Version 1.3 · Last updated 8 October 2026
Controller: NUADU Holding Pte. Ltd., UEN 201905864N, 33 Ubi Avenue 3, #08-13, Vertex, Singapore 408868 ("NUADU"). NUADU Holding owns and operates the NUADU product and this website.
Contact for privacy matters: privacy@nuadu.com
EU representative (Art. 27 GDPR): NUADU Sp. z o.o., al. Zwycięstwa 241/13, 81-521 Gdynia, Poland — reachable at privacy@nuadu.com
Supervisory authority: you may lodge a complaint with the data protection authority of your habitual residence or place of work (in Poland: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa). Singapore residents may contact the Personal Data Protection Commission (PDPC).
1. Scope and Definitions
"Personal Data" has the meaning given in Art. 4(1) GDPR: any information relating to an identified or identifiable natural person.
This policy applies to Personal Data NUADU collects as controller through nuadu.com: the contact form, the live AI demos, usage analytics and the blog. Where NUADU processes data on behalf of educational institutions, certification bodies or enterprises ("Institutional Clients"), NUADU acts as processor under a separate Data Processing Agreement; that processing, its sub-processors and its data residency are described at nuadu.com/trust and in the DPA, not in this policy.
2. Data We Collect and How We Use It
| Purpose | Data Categories | Lawful Basis | Retention |
|---|---|---|---|
| Contact form (enquiry and diagnostic call) | Name, email, organisation (optional), assessment path, country, number of candidates or students tested per year, target date for the first exam, role, your consent choices, consent timestamp, Turnstile verification result, IP address | Pre-contractual measures at your request (Art. 6(1)(b)) | 2 years after the last contact about the enquiry, then deleted; longer only where a contract follows |
| Routing of enquiries from Poland | The same contact-form data | Legitimate interests (Art. 6(1)(f)) — NUADU's exclusive white-label partner for Poland handles Polish enquiries | As above; EduExpert's retention is governed by EduExpert's own notice (Section 5) |
| Demo access (email gate) | Email address, name (optional), IP address, Turnstile token, a "registered" flag in your browser's sessionStorage (deleted when the browser session ends) | Legitimate interests (Art. 6(1)(f)) — protecting the demos from automated abuse and recording your interest in NUADU in the CRM; results are shown on screen, not emailed | 2 years after last interaction, or earlier if you object or ask for erasure |
| Rate limiting of the demos and forms | Pseudonymised IP address (keyed hash; the IP itself is not stored), type of request (AI demo, speech, demo gate, contact form) and time of the request | Legitimate interests (Art. 6(1)(f)) — protecting the demos and forms from abuse and limiting their cost | 24 hours |
| Marketing communications | Email address, consent record (timestamp, source form, consent text version) | Consent (Art. 6(1)(a)); see the consent texts on the forms. Marketing consent is never a condition of demo access or of the contact form | Until consent is withdrawn; consent records kept 3 years after withdrawal for audit |
| AI demo processing (text, uploaded document, audio) | User-submitted content | Legitimate interests (Art. 6(1)(f)) — providing the analysis you requested | Not retained by NUADU. Sent to Microsoft Azure AI services, processed, discarded (Sections 5–6) |
| Website security (Cloudflare Turnstile) | IP address, browser signals, interaction signals | Legitimate interests (Art. 6(1)(f)) — bot protection and abuse prevention | Session; Cloudflare may retain security logs up to 4 days under its data processing terms |
| Usage analytics and optional session replay (Amplitude, EU hosting; tags loaded through Google Tag Manager) | Pseudonymous device identifier stored in a cookie for 12 months, pages viewed, interactions; with session replay also a reconstruction of your interactions on the page (text you type into forms is masked) | Consent (Art. 6(1)(a)) for each option separately; nothing is loaded or collected until you choose | Cookie: 12 months. Event data: 12 months |
| Blog comments | Not collected — the blog has no comment function at present | — | — |
To open a demo we ask for your work email; we process it to handle your request, as described for the contact form.
CRM. Contact-form submissions and demo-gate registrations are first stored in the website database and then synchronised to NUADU's CRM (Pipedrive): a contact record is matched or created by email address, an enquiry ("deal") is created, and the message is attached as a note. Your marketing status in the CRM is set to "subscribed" only if you ticked the marketing consent. Demo-gate registrations are recorded in the CRM as demo enquiries; NUADU does not send sales or marketing emails as a result of a demo registration.
Necessity of providing data (Art. 13(2)(e)): The contact form needs your name, email, path, country, volume, target date and role so that we can prepare the conversation you asked for; without them we cannot handle the enquiry. Your email address is required to unlock the live AI demos; your name is optional. Without an email address the demos do not run. Providing data for marketing communications and for analytics is entirely optional and does not affect the enquiry or the demos.
Legitimate Interest Assessments have been carried out for AI demo processing, demo-gate registration and CRM recording, rate limiting, Turnstile bot protection and the routing of Polish enquiries, and are available on request from the data protection contact above.
Data Protection Impact Assessment: a DPIA has been carried out for the AI demo processing. A summary is available on request.
3. Special Categories and Children
NUADU does not intentionally collect special category data (Art. 9). Audio recorded in the speaking and pronunciation demos may contain biometric characteristics but is not processed for identification purposes and is not stored by NUADU.
The nuadu.com demos and forms are not directed at children under 16. Where Institutional Clients deploy NUADU for students under 16, the institution is controller and obtains the required parental or guardian consent.
4. Automated Processing (Art. 22)
The live demos produce automated scores and feedback. The writing, speaking and content-scanner demos use GPT-4.1 mini (gpt-4.1-mini, version 2025-04-14), an OpenAI-family model hosted on Microsoft Azure AI Foundry. The speaking demo transcribes your answer with Microsoft Azure AI Speech and GPT-4.1 mini scores the transcript; the pronunciation demo uses Azure AI Speech pronunciation assessment; images uploaded to the content scanner are read with Azure AI Document Intelligence. The models return scores and textual feedback based on statistical patterns, not expert human judgement, and may contain errors or biases. For demo users the outputs are informational only and have no legal or similarly significant effect. No decision about academic standing, employment or access to a service is made solely on this basis.
In institutional deployments a named educator reviews, may override and signs every AI-assisted result; this is a contractual requirement. Data subjects may contest an AI-assisted result through their institution or by writing to privacy@nuadu.com. See the AI Transparency Notice.
5. Recipients and Processors (nuadu.com)
| Recipient | Role | Purpose | Location | Transfer Safeguard |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd. / Microsoft Corporation — Azure AI Foundry (Azure OpenAI), Azure AI Speech, Azure AI Document Intelligence | Processor | AI inference for the live demos | Sweden Central (EU), single region | Microsoft Products and Services DPA; SCCs |
| Cloudflare, Inc. | Processor | Website hosting and server functions (Cloudflare Workers); edge security (WAF, DDoS protection); bot protection (Turnstile) on forms and on every AI demo request | Global network; requests are handled at the Cloudflare data centre nearest to you | Cloudflare DPA; SCCs; EU–US Data Privacy Framework |
| Supabase, Inc. (database for the website, provisioned through Lovable Cloud) | Processor | Storage of contact-form submissions, demo-gate registrations and rate-limit counters (hashed IP addresses, kept 24 hours) | United Kingdom (London) | Adequacy decision (Art. 45 GDPR); Supabase DPA |
| Pipedrive OÜ, Estonia | Processor | CRM: contact records, enquiries (deals) and notes created from contact-form submissions and demo-gate registrations; marketing status | EU (AWS Frankfurt) | Pipedrive DPA (Art. 28 GDPR) |
| Amplitude, Inc. (EU data centre) | Processor | Usage analytics and optional session replay, only after your consent | EU | Amplitude DPA; SCCs |
| Google Ireland Ltd. / Google LLC — Google Tag Manager (when in use) | Processor | Tag container that loads the analytics tags listed in the Cookie Policy, only after your consent | EU / US | Google Ads Data Processing Terms; SCCs; EU–US Data Privacy Framework |
| EduExpert sp. z o.o., Poland | Independent controller after handover | Handling of enquiries submitted with country = Poland; EduExpert is NUADU's exclusive white-label partner in Poland (EduProctor by EduExpert) | Poland (EU) | Not a transfer; EduExpert's own privacy notice applies: eduexpert.eu/polityka-prywatnosci |
| Pipedrive OÜ — Pipedrive Campaigns | Processor | Delivery of marketing emails to subscribers who gave marketing consent | EU (AWS Frankfurt) | Pipedrive DPA (Art. 28 GDPR) |
OpenAI, Inc. is not a processor. The GPT model is operated by Microsoft on Azure infrastructure under Microsoft's terms; OpenAI has no access to data processed through Azure AI Foundry. Microsoft does not use prompts, completions or audio to train or improve any model; this commitment is binding under the Microsoft Products and Services DPA.
Processors used by the NUADU assessment platform for Institutional Clients (Microsoft Azure, Constructor, UserWay, Google Tag Manager, Crisp, Amplitude) are listed at nuadu.com/trust and in the DPA. Only those listed in the table above are used by this website.
6. Data Retention by Processors
Azure OpenAI screens prompts and outputs for harmful content and patterns of misuse. Where potential abuse is detected, a sample of the relevant prompts and outputs may be reviewed, by automated systems by default and, where necessary, by authorised Microsoft employees located in the European Economic Area, who access the data only through secured, just-in-time approved access. Content selected for human review is stored in a separate abuse-monitoring store, isolated per customer resource and located in the EU. Microsoft retains this data only for as long as needed to investigate abuse and protect the service. Content reviewed only by automated means is not stored. None of this data is used to train models. NUADU does not enable Azure's optional storage of prompts or responses.
Azure AI Speech processes streamed audio in server memory in real time and does not store it; audio logging is not enabled. NUADU receives only the recognised text and, in the pronunciation demo, the pronunciation scores. Azure AI Document Intelligence temporarily stores the uploaded image and the extraction results in the same EU region (Sweden Central) for up to 24 hours, after which they are deleted automatically.
7. International Transfers
AI processing for the demos runs in the EU, in a single Microsoft Azure region (Sweden Central), using a regional deployment that does not route prompts to other regions. The website database is hosted in Europe (United Kingdom, London), pursuant to the European Commission's adequacy decision under Article 45 GDPR (renewed in December 2025, valid until 27 December 2031). CRM records and marketing email delivery are handled by Pipedrive in the EU (AWS Frankfurt). The website and its server functions are delivered through Cloudflare's global network: text and images you submit pass through the Cloudflare data centre nearest to you before reaching Azure, so for visitors outside the EU this transit may take place outside the EU (Cloudflare DPA, SCCs, EU–US Data Privacy Framework). The main NUADU application instance also runs in the EU (regions in use: West Europe, North Europe, Sweden Central, Poland Central, France Central); other regions are available to Institutional Clients on request (see nuadu.com/trust). Where data leaves the EU/EEA, NUADU relies on:
- EU Standard Contractual Clauses (Commission Decision 2021/914)
- EU–US Data Privacy Framework, where the recipient is certified
- Adequacy decisions under Art. 45 GDPR
8. Your Rights
You may exercise the following rights by writing to privacy@nuadu.com. NUADU responds within one month (extendable by two months for complex requests, with notice).
| Right | Description | How |
|---|---|---|
| Access (Art. 15) | A copy of your personal data | JSON or CSV |
| Rectification (Art. 16) | Correct inaccurate or incomplete data | Email request |
| Erasure (Art. 17) | Deletion, subject to legal retention duties | Email request; demo-gate and newsletter records are deleted on request |
| Restriction (Art. 18) | Limit processing while a dispute is resolved | Email request |
| Portability (Art. 20) | Consent- or contract-based data in a structured, machine-readable format | JSON or CSV; direct transfer where technically feasible |
| Object (Art. 21) | Object to legitimate-interest processing | Assessed case by case |
| Withdraw consent | Marketing: unsubscribe link in every email or email request. Analytics: "Analytics preferences" in the site footer. Demo emails: unsubscribe link in every email or email request; objection to the demo registration: email request | Effective immediately; does not affect prior processing |
You have the right to lodge a complaint with the supervisory authority named at the top of this policy, or with the authority of your habitual residence or place of work.
9. FERPA (US Institutional Clients)
Where NUADU processes education records on behalf of US educational institutions, NUADU acts as a "School Official" with a "legitimate educational interest" under 34 CFR 99.31(a)(1), uses the records only for authorised purposes, does not redisclose them except to authorised sub-processors named in the institutional agreement, and is subject to the conditions on use and redisclosure applicable to other school officials under 34 CFR 99.33(a)(2). The institutional agreement governs these obligations.
10. Data Security
Data is encrypted in transit (TLS 1.2+) and at rest. Access is limited by role-based access control and multi-factor authentication. Contact-form and demo-gate submissions are checked by Cloudflare Turnstile before they are stored. NUADU notifies the supervisory authority within 72 hours of becoming aware of a personal data breach (Art. 33) and affected data subjects without undue delay where required (Art. 34).
11. Changes to This Policy
Material changes are published on this page with a new date and version, and registered demo users and subscribers are informed by email. Continued use after notice does not amount to fresh consent for any new processing purpose; such consent is obtained separately. Previous versions are available on request.