Privacy statement

Version and effective date: 2026-08-21

This is a translation of the Dutch privacy statement, which is the authoritative text. Where the two differ, the Dutch text prevails.

Who we are

Nehalo is a service of Hugir B.V., registered with the Dutch Chamber of Commerce under number 96766794 (hereinafter: Hugir). Hugir is the controller for the personal data processed in connection with Nehalo. This privacy statement explains which data we process, what we use it for, how long we keep it, and how you can exercise your rights.

In this statement we call Nehalo the service for short. By that we mean the app, the website and everything that belongs to them.

For questions about this statement or about your personal data, contact us at privacy@nehalo.com.

1. What do we use your personal data for?

1.1 To handle an access request

When you request access to Nehalo, you provide an email address. We use it solely to assess your request and to let you know the outcome.

The data concerned:

• email address;
• date and time of the request.

Legal basis: taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).

1.2 To provide the service to account holders

So that you can create and use an account, we process the data needed to sign you in, to manage your account, and to inform you about matters that directly concern your account or the service, such as a sign-in code or a change to this statement or to the terms of use.

The data concerned:

• email address;
• sign-in data, such as sign-in codes and active sessions;
• the invitation through which your account was created;
• which version of the terms of use you accepted and which safety statement you acknowledged, and when.

Legal basis: performance of the contract we conclude with you (Article 6(1)(b) GDPR). For recording acceptances and acknowledgements: our legitimate interest in being able to demonstrate which terms were agreed (Article 6(1)(f) GDPR).

1.3 To contact you, if you give your consent

Separately from your use of the service, we may ask for your consent to contact you by email, for example to ask about your experience with Nehalo. If you give it, that consent is not required to use the service and you can withdraw it at any time where you gave it or via privacy@nehalo.com. Withdrawal has no effect on your account.

Legal basis: your consent (Article 6(1)(a) GDPR).

1.4 To measure how the service is used and to improve it

We keep aggregate figures on how many visitors the website has, how many accounts are active, and from which countries the service is used. We use these figures solely to see how the service is used and to improve it. We do not build profiles of individual users and do not track you outside our own service.

The data concerned:

• a temporary, non-reversible derivative of connection data (a hashed value with a daily-changing key), by which a website visitor is counted as a unique visitor within one day; the IP address itself is not stored and the derivative cannot be traced back after that day;
• the number of active accounts per day and per month;
• the country the connection comes from, derived on our own servers and stored as a country only.

Legal basis: our legitimate interest in understanding how the service is used and in improving it (Article 6(1)(f) GDPR).

1.5 To keep the service secure

To prevent and counter abuse of the service, such as guessing sign-in codes or overloading our systems, we limit the number of requests per connection and keep security and server logs. Technical data such as IP addresses stays in these logs for at most 30 days (see section 5) and is not linked to your account.

Legal basis: our legitimate interest in a secure and available service (Article 6(1)(f) GDPR).

1.6 To show your position on the chart

If you give permission, the service asks your device for your position. The chart then opens where you are. That position is used and kept on your device, like the rest of your chart settings. It only goes to our servers when the service fetches data for it, such as the depth or the forecast at that spot. This works the same way as for any other point you pick on the chart. We do not keep your position as separate data and do not link it to your account. Such a request only appears in the logs described in section 1.5. You can withdraw the permission at any time in your browser or device settings.

The data concerned:

• your device’s position and how accurate it is.

Legal basis: your consent (Article 6(1)(a) GDPR).

2. What do we not process?

• We do not process special categories of personal data.
• We do not use cookies or other techniques to track you. The service stores in your browser only what it needs to work, such as a cookie for your session and your settings. No consent is needed for that.
• We do not make decisions based on automated processing or profiling, and we do not sell or rent personal data.

3. With which third parties is personal data shared?

We share personal data only with service providers we need in order to provide the service, and who process the data on our behalf. We have concluded a data processing agreement with each of them. They fall into the following categories:

• a hosting provider for our servers and database;
• an email delivery service, for sign-in codes and messages about your account;
• a storage provider for encrypted backups;
• an email provider for our business mailbox, through which we receive and answer messages from users.

All storage of personal data controlled by Hugir is located within the European Union. Personal data is not transferred to countries outside the European Economic Area.

One connection is made by your browser itself: your browser fetches the base map (land, water, and place names) directly from OpenFreeMap. As with any server your browser connects to, OpenFreeMap receives your IP address and the requested map areas. OpenFreeMap states that it keeps no user data and uses no cookies.

4. How do we keep your personal data secure?

Hugir has taken appropriate technical and organisational measures to protect personal data against loss and unlawful use. Account data is stored encrypted per user, all traffic with the service is encrypted, and only authorised persons have access to personal data, and only insofar as necessary for their task.

5. How long do we keep your data?

We do not keep personal data longer than necessary for the purpose for which it was collected:

• an access request: at most 180 days after your most recent request, or earlier once the request has been handled or withdrawn;
• account data: for as long as your account exists;
• your consent to be contacted: until you withdraw it;
• your position: not as separate data, only in the security and server logs (at most 30 days);
• measurement data: the daily derivative for at most one day; thereafter only totals;
• security and server logs: at most 30 days;
• backups: at most 30 days.

When an account is deleted, its data is removed from our systems immediately. Copies in backups disappear as soon as the backup in question expires, at the latest after 30 days. When a backup is restored, previously deleted accounts are not reinstated.

6. How can you exercise your privacy rights?

You have the right to request access to the personal data we process about you, to have inaccurate data rectified, to have data erased, to have processing restricted, and to receive your data in a commonly used format. You may withdraw consent at any time; this does not affect the lawfulness of processing before the withdrawal.

Objection. You may object at any time to the processing we base on our legitimate interest (sections 1.2, 1.4, and 1.5). We then stop that processing, unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Send a request to privacy@nehalo.com from the email address that belongs to your account or request, so that we can establish your identity. We respond within one month.

7. Lodging a complaint

If you have a complaint about the way we handle your personal data, we ask you to raise it with us first via privacy@nehalo.com. You also have the right to lodge a complaint with the supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl).

8. Are you required to provide personal data?

Providing an email address is necessary to request access and to use an account; without an email address we cannot provide the service. Providing any other data is not required.

9. About this privacy statement

We may amend this privacy statement when the processing of personal data changes. A new version receives a new effective date and is published at nehalo.com/privacy. In the event of a material change we inform account holders in advance.