Data Map

This document is provided in English and Georgian. In case of discrepancy, the English version shall prevail.

Document

Data Map — Records of Processing Activities (ROPA)

Version

1.1

Effective Date

15 October 2026

Last Updated

15 October 2026

Data Controller

Nixyum LLC · Reg. No. 400458045 · Tbilisi, 13 Nikoloz Janashia Street, Georgia

Privacy Contact

[email protected]

Supervisory Authority

State Audit Office of Georgia (SAO) · pdp.sao.ge

Related Documents

Privacy Policy; Data Retention Schedule; Data Retention & Deletion Policy; Cookies Policy; Master Definitions

011. Purpose and Legal Basis for This Document

This Data Map constitutes Nixyum's Record of Processing Activities (ROPA) as required by the Law of Georgia on Personal Data Protection and, by harmonisation, Article 30 of the GDPR. It sets out all categories of Personal Data processed by Nixyum as Controller, the purposes and legal bases for each processing activity, the categories of recipients, the applicable retention periods, and the international transfer mechanisms in use.

This document is maintained and updated as a living compliance record. It is published as part of the Nixyum Policy Suite in the interest of full transparency toward Data Subjects. In the event of any conflict between this document and the Privacy Policy, the Privacy Policy governs for the purposes of Data Subject-facing obligations.

Capitalised terms used in this document have the meanings assigned in the Master Definitions.

This Data Map and the underlying processing records shall be made available to the State Audit Office of Georgia within three (3) working days of any lawful request, in accordance with the Georgian Data Protection Law.

022. Notes on Legal Bases

The following notes apply to the legal bases cited throughout this Data Map:

• Contract: Processing is necessary for the performance of the Terms of Service to which the User is party, or to take steps at the User's request prior to entering into that agreement.
• Legal Obligation: Processing is required by Georgian law, including the Georgian Tax Code, Georgian Data Protection Law, Georgian Electronic Communications Law, or any other applicable legislation or binding regulatory direction.
• Legitimate Interest: Processing serves the legitimate interests of Nixyum or a third party, and those interests are not overridden by the fundamental rights and freedoms of the Data Subject. Every processing activity marked "Legitimate Interest" in this Data Map is subject to a documented Legitimate Interests Assessment (LIA) maintained internally by Nixyum. Data Subjects have the right to object to processing based on Legitimate Interest.
• Consent: The Data Subject has provided freely given, specific, informed, and unambiguous consent. Consent is collected through the Platform's consent mechanisms and may be withdrawn at any time without detriment.
• Vital Interests: Processing is necessary to protect the life or physical safety of the User or another person. Nixyum relies on this basis only in an emergency, for example to alert the emergency services when a person's life is in immediate danger, and only for that purpose.
• Manifestly Made Public: Applied to Special Category Data that the Data Subject has voluntarily made public through their own act of publication on the Platform. This is a distinct legal ground from explicit consent and corresponds to the Georgian Data Protection Law's equivalent of GDPR Article 9(2)(e).

033. Records of Processing Activities

The entries below set out every processing activity Nixyum carries out as Data Controller, grouped by function (Groups A–F). Each entry's retention refers to the Data Retention Schedule, which sets the exact periods, deletion methods and extension triggers.

Group A — Account & Identity Management

Account Registration and Sign-in

• Personal Data: email address; password, stored only as a salted hash; first and last name; date of birth and gender; invitation code, if one was used; when the Terms of Service and the Privacy Policy were accepted; for sign-up or sign-in with Google or Apple, the email address and account identifier the provider gives us and, where it shares them, the name and profile picture; for sign-up with email, a pseudonymised record of the network and type of device used
• Purpose: create and maintain the Account; check the minimum age of 18 at sign-up; let the User sign in and manage their sessions; greet the User by name in service emails; prevent fraudulent and duplicate accounts
• Legal Basis: Contract; Legitimate Interest (fraud prevention, enforcing the minimum age); Legal Obligation (the minimum age)
• Recipients & Transfer: Nixyum's internal systems; hosting provider (EU); email delivery provider (EU); security and bot-protection provider, for the check at sign-up and sign-in (worldwide); Google or Apple, which act as independent controllers when the User chooses to sign in with them
• Retention: for the life of the Account, including the pseudonymised sign-up record. When the User deletes the Account, it is erased within 30 days after the 7-day cancellation period, as the Data Retention & Deletion Policy describes. See the Data Retention Schedule.

Nex Profile

• Personal Data: display name and handle; profile photo; bio; chosen interests; followers and following; optional details the User chooses to show, such as age, gender, location, website, phone number or relationship status, each with its own visibility setting (the date of birth itself is never shown); profile settings
• Purpose: show the Nex profile to other Users; enable social interaction and attribute Content to the Nex; let the User personalise the Platform
• Legal Basis: Contract; Consent (optional details the User chooses to show); Legitimate Interest (authentic interaction)
• Recipients & Transfer: other Users, according to the User's visibility settings; hosting provider (EU); media storage (EU) and content delivery network (worldwide), for the profile photo
• Retention: for the life of the Account. When the Account is deleted, the profile is removed from the Platform, copies in backups are overwritten within 90 days, and copies on content delivery network servers are removed when the files themselves are erased. See the Data Retention Schedule.

Nyx Profile

• Personal Data: display name and handle (a new Nyx receives a generated nickname, which the User can change); avatar; bio; chosen interests; followers and following; profile settings. A Nyx never shows the User's age or gender.
• Purpose: let the User take part without showing who they are; allow expression under a separate identity; support moderation while keeping the Nyx's link to the Account private
• Legal Basis: Contract; Legitimate Interest (enabling pseudonymous expression with internal accountability)
• Recipients & Transfer: other Users, with no visible link to the User's Nex or Account; hosting provider (EU); media storage (EU) and content delivery network (worldwide), for the avatar
• Retention: as for the Nex profile. See the Data Retention Schedule.

The Nex–Nyx Link (Persona-to-Account Mapping) ⚠ Highest privacy sensitivity

• Personal Data: the secure internal record of which Account each Nyx belongs to, through which Nixyum can tell which Nex and which Nyx belong to the same person
• Purpose: accountability for conduct as a Nyx; enforcement of the Community Guidelines and Terms of Service across both Personas; identifying the User behind a Nyx where an order of a Georgian court or Georgian law requires it, in the cases listed in Section 6.3 of the Privacy Policy; ban enforcement
• Legal Basis: Legitimate Interest (platform safety and integrity); Legal Obligation (compliance with lawful orders)
• Recipients & Transfer: internal only, limited to authorised staff who need it, and every access is logged; never shown to other Users; disclosed to third parties only in the circumstances listed in Section 6.3 of the Privacy Policy; hosting provider (EU)
• Retention: for the life of the Account, and for 30 days after the Account is deleted, to meet any pending disclosure obligation; longer only while such a request is pending or a legal hold applies. See the Data Retention Schedule. DPIA-03 covers this processing.

Sparks Card

• Personal Data: what the User puts on their Sparks card, such as an introduction, city, gender, languages and interests, and their answer to a prompt
• Purpose: show the card to other Users who discover people through Sparks
• Legal Basis: Contract (the User chooses to complete a card)
• Recipients & Transfer: other Users who use Sparks, while the card is not hidden; hosting provider (EU)
• Retention: for the life of the Account; the User can hide the card from Sparks at any time in the card editor. See the Data Retention Schedule.

Persona Usage Records

• Personal Data: which Persona (Nex or Nyx) the User used for each piece of Content, including through Act As
• Purpose: safety and moderation; these records are never shown to other Users
• Legal Basis: Legitimate Interest (platform safety and integrity)
• Recipients & Transfer: internal only, authorised staff; hosting provider (EU)
• Retention: which Persona was used stays with the Content for as long as the Content exists. Switches between Personas are recorded as daily counts that identify no one (kept 13 months). If the User allows analytics, a switch is also recorded as a feature use (kept 90 days), with its direction but never the Persona switched to. See the Data Retention Schedule.

Group B — Content & Communication

User Content (Posts, Comments, Stories, Media)

• Personal Data: text; photos, video and audio; links; reactions and comments; stories; Content metadata (time, which Persona posted it, location tag if added)
• Purpose: publish and distribute Content to other Users; enable social interaction (comments, reactions, sharing); check Content against the Community Guidelines, automatically and on Reports
• Legal Basis: Contract (core service); Legitimate Interest (safety); Manifestly Made Public (where Content includes Special Category Data the User chose to publish)
• Recipients & Transfer: other Users, according to the User's settings; hosting provider (EU); media storage (EU); content delivery network (worldwide); computing capacity for Nixyum's own Trust & Safety Models (EU/EEA), for automated checks; law enforcement on a valid legal request
• Retention: until the User deletes it or the Account. Deleted Content is hidden at once and erased within 30 days, unless it is under review, a Moderator removed it, or it is needed for a legal claim; for a photo or video, a short technical record that it existed is kept; copies in backups are overwritten within 90 days, and copies on content delivery network servers are removed when the files themselves are erased. See the Data Retention Schedule.

Private Messages

• Personal Data: message text; attachments and voice messages; send and read times; recipients; message metadata. Messages are encrypted in transit and when stored, but they are not end-to-end encrypted.
• Purpose: deliver private messages to their recipients; include the messages a User sent in their data download; check messages automatically for material that breaks the Community Guidelines; review a reported conversation, or a message held by those checks
• Legal Basis: Contract (messaging); Legitimate Interest (safety: automated checks, and investigating reported harassment or illegal Content)
• Recipients & Transfer: the recipients only; hosting provider (EU); computing capacity for Nixyum's own Trust & Safety Models (EU/EEA), for automated checks, including of photos, videos and voice messages; authorised staff, only for a reported conversation or a held message, and every staff review is logged; law enforcement on a valid legal request
• Retention: while the conversation exists. When a message is deleted for everyone, its text is wiped at once and any photo, video or voice message attached to it is erased within 2 days, unless it is under review or a legal hold applies; a conversation that every participant has deleted is erased within 30 days after the last of them deleted it, unless it has been reported or is under review, or a legal hold applies. When a User deletes their Account, the messages they sent stay with their recipients, shown as from a deleted user. Copies in backups are overwritten within 90 days. See the Data Retention Schedule.

Group C — Technical & Operational Processing

Security and System Logs

• Personal Data: IP address at sign-in and when key features are used; device type, operating system and browser; session identifiers; sign-in and sign-out times; failed sign-in attempts; rate-limit events; approximate location (city and country) derived from the IP address; for sign-up with email, a pseudonymised record of the network and type of device used
• Purpose: detect and prevent unauthorised access, fraud and abuse; show the User their active sessions; alert the User to sign-ins from new devices, unless they turn this off; investigate security incidents
• Legal Basis: Legitimate Interest (platform security, subject to a balancing assessment); Legal Obligation (security incident reporting)
• Recipients & Transfer: Nixyum's internal systems; hosting provider (EU); cache and rate-limiting service (EU); security and bot-protection provider (worldwide); law enforcement on a valid legal request
• Retention: full IP addresses are removed after 72 hours, after which only a pseudonymised network identifier and the country are kept; security logs and sign-in history are deleted after 90 days; the pseudonymised sign-up record is kept for the life of the Account. Longer only while an active security investigation or a legal hold applies. See the Data Retention Schedule.

Encrypted Backups

• Personal Data: encrypted copies of the live databases and Content storage
• Purpose: disaster recovery and business continuity
• Legal Basis: Legitimate Interest (operational continuity)
• Recipients & Transfer: hosting and storage providers (EU); used only for disaster recovery, never to restore data a User deleted
• Retention: no backup or protected copy is kept for more than 90 days. If a system is ever restored from a backup, every Account deletion carried out after that backup was taken is carried out again, from a record of deletions kept separately from the data; what happens to any other deleted data a restoration brings back is set out in Section 9 of the Data Retention & Deletion Policy. See the Data Retention Schedule.

Push Notifications

• Personal Data: if the User allows push notifications, a token that the push notification provider uses to deliver them to the device; the notification itself
• Purpose: tell the User about activity on the Platform; a notification about a private message shows who wrote, never what they wrote
• Legal Basis: Contract (the User allows notifications on the device)
• Recipients & Transfer: push notification provider (worldwide). Unless the User's device uses encrypted notifications, which no iPhone or iPad does today, the provider can see what a notification says, which Persona it is for and who sent it, so when that device receives notifications for both the User's Nex and Nyx, the provider can tell that both go to the same device.
• Retention: the token is deleted when the User signs out of that device, or after 90 days without use. See the Data Retention Schedule.

Group D — Moderation, Safety & Compliance

Content Moderation & Trust & Safety

• Personal Data: reported Content (text, images, video, audio); Content held by automated checks; the reporter's identity (internal, never disclosed to the reported User); the reported User's account history; the moderation decision and its reasons; the enforcement action taken
• Purpose: enforce the Community Guidelines and Terms of Service; investigate Reports; prevent and respond to abuse, harassment and illegal Content; keep the Platform safe
• Legal Basis: Legitimate Interest (platform safety and integrity, subject to a balancing assessment); Legal Obligation (compliance with Georgian law)
• Recipients & Transfer: authorised Moderators (internal); hosting provider (EU); law enforcement on a valid legal request
• Retention: reports, 12 months after the case closes; the case file (Moderators' decisions, the Enforcement Actions taken and appeals), 2 years after the final decision and in any case while an Enforcement Action from it is still in force; longer for serious violations, an active investigation or a legal hold. See the Data Retention Schedule.

CSAM Detection and Reporting ⚠ Sealed evidence, strictly restricted access

• Personal Data: where child sexual abuse material (CSAM) is identified: the material itself, preserved as sealed evidence to which access is strictly restricted; the detection record (codes that identify the material, the time of upload, the account identifier, the file size and the IP address used for the upload); and the NCMEC CyberTipline report reference. For every upload, the IP address used is held for at most 6 hours, so that it can be added to the record if the upload is identified as CSAM; it is then deleted.
• Purpose: block CSAM before it is published; report it to NCMEC and, where required, to the competent authorities; comply with Georgian criminal law
• Legal Basis: Legal Obligation (Georgian criminal law; applicable CSAM reporting law, see REPORT Act in the Master Definitions); Legitimate Interest (child safety, platform integrity)
• Recipients & Transfer: NCMEC; the competent authorities, where required; services that check uploads against known CSAM, which receive only a code computed from an image, never the image itself; strictly restricted internal access, with no general Moderator access
• Retention: for the period set out in the Data Retention Schedule, which is not shorter than the minimum periods set by applicable law (see REPORT Act in the Master Definitions); erasure requests cannot shorten it. DPIA-02 covers this processing.

Appeal Records

• Personal Data: the appeal; the Moderator's review notes; the outcome; correspondence with the User
• Purpose: review appeals against Enforcement Actions fairly; keep a due-process audit trail; find inconsistent moderation decisions
• Legal Basis: Legitimate Interest (fair process, accountability); Legal Obligation (record-keeping for compliance)
• Recipients & Transfer: authorised Moderators (internal); hosting provider (EU)
• Retention: 2 years after the appeal is decided, or longer while its case file is kept; the same extension triggers as moderation records. See the Data Retention Schedule.

Takedown Requests from the Public

• Personal Data: the requester's name and email address; their relationship to the person shown, or their role if they act for them; the addresses and a description of the Content; the declarations the requester confirms
• Purpose: handle requests to remove intimate images shared without consent, and similar unlawful Content; reply to the requester
• Legal Basis: Legal Obligation; Legitimate Interest (protecting the people shown)
• Recipients & Transfer: authorised staff (internal); hosting provider (EU); email delivery provider (EU), for the acknowledgement
• Retention: as set out in the Data Retention Schedule.

Banned Account Identifiers

• Personal Data: a one-way coded form of the email address of a permanently banned Account, and a code for the reason. No Content, username or device identifier is kept.
• Purpose: prevent permanently banned Users from registering again; protect the Platform from repeat serious violators
• Legal Basis: Legitimate Interest (platform safety, subject to a balancing assessment). Erasure requests may be refused on this basis.
• Recipients & Transfer: internal systems only, not accessible from outside; hosting provider (EU)
• Retention: depends on how serious the violation was, as set out in the Data Retention Schedule; for an Account deleted because its holder is under 18, only until they turn 18, and for at most 5 years.

Data Subject Request Records (DSAR)

• Personal Data: Identity verification record; request type and details; actions taken; correspondence; response timestamp
• Purpose: Process and respond to data subject rights requests; demonstrate compliance with Georgian Data Protection Law; maintain accountability for data protection obligations
• Legal Basis: Legal Obligation (Georgian Data Protection Law — data subject rights); Legitimate Interest (compliance documentation)
• Recipients & Transfer: Internal privacy and legal team only; hosting provider (EU)
• Retention: 5 years from closure; retained to demonstrate statutory compliance. See the Data Retention Schedule

Feed Composition and Ranking

• Personal Data: Engagement Signals, recorded separately for each Persona (views, dwell time, reactions, comments, hides and follows); account preferences and language and region settings; who each Persona follows
• Purpose: compose and order each Persona's Content feed, ranked from that Persona's own activity; improve feed quality
• Legal Basis: Contract (feed ranking is part of the Platform service described in the Terms of Service); Legitimate Interest (Platform quality, supported by a documented Legitimate Interests Assessment)
• Recipients & Transfer: authorised staff (internal); hosting provider (EU). Engagement Signals are not used to build advertising profiles or to infer Special Category Data.
• Retention: views and dwell time: 31 days in identifiable form, then only per-post totals with no viewer in them; reactions, comments, hides and follows: until the User undoes them or the Account is deleted. See the Data Retention Schedule. DPIA-01 covers this processing.

Age Check at Sign-up and Under-18 Review

• Personal Data: the date of birth given at sign-up; where an Account appears to belong to someone under 18: what led to the block, the account holder's reply and the reviewer's decision. Nixyum never asks for an identity document; one sent anyway is used only for that decision and then deleted.
• Purpose: refuse registration to anyone under 18; block and, after a review by a person, delete any Account that belongs to someone under 18, never on an automated signal alone
• Legal Basis: Legal Obligation (Georgian Personal Data Protection Law, minimum age requirement); Legitimate Interest (enforcing the minimum age of 18 and excluding Minors)
• Recipients & Transfer: authorised staff (internal); hosting provider (EU); email delivery provider (EU), for the email explaining the block. No third-party age-verification provider is used.
• Retention: the date of birth is kept with the Account. Review records, and any document sent, are deleted within 30 days of the decision; if the Account is deleted, only a one-way coded form of the email address is kept (see Banned Account Identifiers). See the Data Retention Schedule.

Automated Content Moderation

• Personal Data: public Content and private messages, including photos, videos and voice messages, sent for automated checks; the minimal identifiers needed to route the result; the result of each check
• Purpose: find material that may break the Community Guidelines, and spam and abuse; hold flagged Content from other Users until a person reviews it; block known CSAM
• Legal Basis: Legitimate Interest (platform safety, subject to a balancing assessment); Legal Obligation (detecting known CSAM)
• Recipients & Transfer: Nixyum's own Trust & Safety Models, run on rented computing capacity in EU/EEA data centres; no third-party AI service receives User Content; authorised Moderators (internal), for flagged Content
• Retention: the result of each check is kept with the moderation records (above); a result that opened no case has no fixed period yet. The computing provider processes Content only on Nixyum's instructions, under its data processing terms. Decisions that affect an Account's standing (suspension or termination) are always taken by a Moderator. DPIA-02 covers this processing.

Improving Trust & Safety Models

• Personal Data: Content in pseudonymised form: Content a Moderator has confirmed breaks the Policies, including private messages; and, as examples of Content that breaks no rule, public Content only. Private messages that break no rule are never used.
• Purpose: evaluate and improve Nixyum's own Trust & Safety Models
• Legal Basis: Legitimate Interest, supported by a documented Legitimate Interests Assessment. A User can object at any time with the setting "Don't use my posts to improve safety tools" in Settings → Privacy & Safety, or by writing to [email protected]; Content confirmed to break the Policies may still be used, because protecting other Users from it is a compelling legitimate ground.
• Recipients & Transfer: Nixyum's own models, run on rented computing capacity in EU/EEA data centres; the Content is never sold or licensed to anyone
• Retention: as set out in the Data Retention Schedule.

Direct Marketing Consent Records

• Personal Data: User identifier; time and source of the opt-in; scope of the consent and version of the consent text; time of any opt-out; channel preferences
• Purpose: record and demonstrate freely given, specific, informed and unambiguous opt-in consent to Direct Marketing; honour opt-out requests within seven (7) working days; comply with the Georgian Data Protection Law's transparency and consent-evidencing obligations
• Legal Basis: Consent (the Georgian Data Protection Law's opt-in basis for Direct Marketing); Legal Obligation (record-keeping to demonstrate compliance)
• Recipients & Transfer: internal privacy staff; email delivery provider (EU); hosting provider (EU); never shared with advertisers
• Retention: 3 years after the User withdraws consent or the consent relationship ends. See the Data Retention Schedule.

Cookie and Consent Records

• Personal Data: each consent decision: the choice, the time, the version of the Cookies Policy then in force and the platform; the IP address, only as a salted hash
• Purpose: remember the User's choice so that the banner is not shown again unnecessarily; evidence consent under the Georgian Data Protection Law
• Legal Basis: Legal Obligation (demonstrating consent); Legitimate Interest
• Recipients & Transfer: the User's own device; Nixyum's servers; hosting provider (EU)
• Retention: on the device, 12 months from the last choice, or until the Cookies Policy's version changes; on Nixyum's servers, 3 years from each record. See the Cookies Policy and the Data Retention Schedule.

Group E — Commercial Operations

Advertising — Not offered at present

• The Platform shows no advertising, and Nixyum processes no Personal Data for advertising and keeps no advertiser accounts. If advertising is introduced, this Data Map, the Privacy Policy and the Advertising Policy will be updated before it starts and Users will be notified; Profiling for advertising will require the User's consent and will never combine signals from a User's Nex and Nyx.

Support by Bank Transfer

• Personal Data: the transfer details Nixyum's bank gives it: the sender's name and account number, the amount, the date and any message added. The Platform takes no card payments, and Nixyum receives no payment card data.
• Purpose: keep accounting and tax records of support received; answer a User who asks about their transfer
• Legal Basis: Legal Obligation (Georgian Tax Code: accounting records); Legitimate Interest
• Recipients & Transfer: internal finance staff; the banks, which process the transfer as independent controllers under their own privacy policies. The details are not linked to an Account unless the User tells Nixyum the transfer was theirs.
• Retention: at least 5 years; longer during a tax audit or litigation. See the Data Retention Schedule.

Customer Support

• Personal Data: the content of support requests, emails and feedback; account information referred to in the request; resolution notes
• Purpose: answer Users' questions and resolve issues; improve support; keep records for accountability
• Legal Basis: Contract (support is part of the service); Legitimate Interest (service improvement, accountability)
• Recipients & Transfer: internal support staff; hosting provider (EU); email delivery provider (EU); never shared with other Users
• Retention: as set out in the Data Retention Schedule; requests linked to an Account are deleted with it, attached files included.

Group F — Legal, Security & Regulatory Records

Legal Compliance & Court Order Records

• Personal Data: Law enforcement request details; court orders and legal correspondence; data preservation holds; compliance actions taken
• Purpose: Comply with valid legal orders, court orders, and law enforcement requests; maintain evidence of legal compliance; protect Nixyum's legal position
• Legal Basis: Legal Obligation
• Recipients & Transfer: Internal legal team only; law enforcement / courts (as directed); legal counsel (under confidentiality)
• Retention: Until hold lifted + 5 years. See the Data Retention Schedule

Data Breach Records

• Personal Data: Incident description and timeline; affected data categories and estimated individuals; containment and remediation actions; Supervisory Authority notification records; User notifications sent
• Purpose: Document and investigate data breaches; comply with breach notification obligations under Georgian Data Protection Law; demonstrate regulatory compliance
• Legal Basis: Legal Obligation (Georgian Data Protection Law — breach notification and documentation)
• Recipients & Transfer: Internal legal and privacy team only; Supervisory Authority (notification only); affected Users (where legally required); hosting provider (EU)
• Retention: 5 years from incident date; not subject to User deletion requests. See the Data Retention Schedule

Special Category Data (Incidental)

• Personal Data: Racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic / biometric data; health data; sex life or sexual orientation data. Note: Nixyum does not proactively collect Special Category Data. This row covers incidental processing where a User voluntarily discloses such data in Content or profile fields.
• Purpose: Display User-provided Content (where User has voluntarily included Special Category Data); moderation (where Special Category Data appears in reported Content); legal compliance (where required by law)
• Legal Basis: Manifestly Made Public (where the Data Subject has voluntarily published the data — the Georgian DP Law equivalent of GDPR Article 9(2)(e)); Legitimate Interest (moderation of content containing Special Category Data — subject to heightened balancing assessment); Legal Obligation (where required)
• Recipients & Transfer: Same recipients as User Content (Group B); Moderation team (internal, on valid Report only); not used for advertising or Profiling; not shared with third parties for marketing
• Retention: Same as the Content category in which it appears. See the Data Retention Schedule

Aggregated & Anonymised Data

• Personal Data: Usage statistics (page views, feature adoption, session counts); demographic trends (region, device type); all personal identifiers permanently removed before processing
• Purpose: Generate Platform usage insights; report performance to stakeholders; improve product and business strategy
• Legal Basis: N/A — anonymised data is no longer Personal Data under Georgian Data Protection Law; derived from Personal Data processed under Legitimate Interest and Contract bases above
• Recipients & Transfer: Internal analytics and product teams; may be shared in aggregate, anonymised form in transparency reports or with business partners; designed to prevent individual identification; re-identification by any party prohibited
• Retention: Indefinite; no deletion obligation applies; anonymisation reviewed before treatment as non-personal data

044. International Data Transfers

Nixyum operates from Georgia. The Platform's servers and databases are located in the European Union, and Personal Data submitted by Users is stored and processed there. Some Processors process limited data outside the EU, as described below. The following transfer scenarios apply:

• Georgia → EU (User data to infrastructure): Personal Data submitted by Users in Georgia is transferred to infrastructure Processors in the EU. This transfer is lawful under the Law of Georgia on Personal Data Protection because EU member states are recognised by the Georgian Supervisory Authority as providing appropriate data protection guarantees. As an additional safeguard, these Processors are bound by data processing terms that include Standard Contractual Clauses (SCCs) or equivalent clauses.
• EU → Georgia (staff access): Nixyum's team is based in Georgia and accesses data stored in the EU. Where the GDPR applies to this access, it is covered by SCCs or equivalent clauses in Nixyum's Processors' data processing terms. Additional safeguards include encryption of data in transit and at rest, access limited to staff who need it, and logging of staff access.
• Outside the EU and Georgia: some Processors process limited data outside the EU and Georgia, including in the United States: for push notifications, content delivery, security and bot protection, and checks against known child sexual abuse material. These transfers are protected by SCCs or equivalent safeguards in the Processor's data processing terms, or by another lawful transfer mechanism under the Georgian Data Protection Law. No Personal Data is transferred to any country without an identified lawful transfer mechanism.

For data flows between the EU and Georgia, Nixyum relies on the recognition of EU member states described above and on SCCs, or equivalent clauses, in its Processors' data processing terms.

055. Processors and Sub-processors

Nixyum engages the following categories of Processors. Each Processor accesses Personal Data only for the purpose for which it is engaged, under data processing terms (signed, or incorporated in the provider's terms of service) that impose obligations consistent with the Georgian Data Protection Law and, by harmonisation, the GDPR. The current list of Processors, with each one's name, purpose and region, is published on the Legal & Compliance page of the Nixyum help centre (support.nixyum.com) and kept up to date.

• Hosting, databases and background processing: the servers, databases, caches and job queues that run the Platform. EU.
• Media storage and delivery: storage of photos, videos and other files in the EU, and a content delivery network that serves copies from locations close to the viewer. Worldwide.
• Website hosting: delivery of the Platform's websites through a global network. Worldwide.
• Email delivery: sending service emails. EU.
• Push notifications: delivering notifications to Users' devices; unless a device uses encrypted notifications, the provider can read them (see Section 6.4 of the Privacy Policy). Worldwide.
• Security and bot protection: protecting sign-up, sign-in and other forms against automated abuse. Worldwide.
• Computing capacity for Trust & Safety Models: the servers on which Nixyum runs its own Trust & Safety Models. EU/EEA. No third-party AI service receives User Content.
• Checks against known child sexual abuse material: services that compare uploaded images with known CSAM; they receive only a code computed from an image, never the image itself. Outside the EU.
• Analytics and payments: none. Nixyum uses no third-party analytics service and no payment processor, and the Platform takes no card payments.

066. Data Subject Rights — Summary

Under the Georgian Data Protection Law and, by harmonisation, the GDPR, Users have the following rights in respect of their Personal Data. Full details of how to exercise these rights are set out in the Privacy Policy.

• Right of Access: Obtain confirmation of processing and a copy of Personal Data held. A copy can be downloaded at any time in Settings → "Download Account Data".
• Right to Rectification: Correct inaccurate or incomplete Personal Data.
• Right to Erasure: Request deletion of Personal Data where no overriding legal basis for retention exists. An Account can be deleted in Settings; the deletion takes effect after 7 days, during which it can be cancelled.
• Right to Restriction of Processing: Request restriction of processing in defined circumstances.
• Right to Object: Object to processing based on Legitimate Interest. Processing will cease unless Nixyum can demonstrate compelling legitimate grounds. Where the processing is for Direct Marketing purposes, the right to object is absolute and Nixyum will cease such processing within seven (7) working days of receipt of the opt-out request.
• Right to Data Portability: Receive Personal Data in a structured, commonly used, and machine-readable format for data provided under Contract or Consent bases.
• Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint with the Supervisory Authority: Lodge a complaint with the State Audit Office of Georgia (SAO) at pdp.sao.ge.

Requests must be submitted to [email protected]. Nixyum will respond in accordance with the response timelines set out in the Master Definitions and the Privacy Policy.

077. Changes to This Data Map

This Data Map is updated whenever Nixyum introduces a new processing activity, changes the purpose or legal basis of an existing activity, engages a new Processor, or makes any other material change to its data processing operations. Material changes will be notified to Users at least thirty (30) days in advance in accordance with the Privacy Policy and Terms of Service.

The version number and Last Updated date at the top of this document reflect the most recent revision.

088. Contact

Privacy & Data Protection

[email protected]

Legal

[email protected]

Data Controller

Nixyum LLC · Tbilisi, 13 Nikoloz Janashia Street, Georgia · Reg. No. 400458045

Supervisory Authority

State Audit Office of Georgia (SAO) · pdp.sao.ge

© 2026 Nixyum LLC. All rights reserved.