Privacy Policy

Last updated: 15 August 2026

This Privacy Policy explains how NIS2Ready ("we", "us") collects, uses and protects personal data when you use our website (nis2.saevelis.com) and services. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national law.

1. Who we are

NIS2Ready is an independent provider of NIS2 self-assessments and gap analysis reports for EU SMEs. For any privacy question, contact us at mfleite@saevelis.com.

2. What we collect

• Self-assessment answers: your responses to the questionnaire (business information; please do not enter personal data of individuals).
• Contact details: name, work email, company, company size, sector, country, provided when you request your results or buy a report.
• Payment data: processed by our payment provider (Stripe). We do not store card numbers.
• Technical data: anonymized analytics (page views) if analytics is enabled; we do not use advertising cookies.

3. Why we process it (legal basis)

• Performance of a contract: to prepare and deliver the report you purchased.
• Legitimate interest: to respond to your request for results and follow up on your inquiry (Art. 6(1)(f) GDPR).
• Legal obligation: invoicing and tax records.

4. How long we keep it

• Report delivery: your answers are used to generate the report and delivered to you by email; they are not kept in a database after generation.
• Report copies in our storage: a copy of the generated PDF is stored with a 30-day retention (to resend a lost email or let a partner re-download it), then expires automatically.
• Usage and error logs: email address and company name, kept for up to 90 days for support, fraud prevention and error monitoring.
• Purchase records: entitlement and payment reference, kept for up to 90 days. Invoicing records are kept for the legally required period.
• Partner program records: partner and client records are kept while the membership is active and for up to 12 months after the last activity.

You can ask us to delete your data at any time (see section 6); we act within 30 days, unless we are legally required to keep a record (for example, invoicing).

5. Who we share it with

We only share data with the processors strictly needed to operate the service:

• Stripe (payment processing): your name, email and payment details are sent to Stripe to process the transaction. We never see or store card numbers. Stripe Privacy: stripe.com/privacy.
• Resend (email delivery): when you buy a report, your email address is processed by Resend to deliver your assessment link and your report. Resend Privacy: resend.com/legal/privacy.
• Vercel (hosting): the website and the API that generates your report run on Vercel's infrastructure. Vercel Privacy: vercel.com/legal/privacy.
• Upstash (Vercel KV, EU/Frankfurt region): entitlements, keys, partner records and the temporary report copies are stored in our Upstash Redis database. Privacy details: upstash.com.
• Plausible (cookieless analytics): anonymized, aggregated page views only, without cookies or personal identifiers. Plausible Privacy: plausible.io/privacy.

We never sell your data. We do not share assessment answers with third parties for marketing.

6. Your rights

Under the GDPR you have the right to access, rectify, erase ("right to be forgotten"), restrict processing, object to processing, and data portability. You also have the right to lodge a complaint with your national supervisory authority. To exercise any of these rights, email mfleite@saevelis.com.

7. Where data is stored

Our database (Vercel KV / Upstash) is hosted in the EU (Frankfurt). The website and the report API run on Vercel's infrastructure, which may process requests outside the EEA under Vercel's data processing terms. Payment data is handled by Stripe, which applies appropriate safeguards for international transfers.

8. Cookies

We do not use advertising or profiling cookies. If privacy-friendly analytics (e.g., Plausible) is enabled, it collects anonymized, cookieless statistics.

9. Changes to this policy

We may update this policy from time to time. The latest version is always available on this page with the "last updated" date.

← Back to NIS2Ready