Privacy Policy

1. Who We Are

Nixia is the data controller for personal data processed in connection with our website and Services.

• Trading Name: Nixia
• Sole Trader: Nicolas Mees
• Jobsplus Registration Number: EE2025198526
• VAT Number: MT32088631
• Registered Address: Breezy Village Apt2, Triq Santa Marija, Il-Mellieha, Malta
• Contact: hello@nixiastudio.com

2. Data We Collect

Data you provide directly

• Identity and contact data: name, email address, phone number
• Business data: company name, professional role, VAT registration number
• Client Materials: property descriptions and images submitted for service delivery
• Communications: messages, support requests, and correspondence with us

Data collected automatically

• Technical data: IP address, browser type, operating system, device type
• Usage data: pages visited, time spent, referring URL, navigation paths

Payment data

We do not collect or store your full payment card details. Payments are processed directly by Stripe, Inc., a PCI DSS Level 1 certified provider. We receive only transaction confirmation and limited non-sensitive metadata.

3. Lawful Basis for Processing

• Contract (Art. 6(1)(b) GDPR) — processing your identity, contact, and business data is necessary to perform the contract with you and fulfil your Orders.
• Legitimate Interests (Art. 6(1)(f) GDPR) — we process technical and usage data to maintain, secure, and improve our website and Services.
• Legal Obligation (Art. 6(1)(c) GDPR) — we retain invoice and transaction records to comply with Maltese tax and accounting law.
• Consent (Art. 6(1)(a) GDPR) — where we send marketing communications or place non-essential cookies, we do so only with your prior consent, which you may withdraw at any time.

4. How We Use Your Data

• To process and fulfil your Orders and deliver the Services
• To send Order confirmations, delivery notifications, and service-related communications
• To handle enquiries and provide customer support
• To process payments via Stripe and maintain accurate financial records
• To maintain and improve the security and performance of our website
• To comply with our legal and regulatory obligations

5. Data Retention

• Order and transaction data: 7 years from the date of transaction (Maltese tax obligations)
• Account and correspondence data: for the duration of our business relationship, plus 2 years
• Technical and usage data: up to 13 months from collection
• Marketing consent records: until withdrawal of consent, plus 1 year

6. Sharing Your Data

We do not sell, rent, or trade your personal data. We may share your data with the following third parties, strictly on a need-to-know basis:

• Stripe, Inc. — payment processing (PCI DSS Level 1; subject to Standard Contractual Clauses)
• Website hosting provider — Netlify, Inc. (USA, Standard Contractual Clauses)
• Professional advisors — legal, accounting, or audit purposes only
• Legal and regulatory authorities — where required by applicable law or valid legal process

7. International Data Transfers

Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission. Stripe, Inc. processes personal data transferred from the EEA under Standard Contractual Clauses. For more information, see stripe.com/privacy.

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption of all data in transit using TLS/HTTPS, role-based access controls, regular security assessments, and staff training. No method of electronic transmission or storage is wholly secure; we cannot guarantee absolute security.

In the event of a personal data breach likely to result in high risk to your rights, we will notify you without undue delay in accordance with GDPR Art. 34.

9. Your Rights Under GDPR

To exercise any of the rights below, contact us at hello@nixiastudio.com. We will respond within one calendar month.

• Access (Art. 15) — request a copy of the personal data we hold about you.
• Rectification (Art. 16) — request correction of inaccurate or incomplete data.
• Erasure (Art. 17) — request deletion of your data where no longer necessary or where consent has been withdrawn.
• Restriction (Art. 18) — request restriction of processing in certain circumstances.
• Portability (Art. 20) — receive your data in a structured, machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interests, including direct marketing.
• Withdraw consent (Art. 7(3)) — withdraw consent at any time without affecting prior lawful processing.

If you believe we have infringed your data protection rights, you may lodge a complaint with the Information and Data Protection Commissioner (IDPC), Privacy Street, Floriana, FRN 1350, Malta — idpc.info@idpc.org.mt.

10. Cookies

We use strictly necessary cookies to operate the site. We may also use analytics cookies with your consent. You can control cookies through your browser settings at any time. Blocking strictly necessary cookies may affect site functionality.

11. Children's Privacy

Our Services are directed exclusively at businesses and professionals. We do not knowingly collect personal data from individuals under 18 years of age.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy with a revised effective date. Where changes are material, we will take reasonable steps to notify you directly in advance.

13. Contact

For all data protection enquiries or requests to exercise your rights, contact us via WhatsApp or at hello@nixiastudio.com. We aim to respond within one calendar month.