Privacy Policy

Nexus is provided by PRAGMA IoT SA (“Pragma IoT”, “we”, “us”), Ganas & Ganas Building Complex, Building B14, Perikleous Street – Drosia District, P.O. Box 600 75, 570 01 Thermi, Thessaloniki, Greece. You can reach our Data Protection Officer at dpo@pragma-iot.com.

This policy covers the Nexus web portal (nexus.pragma-iot.com), the Nexus mobile app for Android and iOS and the Nexus API.

Nexus is used by organisations (our customers) and the people they invite. Your organisation decides what data it puts into Nexus and who can see it. For that data — device and measurement data, assets, dashboards, reports, rules and the user accounts it manages — your organisation is the controller and Pragma IoT acts as its processor, under the data processing terms of its agreement with us.

Pragma IoT is the controller for the data we need to run and secure the platform itself, such as security logs, sign-in sessions and push notification registrations. Questions about your organisation’s data are best sent to your organisation’s administrator; we will help them answer.

We do not use advertising, advertising identifiers, third-party analytics or tracking SDKs, we do not collect your location, contacts or photos, and we do not sell personal data.

• Stored on your phone: your sign-in token (in the system’s secure storage — Keychain on iOS, Keystore on Android), your language, theme and app-lock settings, and a hash of your app PIN. They are removed when you sign out.
• Face ID / fingerprint: checked by your phone’s operating system. Nexus only receives “unlocked” or “not unlocked” and never sees your biometric data.
• Push notifications: only if you allow them. The app registers a push token with Nexus so alerts can reach your phone; signing out removes it.
• Camera and microphone: used only by the Pragma Agent when you start a voice or video conversation. Nothing is recorded by the app otherwise.
• Maps and 3D views load map tiles and chart libraries from public providers (see Who receives data), which see your IP address like any website.

• Providing the Service — signing you in, showing your organisation’s data, sending the alerts and reports you or your administrator set up (performance of the contract with your organisation; our legitimate interest in providing it to you, GDPR Art. 6(1)(b) and (f)).
• Security — protecting accounts, detecting abuse, listing your active sessions, keeping an audit trail (legitimate interests; Art. 6(1)(f)).
• Support and service messages — answering requests, telling you about security events such as a password change or two-factor authentication being switched on or off (contract and legitimate interests).
• Push notifications — only with the permission you give in your phone’s settings, which you can withdraw at any time.
• Legal obligations — where the law requires us to keep or disclose data (Art. 6(1)(c)).

The web portal uses only cookies that are strictly necessary for it to work, so it does not show a cookie banner:

• pragma_access, pragma_refresh — keep you signed in (HTTP-only; removed when you sign out; a sign-in lasts at most 30 days without use);
• pragma_tenant — remembers which organisation you selected;
• nexus_locale — your interface language;
• nexus_sso_bind — a short-lived cookie that ties a single sign-on login to your browser.

The browser’s local storage keeps display preferences such as the theme and map mode. No advertising or analytics cookies are used.

Your data is visible to the people in your organisation according to the roles and scopes your administrator sets. Beyond that, we use these providers:

• Hosting — the platform runs on infrastructure operated by Pragma IoT.
• E-mail — invitations, password resets, alerts and scheduled reports are sent from Pragma IoT’s company mailbox info@pragma-iot.com.
• Google Firebase Cloud Messaging and Apple Push Notification service — deliver push notifications (push token and the notification text).
• Map tiles — OpenStreetMap, Esri and CARTO (dark map style in the portal) serve the map images you look at (IP address and requested map area).
• Script CDNs — jsDelivr and unpkg serve the open-source chart and map libraries used by the app’s 3D and map views (IP address).
• Identity providers — if your organisation uses single sign-on, its provider handles your sign-in.
• Pragma Agent — if your organisation enables the assistant, your questions are processed by the Pragma Agent service operated by Pragma IoT.

We may disclose data when the law requires it, or to protect the rights and safety of our users and the Service.

Some providers above (for example Google and Apple for push notifications, and the CDNs) may process data outside the European Economic Area. Where they do, the transfer relies on safeguards recognised by the GDPR, such as the European Commission’s Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.

• Encrypted connections (HTTPS/TLS) between your browser or app and Nexus.
• A separate database for each organisation, and permissions enforced by the server on every request.
• Passwords hashed with Argon2; secrets such as integration passwords and authenticator keys encrypted at rest.
• Two-factor authentication, session overview with remote sign-out, rate limiting, audit logging and an optional app lock on the phone.
• Regular, verified backups. Pragma IoT is certified to ISO/IEC 27001 (information security) and ISO/IEC 27701 (privacy information management).

Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw consent at any time. You can correct your name, language and notification preferences yourself in the portal or app.

To exercise your rights, contact your organisation’s administrator or write to dpo@pragma-iot.com. We answer within one month. If your request concerns data your organisation controls, we will pass it to them and help them respond.

You can also complain to the Hellenic Data Protection Authority (1–3 Kifissias Avenue, 115 23 Athens, Greece, contact@dpa.gr, www.dpa.gr) or to the authority in the EU country where you live or work.

Accounts are managed by your organisation, and you can ask for yours to be deleted at any time:

1. Ask your organisation’s administrator to remove you (Members page in the portal), or
2. E-mail dpo@pragma-iot.com from the address you sign in with, with the subject “Delete my Nexus account”.

We confirm the request and complete it within 30 days. Deleting an account removes your name, e-mail address, phone, picture, password, two-factor settings, single sign-on links, memberships, notifications, notification preferences and push tokens, and signs out every session. Audit log entries stay for their retention period (365 days) linked only to an anonymised account, and copies in backups disappear within 14 days. Your organisation’s equipment data and shared content (dashboards, reports, rules) belong to the organisation and are not deleted.

Uninstalling the app or signing out does not delete your account.

Nexus is a business service and is not directed at children under 16. We do not knowingly collect their personal data.

We update this policy when the Service or the law changes. The date at the top shows the latest version; material changes are announced in the Service or by e-mail. See also our Terms of Service.

PRAGMA IoT SA, Ganas & Ganas Building Complex, Building B14, Perikleous Street – Drosia District, P.O. Box 600 75, 570 01 Thermi, Thessaloniki, Greece. Data Protection Officer: dpo@pragma-iot.com. General enquiries: info@pragma-iot.com, +30 2316 025006.