NEXUS Group — Public compliance documentation
Privacy Notice
How NEXUS Group processes personal data in NEXUS V2: the categories collected, the purpose of each one, the legal basis, the recipients, the storage location and the retention period.
- Document
- NX-PRIV-01
- Version
- 1.0
- Effective date
- Review cycle
- At least annually, and after any material change to the service.
01Who we are
NEXUS V2 is a private, single-tenant back-office used by NEXUS Group to manage its own marketplace operations: sales reconciliation, shipping, stock and SKU costing. The platform is operated by NEXUS Group, established in Brazil.
For the marketplace orders processed here, the marketplace and the seller are the primary controllers of the relationship with the buyer. NEXUS Group processes that data to operate its own back office and to fulfil the orders placed on its seller accounts.
02What personal data we process
The platform does not have public sign-up and does not collect data from visitors of these public pages. All personal data arrives through the official marketplace APIs after the seller authorises the connection.
| Category | Examples | Purpose | Retention | Origin |
|---|---|---|---|---|
| Marketplace authorization tokens | OAuth access/refresh tokens and expiry for each connected Mercado Livre account and Shopee shop. | Keep the authorized API connection alive so orders can be synced. | Kept while the seller account stays connected; deleted when the connection is removed. | Mercado Livre / Shopee OAuth |
| Order and settlement data | Order id, date, status, items, SKU, quantity, unit and total amount, marketplace fees, freight cost, payment id. | Sales reconciliation, freight and margin calculation, operational reporting. | Retained while needed for accounting and tax obligations, then deleted. | Marketplace APIs |
| Buyer identification (limited) | Buyer id/nickname, recipient name, shipping method and delivery deadline. | Pick, pack and dispatch the order, and answer post-sale questions. | Deleted together with the order record it belongs to. | Marketplace APIs |
| Product and cost data | SKU code, description, hierarchy, unit cost and cost history, Full stock snapshots. | Inventory control and cost of goods sold. | Retained while the SKU is in use; historical versions kept for audit of past sales. | Internal registration |
| Administrator session | Signed session token stored in an HTTP-only cookie. No profiling, no analytics, no advertising cookies. | Authenticate the single administrator account. | 1 day, or 30 days when 'remember me' is selected; cleared on sign-out. | Sign-in |
What we never do
03Purpose and legal basis
| Processing activity | Purpose | Legal basis |
|---|---|---|
| Order synchronisation | Reconcile sales, fees, freight and margin against the marketplace records. | Performance of the contract with the marketplace and the buyer, and the legitimate interest of the seller in operating its business. |
| Shipping and dispatch | Pick, pack, label and dispatch the order to the recipient within the deadline. | Performance of the contract of sale. |
| Stock and cost control | Maintain inventory levels and the cost of goods sold. | Legitimate interest in operating and auditing the business. |
| Accounting and tax records | Retain the records required by accounting and tax obligations. | Compliance with a legal obligation. |
| Administrator authentication | Restrict access to the platform to the authorised operator. | Legitimate interest in securing the system. |
04Where data is stored and processed
Protected Data is stored and processed in Brazil, on single dedicated virtual private server (vps) managed by nexus group. The database is reachable only from the internal network of that server. Data in transit is protected with TLS 1.2 or above for every public connection and every marketplace API call.
There is no international transfer of Protected Data beyond the return of requests to the originating marketplace APIs.
05Recipients and sub-processors
| Recipient | Role | Data received |
|---|---|---|
| Mercado Livre (Mercado Libre) | Source marketplace | Order, item, shipping, buyer name/nickname and settlement data of the connected seller accounts. |
| Shopee (Shopee Open Platform) | Source marketplace | Order, item, shipping, buyer name and payment breakdown of the connected shops. |
| Single dedicated virtual private server (VPS) managed by NEXUS Group | Infrastructure | All Protected Data at rest, inside the production database and its backups. |
The current list, with the purpose of each recipient, is published under Sub-processors and is updated whenever a party is added or removed.
06Retention and deletion
Each category has a defined retention period, listed in the table above and detailed in Data Retention and Deletion. When a seller revokes authorization or disconnects the integration, the related tokens and records are deleted; at the end of a contractual relationship all data collected from the counterparty is deleted.
07Your rights
Individuals may request confirmation of processing, access, correction, portability, deletion, restriction, and information about sharing. Requests are answered within 5 business days. The full procedure, including the identity checks we apply, is published in Data Subject Rights.
Because the marketplace is the primary controller for buyer relationships, a request about a specific order may also need to be raised with the marketplace. We assist the marketplace and the seller in fulfilling such requests.
08Privacy owner and contact
NEXUS Group has appointed a named Privacy Owner / Data Protection Contact. Owns this documentation set, answers data subject and platform requests, coordinates incident notification and approves changes to data handling.
| Purpose | Contact | Target first response |
|---|---|---|
| Privacy Owner / Data Protection Contact | gianlucca.florencio@zeroholding.com.br | 5 business days |
| Security and breach notification | gianlucca.florencio@zeroholding.com.br | Acknowledged within 24 hours |
Statutory Data Protection Officer
10Changes to this notice
This notice is reviewed at least annually and whenever a data category, purpose, recipient or storage location changes. The version and effective date are shown at the top of the page, so a reviewer can always confirm which version is in force.
Document control
Public URL: https://v2.nexusgroup.app.br/privacy.
Approved and maintained by the NEXUS Group Privacy Owner. Reviewed at least annually, and after any material change to the service.