Privacy Policy

Last Updated: April 24, 2025

This Privacy Policy explains how CRBO SAS ("we", "us", "our") processes your personal data when you use the Nextbay website (https://nextbay.app). It applies to all visitors, registered users, and contributors. By using our services, you agree to the practices described below. For the terms governing use of the site, please refer to our Terms & Conditions.

1. Data Controller

CRBO SAS, 4 Rue de l’Ancien Four, 01130 Plagne, France
Email: privacy@crbo.fr
SIRET: 982 309 957 00016
RCS: 982 309 957 R.C.S. Bourg-en-Bresse
VAT: FR43982309957

2. What Personal Data We Collect

Account Data: Username and email address provided at registration.
IP Address: Temporarily collected for security and abuse prevention.
Usage Data: Includes browser type, device info, OS, access times. This is used for security and analytics, anonymized where feasible.
Cookies: Only essential cookies are used, required for site functionality. No tracking or marketing cookies are set.

3. Lawful Basis for Processing

Performance of a Contract: To provide and manage your account and services.
Legitimate Interests: To ensure platform security, detect fraud, and improve service usability. A balance of interests is maintained to ensure your rights are not overridden.
Legal Obligations: To comply with applicable legal requirements.

4. How We Use Your Data

To operate and secure the platform.
To manage user accounts and respond to support inquiries.
To analyze usage patterns (via anonymized data) to improve service quality.
To comply with legal requirements.

5. Data Sharing and Transfers

We do not sell or rent your data.
We share data only with Hetzner Online GmbH (EU-based host) for technical infrastructure.
Data is not transferred outside the EEA.
If legally required (e.g., court order), we may disclose data. Where permitted, users will be notified of such requests.

6. Data Retention

Account data is stored until the user deletes the account or requests erasure.
IP logs are retained for up to 12 months for security purposes.
Anonymized usage data may be retained for up to 36 months for statistical analysis.

7. Data Security

We implement appropriate technical and organizational measures to safeguard your data, including secure hosting, access restrictions, and regular security updates. However, no digital system is completely immune to risk.

8. Your Rights

Under the GDPR, you may request:

Access to the personal data we hold about you
Correction of inaccurate or outdated data
Erasure of your data (“right to be forgotten”)
Restriction or objection to our processing of your data
Export of your data (“data portability”)
Withdrawal of consent (if processing is based on consent)

To exercise your rights, please contact us at privacy@crbo.fr. We will respond within one month of receiving your request.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced by email at least 30 days before they take effect.