This Privacy Policy describes how Bluhartmann (“we”, “us”), through the NEXUS platform (the “Platform”), collects, uses, shares, protects and deletes the personal data of: (a) people who use the Platform on behalf of a client company (“Users”, e.g. sales advisors and administrators), and (b) people who chat with those companies’ messaging agents (“Contacts”).
For User account data, the controller is Bluhartmann. For privacy questions or to exercise your rights, write to nico.lomoro@bluhartmann.com.
When a client company uses the Platform to communicate with its own Contacts, that company is the controller of that data and Bluhartmann acts as a processor, handling it on the company’s instructions.
This section specifically describes how NEXUS accesses, uses, stores, shares and deletes Google user data.
If you sign in with Google, we only request the openid, email and
profile scopes, and we use your email, name and account identifier solely to authenticate
you into an account your company already created by invitation. Signing in with Google does not create
a new account.
Connecting a calendar is optional and each User starts it from the Platform’s Agenda, with a consent separate from sign-in. When you connect it we request these scopes:
openid: Identify the Google account you connect, to link it to your user.email: Read that account’s email address, to show you which one is connected.https://www.googleapis.com/auth/calendar.events: Create, edit and delete events in the calendars you choose, so the appointments you schedule in the Platform show up in your Google Calendar (including the Google Meet room of a video call).https://www.googleapis.com/auth/calendar.readonly: See the list of your calendars and their events, so you can choose which ones to sync and so their busy time is reflected in your Agenda.Data we read: the list of your calendars (name, color, whether it is your primary calendar and your access level) and, for the calendars you choose to sync, the events within a window of 30 days back and 180 days ahead: title, description, start and end time, whether it is an all-day event, whether it shows as busy or free, its status and its video-call link. We do not store attendees or attachments, and we do not read calendars you did not choose.
How we use it: solely to provide the two-way sync you see in the Agenda:
What we do not do with your Google data:
Imported events are shown only to you, in your Agenda. Appointments that you or the agent book with a Contact are visible to the authorized Users of your workspace, as part of that Contact’s record. Data is hosted on our server infrastructure, which processes it on our behalf. It is not shared with any other third party.
Google access tokens are stored encrypted and are never shown in the interface or written to logs. All traffic with Google and with the Platform uses HTTPS, and access to the data is restricted per user and per workspace.
NEXUS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
If you connect a Microsoft calendar, we process the same data, for the same purposes and with the same safeguards described in section 3 (reading calendars and events, and writing the Platform’s appointments, including the Microsoft Teams meeting of a video call). You can disconnect it from the Agenda or revoke access at https://account.live.com/consent/Manage.
We do not sell personal data.
We process data on the basis of performing our contract with the client company or providing the requested service, your consent (for example, when you connect a calendar or start a conversation), our legitimate interest in operating and protecting the Platform, and compliance with legal obligations.
Only with providers that help us deliver the service, to the extent necessary and under confidentiality obligations:
Some providers process data outside your country of residence. In those cases we apply appropriate safeguards under applicable law.
We keep data as long as needed for the purposes in this policy, for the duration of the relationship with the client company, or as required by law. Call recordings are deleted after the period each client company sets (by default, 90 days). Calendar data is governed by section 3.5.
We apply reasonable technical and organizational measures: encryption of credentials and tokens, HTTPS connections, per-workspace data separation, role-based access control and audit logs.
Where applicable law grants them, you may exercise the rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time. Write to nico.lomoro@bluhartmann.com. If you are a Contact of a client company, you can also contact that company.
BAJA in the WhatsApp conversation to stop receiving messages.The Platform uses strictly necessary cookies to keep you signed in. We do not use third-party advertising cookies.
The Platform is not directed to minors and we do not knowingly collect their data. If you believe a minor has provided us with data, contact us to delete it.
We will publish the current version at this same address, with its update date. If a change expands how Google user data is used, we will notify you and ask for your consent before applying it.
Bluhartmann · nico.lomoro@bluhartmann.com