivered by Cloudflare, like the website: to show you the pages it sees your IP address, browser and the time, and processes this data on our behalf. Cloudflare is a US company with a worldwide network, so this data may also pass outside the European Union, with the GDPR safeguards (Data Privacy Framework and standard contractual clauses). Hub’s data itself stays stored on Amazon Web Services in Stockholm.
- Backups. The database has automatic backups that last 7 days: deleted data stays in those copies until they expire. The technical logs of the services last 90 days, and are designed to record how the services run, not the content of requests.
- Email. Service emails are sent with Amazon SES; bounce notices reach the email provider of nexurgroup.com.
- Invoices. Electronic invoices issued by Nexur Sell go to the Italian Revenue Agency's exchange system, through a transmission intermediary.
- Card payments. The payment is carried out by the gelato shop's POS terminal with its provider: the till only receives the result.
- Nobody else. We do not sell or hand over data, and we do not use it for advertising.
What the apps do not do
- They contain no analytics, behaviour tracking or advertising tools, either ours or third-party.
- They do not use data to track you across other companies' apps or websites.
- They do not read your location in the background. Only Nexur Team reads it, and only when you clock in or out.
- They do not send push notifications.
- Nexur Sell keeps no customer address book on our servers: customer details exist only inside the documents issued.
Deleting data
We create accounts together with the gelato shop, and close them when the shop or you ask: write to support@nexurgroup.com. Closing an account does not delete the documents the law requires us to keep.
What cannot be deleted. Invoices and sales records: the law requires them to be kept for ten years, and an invoice already sent to the exchange system cannot be withdrawn.
A command that promises more than it does. Nexur Sell has a «delete customer» command: it removes the customer from the list on screen, but does not touch documents already issued with their details. For a real deletion request, write to us.
Clock-ins, shifts, holidays, location and notifications have no delete command in the apps today: the request goes through the gelato shop, which is the controller, and then to us.
After a deletion, the data stays in the backups for up to about 7 days, then it disappears from there too.
Your rights
You can ask to see your data, correct it, delete it, restrict its use, receive it in a machine-readable format, and object to the processing. For data we are the controller of we answer ourselves, within one month: write to support@nexurgroup.com. For data we process on behalf of a gelato shop the request goes to the shop; if it reaches us, we pass it on.
If you think your data is being handled wrongly you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali.
When this page changes
The page carries a version number and a date. When something changes in substance — new data, a new provider, a different retention period — the number goes up, and the date says when.