NEXUS Group — Public compliance documentation
Sub-processors
Complete list of third parties that may access or process Protected Data in connection with NEXUS V2, what each one receives and why.
- Document
- NX-SUB-01
- Version
- 1.0
- Effective date
- Review cycle
- At least annually, and after any material change to the service.
01Current list
| Party | Role | Purpose | Data processed |
|---|---|---|---|
| Mercado Livre (Mercado Libre) | Source marketplace | Origin of order, shipping and settlement data. Accessed through the official API with seller-authorized OAuth tokens. | Order, item, shipping, buyer name/nickname and settlement data of the connected seller accounts. |
| Shopee (Shopee Open Platform) | Source marketplace | Origin of order, shipping and escrow data. Accessed through the official API with shop-authorized tokens and HMAC-SHA256 request signing. | Order, item, shipping, buyer name and payment breakdown of the connected shops. |
| Single dedicated virtual private server (VPS) managed by NEXUS Group | Infrastructure | Runs the application container and the PostgreSQL database. | All Protected Data at rest, inside the production database and its backups. |
Protected Data is stored in Brazil. Beyond the parties listed above, no other processor, analytics provider, advertising network or data broker receives Protected Data.
02Controls applied to third parties
- A third party is engaged only when it is necessary to deliver the service, and only for the data categories listed above.
- Marketplace access is limited to the scopes required by a delivered feature, using credentials the seller authorised.
- Infrastructure providers receive data only as a consequence of hosting the environment; they are not granted application-level access.
- Credentials issued to third-party platforms are protected with multi-factor authentication and are rotated when compromise is suspected.
- This list is reviewed at least annually and updated whenever a party is added or removed.
03Exclusions
No onward disclosure
Protected Data is not sold, rented or licensed, is not shared with advertisers or data brokers, and is not sent to third-party artificial intelligence or model-training services.
04Questions
Questions about this list can be sent to gianlucca.florencio@zeroholding.com.br. Related documents: Privacy Notice and Information Security Policy.
Document control
Public URL: https://v2.nexusgroup.app.br/sub-processors.
Approved and maintained by the NEXUS Group Privacy Owner. Reviewed at least annually, and after any material change to the service.