NEXUS Group — Public compliance documentation
Personal Information Protection Standard
Mandatory internal standard defining how NEXUS Group classifies, protects, retains and deletes personal information processed by NEXUS V2. It applies to every person and system that touches Protected Data.
- Document
- NX-PIPS-01
- Version
- 1.0
- Effective date
- Review cycle
- At least annually, and after any material change to the service.
Status of this document
01Purpose and scope
This standard exists to ensure that every piece of personal information reaching NEXUS V2 is collected for a defined purpose, kept to the minimum necessary, protected against unauthorised access, and deleted when it is no longer needed.
In scope
- All personal information received through the Mercado Livre and Shopee APIs, including buyer identification and shipping recipient data.
- All order, payment, product and cost records that can be linked to an identifiable person.
- Authorization credentials (OAuth access and refresh tokens) belonging to connected seller accounts and shops.
- The production environment, its database, its backups and the workstation used to administer it.
- Any personnel, contractor or automated process with access to the above.
Out of scope
- Data that never enters the platform, such as marketplace data the operator reads directly on the marketplace website.
- Anonymous aggregate figures that cannot be re-associated with an individual.
02Roles and responsibilities
| Role | Responsibility |
|---|---|
| Privacy Owner / Data Protection Contact | Owns this documentation set, answers data subject and platform requests, coordinates incident notification and approves changes to data handling. Contact: gianlucca.florencio@zeroholding.com.br. |
| System administrator | Operates the production environment, applies this standard in configuration, keeps credentials in a secrets manager and never stores Protected Data outside approved systems. |
| Developer | Implements data minimisation in code, requests only the API scopes required by a delivered feature, and never copies production Protected Data into development environments. |
| All personnel | Reports suspected incidents immediately to the security channel and follows the security baseline on every device used for company work. |
03Processing principles
- Lawfulness and transparency.Personal information is processed only after the seller has authorised the connection through the marketplace's own OAuth flow, and only for the purposes published in the Privacy Notice.
- Purpose limitation. Data is used to reconcile sales, calculate freight and margin, dispatch orders and control stock. It is never used for advertising, profiling, scoring, resale or training of third-party models.
- Data minimisation. Only the API scopes required by a delivered feature are requested. Fields that no screen or report consumes are not persisted.
- Accuracy. Records are refreshed from the marketplace API, which remains the source of truth; corrections applied at the marketplace propagate on the next sync.
- Storage limitation. Every category has a defined retention period, published in the Data Retention and Deletion document.
- Integrity and confidentiality. Controls are defined in the Information Security Policy and are mandatory, not optional.
- Accountability. This standard, its review date and its owner are published so that any platform, seller or individual can verify them.
04Data classification
Every data element handled by the platform is assigned one of three classes. The class determines the minimum protection required.
| Class | Definition | Minimum protection required |
|---|---|---|
| Restricted | Marketplace authorization tokens, application secrets, database credentials, administrator credentials. | Stored only as environment variables or in the production database; never in source control, spreadsheets, chat or e-mail; transmitted only over TLS 1.2+; access limited to the system administrator; rotated when compromise is suspected. |
| Confidential | Personal information: buyer identification, recipient name, order, shipping and payment records. | Stored only in the production database on the internal network; transmitted only over TLS 1.2+; never exported to unmanaged devices; deleted according to the retention schedule. |
| Internal | Product catalogue, SKU costs, aggregate operational metrics. | Accessible only to authenticated personnel; no publication without approval. |
Prohibited handling
05Data inventory and purpose
The following inventory reflects what the platform actually stores. It is reviewed whenever a new data category is introduced.
| Category | Examples | Purpose | Retention | Source |
|---|---|---|---|---|
| Marketplace authorization tokens | OAuth access/refresh tokens and expiry for each connected Mercado Livre account and Shopee shop. | Keep the authorized API connection alive so orders can be synced. | Kept while the seller account stays connected; deleted when the connection is removed. | Mercado Livre / Shopee OAuth |
| Order and settlement data | Order id, date, status, items, SKU, quantity, unit and total amount, marketplace fees, freight cost, payment id. | Sales reconciliation, freight and margin calculation, operational reporting. | Retained while needed for accounting and tax obligations, then deleted. | Marketplace APIs |
| Buyer identification (limited) | Buyer id/nickname, recipient name, shipping method and delivery deadline. | Pick, pack and dispatch the order, and answer post-sale questions. | Deleted together with the order record it belongs to. | Marketplace APIs |
| Product and cost data | SKU code, description, hierarchy, unit cost and cost history, Full stock snapshots. | Inventory control and cost of goods sold. | Retained while the SKU is in use; historical versions kept for audit of past sales. | Internal registration |
| Administrator session | Signed session token stored in an HTTP-only cookie. No profiling, no analytics, no advertising cookies. | Authenticate the single administrator account. | 1 day, or 30 days when 'remember me' is selected; cleared on sign-out. | Sign-in |
06Lifecycle controls
Collection
Data enters the platform in one way only: authenticated calls to the official marketplace APIs, using tokens the seller granted through the marketplace's own authorization screen. There is no scraping, no purchase of data from third parties and no collection from visitors of these public pages.
Storage
Protected Data is stored in a PostgreSQL database that listens only on the internal Docker network of the production server in Brazil. The database is not published to the internet, and the application is the only component allowed to query it.
Use and access
Access follows least privilege: a single administrator account authenticates against the application, and every route except the sign-in page and the health check rejects unauthenticated requests. The session is a signed token stored in an HTTP-only cookie that client-side scripts cannot read.
Transfer
Personal information is transmitted only between the platform and the originating marketplace APIs, always over TLS 1.2 or above. It is not shared with advertisers, data brokers or analytics providers. The complete list of parties that may process Protected Data is published under Sub-processors.
Retention and deletion
Each category has a defined retention period. When a seller revokes authorization, disconnects the integration, or the contractual relationship ends, the corresponding records and tokens are deleted from the production database and are removed from backups as the backup rotation expires. The full procedure and the deadlines are published in Data Retention and Deletion.
07Rights of individuals
Requests for access, correction, export, deletion or restriction are handled through the published privacy channel and answered within 5 business days. When the requester is a buyer of a marketplace order, the request is executed in coordination with the seller and the marketplace, because the marketplace remains the primary controller of that relationship. The procedure is published in Data Subject Rights.
Assistance to platforms and sellers
08Incidents involving personal information
Any suspected or confirmed exposure of personal information is treated as a security incident and escalated immediately. Affected marketplaces and sellers are notified without undue delay and, for confirmed personal data breaches, within 24 hours of confirmation. Severity levels, response phases and the notification content are defined in Incident Response and Breach Notification.
09Compliance, training and enforcement
- Every person with access to Protected Data reads this standard before receiving access and after each revision.
- Access is reviewed at least annually and immediately when a role changes or a person leaves.
- This standard, the Information Security Policy and the retention schedule are reviewed at least annually and after any material change to the service.
- Failure to follow this standard results in immediate access removal and, for contractors, termination of the engagement.
- Requests from marketplaces for evidence of these controls are answered with configuration exports, screenshots or code references, coordinated by the Privacy Owner.
Document control
Public URL: https://v2.nexusgroup.app.br/personal-data-protection-standard. This document may be attached, printed or referenced directly in a platform security review.
Approved and maintained by the NEXUS Group Privacy Owner. Reviewed at least annually, and after any material change to the service.