> ## Documentation Index > Fetch the complete documentation index at: https://docs.nuwacom.ai/llms.txt > Use this file to discover all available pages before exploring further. # Handling of personal and private data Last updated: September 21, 2026 nuwacom is an AI-powered platform that connects a company’s knowledge and makes it usable for day-to-day work. nuwacom provides employees with fast and easy access to documents, meetings, and connected systems. A key benefit is personalization: results, answers, and suggestions are tailored to the respective user and their permissions. nuwacom operates the platform as Software-as-a-Service in EU data centers and sets up each customer as a separate, logically segregated tenant; access to the customer’s data by other customers or unauthorized third parties is excluded. nuwacom uses only what the customer provides as the data basis: data from the systems or connectors that the customer connects, and content that the customer creates directly in nuwacom. nuwacom does not use its own data sources, and the permissions from the connected systems continue to apply unchanged. To ensure the functionality of the platform, nuwacom processes personal and private data. This document describes what data this is, the purpose for which nuwacom processes it, where it is stored, and when nuwacom deletes it. It is intended as a basis for the customer’s internal reviews, data protection impact assessments, and works agreements. *** ## 1. Allocation of roles and responsibility nuwacom acts toward customers as a processor within the meaning of Art. 28 GDPR. The customer remains the controller within the meaning of the GDPR. nuwacom processes personal data exclusively on the customer’s documented instructions and within the framework of the data processing agreement (DPA), the terms of use, and the platform agreement. The customer alone decides which documents, meetings, and information are added to the platform. nuwacom has no control over the identity of the data subjects or over the types of personal data processed. The transparency and information obligations under Art. 13 and 14 GDPR therefore lie with the customer; nuwacom supports the customer with documentation, evidence, and technical functions. The customer
– determines the purposes, content, user groups, and configuration. nuwacom GmbH
Universitätsstraße 3
56070 Koblenz
– operates the platform. heyData GmbH
Schützenstraße
10117 Berlin
[datenschutz@heydata.eu](mailto:datenschutz@heydata.eu) > **Principle:** nuwacom does not use customer data to train general AI models. nuwacom does not analyze content for its own purposes and does not share it with third parties that are not contractually bound as sub-processors. ## 2. User profiles and access data nuwacom creates a user profile for each authorized person. It is used for authentication, assignment of permissions, and personalization of work results. For this purpose, nuwacom processes: * **Professional contact and profile data** – first and last name, email address, position, department, location, and other required or voluntary profile information * **Login data** – email address and password or the claims transmitted by the customer through the SSO process If the customer uses Single Sign-On and SCIM, nuwacom manages end-user identities via the customer’s identity provider. The customer therefore controls the creation, modification, and deactivation of accounts themselves. ## 3. Content and connected knowledge sources As content, nuwacom processes all data that the customer and its users add to or generate in the platform: documents, files, prompts, configurations, knowledge bases, search queries, chat histories, outputs, agents, skills, workflows, and apps as well as – if activated by the customer – meeting transcripts and summaries. This content may include personal data of the customer’s employees, authorized third parties, and meeting participants. nuwacom ensures that content is displayed only to those users who are authorized to access it. Access follows a role-based permission concept based on the least-privilege principle; for connected systems, the permissions assigned there remain authoritative. ## 4. Usage data and logging For operation, security, and error analysis, nuwacom processes technical usage data such as IP address, device characteristics, access times, and user ID. Access and audit logs are tamper-resistant and make it possible to trace input, changes, and deletion. > **No performance or behavior monitoring by nuwacom.** nuwacom does not analyze usage data to evaluate the behavior or performance of individual employees. Analyses to improve the services are carried out exclusively in anonymized or aggregated form at workspace level – such as usage statistics, error and performance logs, security monitoring, and model routing. None of these analyses access content as content. > > Access by nuwacom employees to customer data occurs only at the customer’s request in a support case and is logged. ## 5. Meeting notetaker If the customer activates the function, nuwacom can transcribe and summarize meetings. Transcripts and summaries are customer data and are stored in the customer’s workspace, where the customer can view, edit, and delete them. * The customer determines which meetings are recorded and which meetings the agent may attend; individual meetings can be excluded and the agent can be removed. * The agent actively informs participants in the meeting about the active note-taking function; nuwacom also provides consent management functionality, including dual-party consent. * The customer is responsible for determining the legal basis for transcripts and for obtaining the required notices and consents. If the customer deletes a transcript or terminates the account, nuwacom permanently removes the transcript from active systems and backups within 30 days. ## 6. Processing by AI models nuwacom forwards requests to the language models approved by the customer. Processing takes place with the providers listed in the sub-processor list; nuwacom excludes permanent storage of content by the model providers. Customer data is not used to train general AI models. Individual AI services offer different operating modes (global or EU-only). nuwacom enables the customer to restrict processing entirely to the EEA: in the workspace settings, only models hosted in the EEA can be permitted and all other models and regions can be disabled. The customer’s administrators configure this centrally; it applies bindingly to all regular users – models that have not been approved are not available for selection in the interface. Initial setup is carried out during onboarding together with the responsible Customer Success Manager; nuwacom confirms the configured settings in writing upon request. As long as no EU-only mode is configured, prompts and outputs may be processed outside the EU. If such processing occurs, EU Standard Contractual Clauses, adequacy decisions, or the EU-US Data Privacy Framework apply. > **Privacy Mode:** nuwacom anonymizes personal data upon request before it is passed to a model and restores the context for users after processing. The result remains fully readable, while model processing takes place without clear-text data. The function is currently in open beta. ## 7. Storage location, hosting, and sub-processors nuwacom stores customer data at rest exclusively within the EU. Backups are performed zone-redundantly within the same region; backup or recovery data is not outsourced across regions. The storage location is contractually anchored through the hosting option selected in the order form. | Hosting option | Configuration | | :- | :- | | Standard | Microsoft Azure, data centers within the EU | | Germany / STACKIT | At the customer’s express choice; operation in the eu01 region (Germany) | nuwacom engages sub-processors only to the extent necessary and contractually obligates them to at least equivalent confidentiality and data protection duties. nuwacom publishes the current list of sub-processors, including location, service, and transfer basis, in the [Trust Center](https://trust.nuwacom.ai). nuwacom notifies the customer of changes; the customer may object within 15 days on data protection grounds. ## 8. Special categories of personal data nuwacom excludes the processing of special categories of personal data under Art. 9(1) GDPR by default. The data processing agreement expressly states that the services are not intended for the processing of sensitive data. For customers who are subject to professional secrecy obligations under Section 203 of the German Criminal Code (StGB), nuwacom offers a separate supplementary agreement. ## 9. Deletion, return, and retention periods nuwacom deletes personal data as soon as there is no longer a business purpose and returns it at the customer’s request via the provided export interfaces. nuwacom provides a deletion log upon request. Data carriers are destroyed in accordance with DIN 66399 and with reference to NIST SP 800-88 Rev. 1. | Data category | Retention | | :- | :- | | Active customer data | 30 days rolling; monthly snapshots for 12 months | | Backup copies | 30–90 days; complete destruction no later than 90 days after the end of the contract | | Audit logs / access logs | 30–90 days, then automatic deletion | | Meeting transcripts | According to the customer’s configuration; after deletion, removal from active systems and backups within 30 days | | Customer account after contract end | Immediate deactivation; complete deletion within 90 days | ## 10. Technical and organizational measures * **Tenant separation** – dedicated, logically segregated tenant for each customer; row-level security prevents data from being mixed * **Encryption** – TLS 1.2/1.3 in transit, AES-256 at rest * **Access control** – role-based permission concept, MFA for remote access, review at least annually * **Monitoring** – log management, intrusion detection, annual penetration tests, quarterly scans * **Personnel** – confidentiality commitment and mandatory annual awareness training nuwacom is **ISO/IEC 27001:2022** **certified** (SOCOTEC, October 27, 2025). ## 11. Data subject rights and security incidents nuwacom promptly forwards requests from data subjects to the customer as the controller and supports the customer to the technically possible extent in responding to them. nuwacom informs the customer of a personal data breach without undue delay and supports the customer in fulfilling its obligations under Art. 33 and 34 GDPR. ## 12. Further documents and contact Certifications, technical and organizational measures, subprocessors Information on data processing Information on data privacy For further questions, nuwacom can be reached at [info@nuwacom.ai](mailto:info@nuwacom.ai). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.