Privacy Policy

Last updated: 30 September 2026

This Privacy Policy explains how NEX SOCIETÀ COOPERATIVA – IMPRESA SOCIALE ("Nex", "we") processes personal data in connection with your use of NexWallet ("the Service"), the platform associations and other organisations use to issue membership cards, loyalty cards, coupons and tickets for Apple Wallet and Google Wallet and to collect their members' fees online, in accordance with Regulation (EU) 2016/679 (the "GDPR").

1. Data Controller

The data controller for account, billing and platform-usage data is:

NEX SOCIETÀ COOPERATIVA – IMPRESA SOCIALE
Privacy contact: info@nexcoop.it

2. Two distinct roles: Controller and Processor

NexWallet is used by many organisations, each with its own members or customers. Depending on the data in question, Nex acts in one of two roles:

• Data Controller for the account data of the people who run an organisation on the Service (name, email, password, organisation membership, role, login logs, preferences) and for the organisation's billing data relating to its NexWallet subscription.
• Data Processor for the data an organisation enters or collects through the Service about its own members, customers or attendees: identity and contact details, card number, cardholder photo, card balances and activity, membership fee payments. In this case the organisation is the Controller, determining the purposes and means of processing; Nex only processes this data on the organisation's instructions, as set out in the Terms of Use.

If you received a card from an association or a business, that organisation is the controller of your data: please contact it first with any request.

3. Categories of data processed

• Account data: name, email, password (stored only as a hash), preferred language, organisation, role and permissions; two-factor authentication and passkey data if enabled; browser sessions.
• Organisation billing data: legal name, tax code, VAT number, registered address, SDI recipient code, certified email (PEC), subscribed plan and invoices issued.
• Member and customer data entered by the organisation: name, email, phone, card number, validity dates, cardholder photo (only if the organisation turns this feature on), card data (points, stamps, remaining uses, tier) and activity history (uses, recharges, check-ins, renewals).
• Membership fee payments: payer's name, email and phone, amount, date, receipt number and payment identifiers. Payment card details are entered directly on Stripe: NexWallet never receives or stores them.
• Wallet data: when a card is added to Apple Wallet, the device registers an identifier and a token with the Service, used only to send it updates; for Google Wallet the card is created with Google using the data shown on it.
• Technical data: IP address, application logs, session and security cookies.

4. Purposes and legal basis

• Providing the Service and managing your account — performance of a contract (Art. 6(1)(b) GDPR).
• Issuing and updating cards in wallets, running the scanner, collecting membership fees and sending members receipts and expiry reminders, on the organisation's behalf — performance of the contract with the organisation, which remains the controller of this processing (Art. 28 GDPR).
• Subscription billing, electronic invoicing and retention of accounting records — legal obligation (Art. 6(1)(c)).
• Security, abuse prevention, application logging — legitimate interest (Art. 6(1)(f)).

5. Payments

Payments are handled by Stripe. Members' fees are paid into the organisation's own Stripe account; the organisation is the seller and receives the money directly. The NexWallet subscription is paid to Nex. In both cases Stripe processes payment data as an independent controller, under its own privacy policy (stripe.com/privacy).

6. Recipients and sub-processors

Data is processed with the help of the following providers:

• Amazon Web Services (AWS) — server and database hosting, email delivery (Amazon SES).
• Apple (Apple Wallet and push notifications), Google (Google Wallet) and, where enabled, Samsung (Samsung Wallet) — receive the card's contents in order to display and update it on the holder's device.
• Stripe — payments, as an independent controller for payment data.
• TeamSystem S.p.A. (Fatture in Cloud) — issuing the subscription's electronic invoices, which are transmitted by law to the Italian Revenue Agency through the Exchange System (SdI).

The Service's server and database are located in the European Union (AWS, Milan); emails are also sent from the European Union (AWS, Frankfurt). Some providers, such as Apple, Google and Stripe, may also process data outside the European Economic Area: such transfers rely on the EU-U.S. Data Privacy Framework, to which they adhere, and on the Standard Contractual Clauses approved by the European Commission.

7. Data retention

Account data is retained for the duration of the contractual relationship and deleted or anonymised within a reasonable period after it ends, subject to legal retention obligations. Invoices and accounting records are kept for ten years, as Italian law requires. Member and customer data is retained according to the organisation's instructions and deleted when the organisation removes it or closes its account.

8. Your rights

Under Articles 15-22 GDPR you have the right to access your data, request rectification or erasure, restrict processing, request data portability, object to processing, and withdraw consent where applicable. If your data was entered by an organisation you are a member or customer of, please contact it directly, or write to info@nexcoop.it and we will help direct your request. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.gpdp.it) or your local supervisory authority.

9. Cookies

We use only strictly necessary technical cookies: for sessions and authentication, for form protection and to remember the language you chose. We do not use third-party profiling, marketing or analytics cookies. Payment pages are served by Stripe, which sets its own cookies under its own policy.

10. Security

We implement appropriate technical and organisational measures, including encryption in transit (HTTPS), passwords stored only as hashes, optional two-factor authentication, separation of data between organisations, role-based access control, recharge PINs stored in hashed form, signed scanner links and a history of every card operation.

11. Children

The Service is intended for organisations and is not directed at minors as users. Where an organisation issues cards to members who are minors, it is responsible for informing those with parental responsibility and obtaining their consent where required.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users of any material changes.

13. Contact

For any privacy-related request: info@nexcoop.it