Privacy Notice

This Privacy Notice explains how NestiFi Technologies Limited (“NestiFi”, “we”, “us” or “our”) handles personal data in connection with this Website, business enquiries and NestiFi-powered institutional experiences.

NestiFi Technologies Limited is an Irish company and is responsible for this Website and for the processing described in this Notice where NestiFi acts as controller.

For Website visitors, prospective customers, business contacts and people who contact us directly, NestiFi acts as controller and determines why and how that information is used.

For an institution-deployed service, the credit union, community bank, registered investment adviser, wealth firm or platform partner determines the purposes of processing. NestiFi processes the personal data required to provide and secure the platform on that institution’s documented instructions as its processor or service provider.

The applicable customer agreement and product-specific notice set out the responsibilities of NestiFi, the participating institution and any authorised provider. You should also read the privacy notice supplied by the institution through which you access the service.

Depending on how you interact with us, we may collect:

• business contact information, such as name, work email, organisation, job title and telephone number;
• information included in demo requests, support messages, correspondence and meeting notes;
• limited device, IP address, browser and security-log information generated by our hosting and security providers; and
• information you choose to provide during a business relationship.

In NestiFi-powered deployments, participating financial institutions and their approved regulated or identity-verification providers collect sensitive onboarding information such as Social Security numbers, dates of birth, bank details and know-your-customer documentation where that information is required.

NestiFi does not request that visitors submit that information through the public Website. In an institutional deployment, NestiFi processes only the information required to provide, support and secure the platform in accordance with the customer’s configuration, documented instructions and agreements.

We use personal data for the following purposes and legal bases:

• to respond to enquiries, arrange demonstrations and take steps toward a contract;
• to provide, administer, support and secure the Website and services, based on our legitimate interests and contractual obligations;
• to manage customer and supplier relationships and maintain appropriate business records;
• to detect, investigate and prevent misuse, security incidents and fraud;
• to comply with legal, regulatory, accounting and reporting obligations; and
• where required, for a purpose to which you have consented. You may withdraw consent at any time without affecting earlier lawful processing.

Seb is an AI-assisted educational and workflow tool. Seb does not make investment recommendations, choose financial products, provide financial advice, determine creditworthiness or make lending or underwriting decisions.

Prompts, responses and related context are processed only to provide the requested feature, maintain security, troubleshoot and evaluate quality in accordance with the relevant customer agreement and product notice. Users should avoid entering information that is not needed for the interaction.

We will not use institution customer or end-user content for unrelated general-purpose model training without appropriate authorisation and disclosure. External AI providers used to support the service are subject to contractual, access and data-protection controls appropriate to the service.

The public Website is intended for adults and institutional representatives and is not directed to children under 13. NestiFi-powered family and financial-literacy experiences may be made available to children through a participating institution.

Where required, appropriate parental or guardian authorisation, including verifiable parental consent for children under 13 in the United States, is obtained before personal data is processed. The institution’s child and family notice will explain the information used, parental choices and how deletion can be requested.

NestiFi and its customers should collect only the information reasonably necessary for the relevant child-facing feature and should not use children’s data for behavioural advertising.

We may share personal data only as reasonably necessary with:

• the institution through which a NestiFi-powered service is offered;
• hosting, cloud, security, communications, support and professional-service providers acting under appropriate obligations;
• regulated or identity-verification partners identified by the institution where necessary for their separate services;
• professional advisers, auditors, insurers and potential investors or acquirers subject to appropriate safeguards; and
• courts, regulators, law-enforcement bodies or other parties where required by law or necessary to protect rights and security.

NestiFi does not sell personal data or share it for cross-context behavioural advertising. We do not use advertising pixels, behavioural-tracking technologies, analytics cookies or newsletter cookies on the public Website.

Strictly necessary technologies may be used to operate, secure and deliver the Website. If our use of cookies or similar technologies changes, we will update this notice and introduce any consent choices required by law.

NestiFi is based in Ireland and may use providers or support resources in other countries, including the United States. Where personal data is transferred outside the European Economic Area, we use an available lawful transfer mechanism, such as an adequacy decision or approved standard contractual clauses, together with supplementary safeguards where appropriate.

We retain personal data only for as long as needed for the purpose for which it was collected, including to meet contractual, security, legal, accounting and dispute-resolution requirements.

Retention depends on the relationship and data category. Business enquiries that do not progress may generally be retained for up to 24 months, while customer-contract and transaction-related records may be retained longer where law or legitimate business needs require. Institution-deployed data is retained and returned or deleted in accordance with the customer agreement and documented instructions.

We use administrative, technical and organisational safeguards designed for the nature of the information and the risks involved, including access controls, environment separation, encryption and security monitoring where appropriate.

No method of transmission or storage can be guaranteed completely secure.

Depending on your location and the circumstances, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy of information, withdraw consent and complain to a supervisory authority.

Individuals in the European Economic Area may complain to the Irish Data Protection Commission at dataprotection.ie. If you use NestiFi through an institution, please contact that institution first where it controls your information. We will assist it as required.

Residents of certain United States states may have additional rights under applicable privacy laws. NestiFi will honour rights that apply to its role and processing.

We may update this Notice as our services, corporate structure, data practices or legal obligations change. We will post the revised version here and provide additional notice where required.

Privacy questions and requests can be sent to support@nestifi.money or NestiFi Technologies Limited, 24A Baggot Street Upper, Dublin, D04 N528, Ireland.