Privacy policy

1. Data controller

The data controller is PRIME NEXUS INTERNATIONAL LLC, contactable at legal@eorigpsr.com. See the legal notice for full contact details.

2. Data collected and purposes

Diagnostic

• Questionnaire answers: calculation of the EORI, VAT, IOSS or GPSR diagnostic. Legal basis: legitimate interests.
• Email address: sending and saving the result when requested by the user. Legal basis: consent.

Account, applications and catalogue

• Business data: company name, tax and customs identifiers, address, contact details and supporting documents required for the service.
• Product data: descriptions, manufacturers, materials, documents, images and data synced from a connected store.
• Legal basis: performance of the contract or pre-contractual steps requested by the user.

Payment

We retain transaction identifiers, the plan or service purchased, the amount and payment status. Card data is processed exclusively by Stripe and never passes through our servers. Legal basis: performance of the contract and accounting obligations.

Usage measurement

We record technical and functional events (for example, a completed diagnostic, created application or generated PDF) to operate, secure and improve the service. Legal basis: legitimate interests.

3. Retention periods

• Empty customer accounts are deleted after 3 years of inactivity. Applications and contract-related data are retained as needed to provide the service, handle claims and comply with applicable law.
• Invoices and accounting data: 10 years.
• Documents retained under the GPSR: for the applicable statutory period, which may be up to 10 years.
• Technical and security logs: up to 12 months, unless an incident requires longer retention.

4. Recipients and processors

• Local development server — hosting of the service and database.
• Stripe Payments Europe Ltd. — payment processing. Certain transfers may be covered by the EU-US Data Privacy Framework.
• Local development SMTP configuration — sending transactional emails.
• OpenAI, only when artificial-intelligence features are enabled: processing data submitted to those features to produce the requested result.
• Google Ireland Ltd. and Google LLC, only after consent: audience measurement with Google Analytics 4 and advertising conversion attribution with Google Ads. Transfers outside the EEA may occur under the safeguards offered by Google.

We do not sell personal data.

5. Your rights

Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction, objection or portability of your data, and withdraw consent at any time. Contact legal@eorigpsr.com. You may also lodge a complaint with the CNIL.

6. Cookies

The service uses cookies strictly necessary for sign-in, security and remembering preferences. With your prior consent, Google Analytics 4 may measure viewed pages and successful actions, and Google Ads may attribute leads, sign-ups and purchases to advertising campaigns. Form contents, email addresses and names are not sent in measurement events.

The “audience measurement” and “advertising and conversions” categories are disabled by default and can be accepted or rejected separately. You can withdraw or change consent at any time using the “Cookies” link in the footer. Your choice is stored for 180 days.

7. Security

We apply appropriate technical and organisational measures, including encrypted communications, access controls and protection of integration secrets and credentials.

8. Updates

This policy may change to reflect legal, technical or functional developments. The update date appears at the top of the page.