Privacy Policy

NIIOMA acts as a data controller where it determines why and how personal data is processed. This includes account administration, billing, platform security, communications, analytics, marketing and the operation of NIIOMA’s business.

Where NIIOMA processes personal data submitted by an organisation solely on that organisation’s documented instructions, NIIOMA acts as a data processor and the organisation acts as the data controller. This applies to personal data that organisations upload, store or manage through the platform, such as contact lists, lead data, employee information and documents containing personal data. Such processing is governed by our Data Processing Agreement, which is available on our legal pages and incorporated into the NIIOMA OS Platform Terms.

The legal role depends on who decides the purpose and means of the specific processing activity. NIIOMA may act as a controller for some activities and a processor for others. Where NIIOMA acts as a controller, this Privacy Policy describes how your data is handled. Where NIIOMA acts as a processor, the relevant organisation’s own privacy notice applies.

Information you provide to us

• Account information (required): first name, surname, job title, function, work email address and password. This information is necessary to create and operate your NIIOMA OS account. If it is not provided, we cannot create your account.
• Company information (required for organisation accounts): company name, industry, size and description. Branding materials are optional. Company information is necessary to create an organisation profile on the platform.
• Form submissions: first name, surname, business email, company name and any message content when you submit a form on our website (such as ‘Become a member’, ‘Apply for Cognitive Services’ or ‘Contact us’).
• Communications content: messages, files, documents and other content you share through NIIOMA OS Chat, NiioFeed posts, comments and other platform features.
• Video and audio data: video call recordings and transcriptions, where recording has been initiated and all participants have been notified (see section 8).
• Payment information (required for paid subscriptions): billing details processed through our payment provider, Stripe. We do not store your full card details on our servers. Payment information is necessary to process your subscription.
• Cognitive Services information: business information, strategic documents and other materials you share with us in connection with our Cognitive Services engagements.

Information we collect automatically

• Usage data: pages viewed, features used, actions taken within NIIOMA OS, timestamps and session duration.
• Device and technical data: IP address, browser type and version, operating system, device type, screen resolution and language preferences.
• Log data: server logs, error reports and performance data.
• Cookie data: information collected through cookies and similar technologies. See our Cookie Policy for details.

Information from third parties

• Authentication providers: where you sign in using a third-party service, we may receive your name and email address from that provider.
• Publicly available business information: we may supplement company profile information with publicly available business data to improve the relevance of our platform. Sources include Companies House and equivalent corporate registers, organisation websites, public professional profiles and public product directories. We do not use this data to create profiles of individuals without their knowledge.

The table below sets out each processing purpose, the typical data involved and the legal basis we rely on under UK GDPR.

Where we rely on legitimate interests, we have conducted a balancing assessment to ensure that our interests are not overridden by your rights. Details of these assessments are available on request.

We do not sell your personal data. We share your information only in the following circumstances.

• With other NIIOMA OS users: your profile information, NiioFeed posts and other content you choose to share on the platform are visible to other users in accordance with your privacy settings and the platform’s functionality.
• Service providers: we use trusted third-party providers to help us deliver our services. These include Amazon Web Services (AWS) for cloud hosting and infrastructure (data stored in the EU/UK), Anthropic (Claude API) for AI processing of intelligent features, LiveKit Cloud for video call infrastructure, Deepgram and AssemblyAI for speech-to-text transcription services (where recording is enabled), Stripe for payment processing, Elasticsearch for search functionality, and Sentry for error tracking and performance monitoring.
• Cognitive Services partners: where necessary to deliver Cognitive Services engagements, with your prior knowledge and agreement.
• Legal requirements: where required by law, regulation, court order or governmental authority.
• Business transfers: in connection with a merger, acquisition or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change.

NIIOMA is based in the United Kingdom and our primary infrastructure is hosted within the European Economic Area (EEA) and UK. Where we transfer personal data outside the UK or EEA, we ensure appropriate safeguards are in place.

These safeguards include UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs), transfers to countries recognised as providing adequate data protection by the UK Secretary of State or the European Commission, and additional technical and organisational measures where necessary.

Details of the safeguards in place for specific transfers are available on request.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. The following retention periods apply.

• Account data: retained for the duration of your account. Following account deletion, account data is removed from the active platform within 30 days. A copy is retained in a restricted archive for 12 months following deletion to support any outstanding queries, disputes or legal obligations, after which it is permanently erased.
• Communications and content: retained for the duration of your account. Upon account deletion, your messages and content are removed from the active platform within 30 days. Messages sent to other users remain visible to those users as part of their own conversation history. Exported data is available through the data export process described in the Platform Terms.
• Form submissions and CRM data: retained for up to 24 months from the date of submission, unless you become a customer, in which case retention is linked to the customer relationship.
• Payment records: retained for 7 years in accordance with UK tax and accounting obligations.
• Log and analytics data: retained for up to 12 months. After this period, data is either permanently deleted or irreversibly anonymised so that it can no longer identify any individual.
• Security logs: retained for up to 24 months to support security investigations, incident response and compliance obligations.
• Backup copies: automated backup systems may retain copies of data for up to 90 days after deletion from the active platform. Backup copies are not actively accessed or used and are overwritten in the ordinary course.

Where data is subject to a legal hold, regulatory requirement or ongoing dispute, retention may be extended for the duration of that obligation. Financial records retained under legal obligation are not affected by account deletion.

NIIOMA OS uses AI-powered features to enhance your experience. These include intelligent matching between enterprises and vendors, content recommendations on NiioFeed, and smart suggestions within platform tools.

These features are powered by the Claude API (provided by Anthropic). When your data is processed through these AI features, it is used solely to provide you with the relevant feature or recommendation.

AI training commitment: NIIOMA does not permit third-party AI providers to use your private content to train their general-purpose models, except where an organisation has expressly opted in. Users should not submit platform content directly through third-party feedback mechanisms unless authorised to do so.

AI outputs are designed to assist, not replace, human decision-making. You are not subject to decisions based solely on automated processing that produce legal or similarly significant effects. You may contact us to request human review of any AI-assisted recommendation or decision.

Our Responsible AI policy provides further detail on our approach to AI ethics and governance.

NIIOMA OS includes video and audio call features with optional recording and transcription capabilities. The following rules apply.

Recording may be initiated by any participant with recording permissions. All participants are notified when recording begins, through both a visual indicator and an audio announcement. Participants may leave the call if they do not wish to be recorded.

Recordings and transcripts are stored securely and are accessible to the participants of the call and to Account Administrators within the relevant organisation. Transcription is provided by Deepgram or AssemblyAI. AI-powered summarisation may be applied to transcripts to generate meeting summaries, which are clearly marked as AI-generated.

Recordings and transcripts are retained for the duration of the organisation’s account, unless deleted earlier by an Account Administrator. Upon account deletion, recordings and transcripts are removed in accordance with the retention periods described in section 6. Any participant may request deletion of a recording or transcript by contacting the Account Administrator of the organisation that initiated the recording, or by contacting us at privacy@niioma.com.

Under UK GDPR, you have the following rights.

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data, subject to legal retention requirements.
• Restriction: request that we restrict processing of your data in certain circumstances.
• Portability: request a copy of your data in a structured, commonly used, machine-readable format.
• Withdraw consent: where processing is based on consent, withdraw that consent at any time.
• Automated decision-making: not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

Your right to object: You may object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on our legitimate interests, where your particular situation gives grounds for objection. You can exercise this right by contacting privacy@niioma.com or by using the unsubscribe controls provided in our marketing communications.

To exercise any of your rights, contact us at privacy@niioma.com. We will respond within one month. In complex cases, we may extend this period by up to two further months, and we will inform you of any extension within the initial one-month period.

These rights are in addition to any contractual data export rights described in the NIIOMA OS Platform Terms.

We implement appropriate technical and organisational measures to protect your personal data. These include encryption in transit (TLS 1.2+) and at rest (AES-256), access controls, regular security assessments and incident response procedures. Further details are available in our Security policy.

Our services are not directed at individuals under the age of 18. NIIOMA OS requires users to be adults acting in a professional or business capacity. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@niioma.com.

We may update this Privacy Policy from time to time. We will publish the updated version on our website with a revised effective date. Where we make material changes that affect how your personal data is processed, we will notify you through the platform or by email before the changes take effect.

Where a new use of personal data requires your consent, we will request that consent before beginning the processing. We will not rely on continued use of the platform as a substitute for consent where consent is the applicable legal basis.