Version 1.0 · Effective 16 November 2026 · denexus.ai/legal/privacy
Who we are and what this covers
Who we are. DeNexus, Inc., a Delaware corporation, 101 Federal Street, Suite 1900, Boston, MA 02110, USA, is the controller of the personal data described here. Our group includes two wholly owned subsidiaries, which support our operations in Europe:
- DeNexus Tech. S.L., Calle Goya, 15, 28001 Madrid, España (NIF B01798289). It is our establishment in the European Union.
- DeNexus UK Limited, 5 New Street Square, London EC4A 3TW, United Kingdom. It is our establishment in the United Kingdom.
Contact: privacy@denexus.ai.
What this notice covers. How we handle personal data when you visit denexus.ai, create a DeRISK™ Intelligence Platform account, use the platform, or communicate with us.
What it does not cover. Personal data contained in documents and data our customers upload to the platform. We process that on our customers' behalf, under our Data Processing Addendum (denexus.ai/legal/dpa). If your data is in such material, please contact the customer that submitted it.
1. What we collect, why, and for how long
| What | Why we use it | Legal basis (EU/UK) | How long we keep it |
|---|---|---|---|
| Website visits: IP address, browser and device details, pages viewed, cookie identifiers | Run and secure the site; with your consent, analytics, session recordings and marketing, through HubSpot, Google, Microsoft, LinkedIn and ZoomInfo | Legitimate interests for necessary cookies; consent for analytics and marketing cookies | As set out in our cookie policy (denexus.ai/legal/cookies) |
| Enquiries and contacts: name, work email, company, job title, your message | Answer you and discuss our services | Legitimate interests; steps before a contract | 24 months after our last contact |
| Marketing: name, work email, company, preferences | Send news, research and event invitations | Consent, or legitimate interests where the law allows for business contacts | Until you unsubscribe, which you can do at any time |
| Account data: name, work email, organization, country, job title, sign-in identifiers, settings | Provide the platform and manage your account | Contract; legitimate interests | While your account exists and 12 months after it closes, longer where the law requires |
| Acceptance records: version accepted, date and time, IP address, browser | Prove which terms you accepted | Legitimate interests; legal obligations | For the life of the account, plus the legal limitation period for contract claims |
| Usage data and run records: actions in the platform, timestamps, technical identifiers | Operate, secure, support and improve the platform; detect and stop abuse | Legitimate interests | Run records 12 months on a rolling basis; usage statistics only in de-identified form |
| Customer relationship: your organization's contacts, accounts and deals, and product usage such as logins, runs and plan | Manage our relationship with your organization: account management, renewals, and offers based on how you use DeRISK | Legitimate interests; you can object at any time | 24 months after our last contact |
| Support: your messages and the details you share | Help you and improve support | Contract; legitimate interests | 24 months after the request closes |
| Billing (paid plans): billing contact, invoices, payment details | Invoice and meet tax and accounting duties | Contract; legal obligations | As long as tax and accounting law requires |
We do not use personal data to train AI Models. We do not sell personal data, or share it for cross-context behavioural advertising, except through marketing cookies you accept. You can refuse or withdraw that at any time through "Your privacy choices" or "Cookie settings" at the bottom of every page, and we honour Global Privacy Control signals.
2. Who we share it with, and where it goes
2.1 Recipients. We share personal data only as needed with:
- service providers acting for us, such as cloud hosting, email delivery, customer relationship management and support tools, bound by contract to protect it;
- our group companies, DeNexus Tech. S.L. (Spain) and DeNexus UK Limited (UK), whose sales, marketing and revenue operations teams use our customer relationship management system, acting on our behalf;
- your organization, for account data about its users;
- professional advisers, such as lawyers and auditors, under confidentiality;
- authorities, where the law requires;
- a buyer or successor, if our business is sold or reorganized, under equivalent protection.
2.2 International transfers. DeNexus is based in the United States, and personal data may be processed there. For transfers from the EEA, the UK or Switzerland, we use the European Commission's standard contractual clauses, with the UK Addendum and Swiss amendments where they apply. You can ask for a copy at privacy@denexus.ai.
3. Your rights
3.1 EEA, UK and Switzerland. You can ask us to:
- give you access to your personal data and a copy of it;
- correct or delete it;
- restrict how we use it, or object to our use based on legitimate interests, including direct marketing;
- transfer it to you or another provider in a usable format;
- withdraw consent at any time, without affecting earlier use.
You may also complain to a data protection authority, such as Spain's Agencia Española de Protección de Datos, the UK Information Commissioner's Office, or the authority where you live or work.
3.2 Complaints in the United Kingdom. If you are in the UK and want to complain about how we use your personal data, email privacy@denexus.ai. We acknowledge complaints within 30 days and respond without undue delay. You can also complain to the Information Commissioner's Office.
3.3 United States. Depending on your state, including California, you may have the right to know what personal data we hold, and to access, correct or delete it. You may also opt out of the sale or sharing of personal data, and of targeted advertising. We honour Global Privacy Control browser signals as an opt-out. We will not discriminate against you for using these rights. You may use an authorized agent.
3.4 How to ask. Email privacy@denexus.ai. We may need to verify your identity. We answer within one month in the EEA and UK, and within the time required by US state law.
4. Security, children, changes and contact
4.1 Security. We protect personal data with the measures described at denexus.ai/legal/security.
4.2 Children. Our website and platform are for businesses and are not directed at anyone under 18. We do not knowingly collect their data.
4.3 Automated decisions. We do not take decisions about you that produce legal or similarly significant effects based solely on automated processing.
4.4 Changes. We publish each version of this notice, with its effective date, at denexus.ai/legal. We tell account holders about material changes by email or in the product.
4.5 Contact. privacy@denexus.ai · DeNexus, Inc., 101 Federal Street, Suite 1900, Boston, MA 02110, USA.