Privacy policy

1. Data controller

The data controller is Nexsim, Crunch Lab, 13 Rue Ernest Thierry-Mieg, 90000 Belfort, France. For any question about your data: contact@nexsim.fr.

2. Data collected and purposes

None of our services contains advertising, audience measurement tools or third-party trackers. Processing is described service by service.

Website www.nexsim.fr

This is a showcase site: it has no form, no customer area and no audience measurement tool. Processing is limited to the following cases.

• Contact requests by e-mail. When you write to the address shown on the site, we process your e-mail address, your name and the content of your message in order to answer your request (demonstration, quotation, information). Legal basis: pre-contractual steps taken at your request, or our legitimate interest in answering enquiries.
• Server technical logs. The host automatically records the IP address, the date and time of the visit, the pages viewed and the browser used, for security and maintenance purposes. Legal basis: legitimate interest in keeping the service secure.
• Display preferences. The language and the theme (light or dark) you choose are stored in the two preference cookies described in section 5. They contain no identifier and cannot be used to recognise you across sites.
• Browser language. On your first visit, your browser sends the list of your preferred languages (the Accept-Language header); it is used solely, for the time it takes to render the page, to select the language version of the site. It is neither stored nor passed on to any third party.

NexControl application

NexControl controls the LuSIM simulator from the tablet. It requires no account and sends no data to Nexsim.

• Data stored on the tablet. Pathologies (names and settings) and preferences (language, theme, communication protocol) stay on the tablet. A pathology export is only created at your request, and you choose who to send it to.
• Exchanges with the simulator. The tablet communicates with the simulator over its local Wi-Fi network, without Internet access. Only technical settings and measurements are exchanged, with no personal data.
• Location permission. Android requires it to read the Wi-Fi network name. NexControl uses it only to check that the tablet is connected to the simulator: no position is read, stored or transmitted.
• Legal pages. This policy and the legal notice are displayed from www.nexsim.fr: viewing them falls under the website processing described above.

NexHome application and Store

NexHome is the NexSIM tablet's home screen. Its Store installs and updates the applications from store.nexsim.fr. There is no user account.

• Tablet registration. At each Store synchronisation, NexHome sends store.nexsim.fr a random tablet identifier, a security key generated on the tablet, the manufacturer, model, serial number and NexHome version. The server also keeps the date of the first and last contact; the audit log records the IP address of the registration. Purposes: distributing and updating the applications, providing a rescue code if the tablet's administrator code is forgotten, blocking a lost or stolen tablet. Legal basis: performance of the simulator supply contract and legitimate interest in securing the tablets.
• Catalogue and downloads. Browsing the Store and downloading applications go through store.nexsim.fr. Requests (IP address, date, resource requested) may appear in the server's technical logs.
• Data stored on the tablet. Administrator code (in an irreversible encrypted form), configured Wi-Fi networks (managed by Android), the last catalogue received and display preferences. They are not sent to Nexsim.
• Location permission. Android requires it to scan for nearby Wi-Fi networks. NexHome reads, stores and transmits no position.

NexStore-web service (store.nexsim.fr)

The store.nexsim.fr web interface is restricted to people authorised by Nexsim (teams and partners): it is used to publish the applications and to support the tablets.

• Account. E-mail address, name, role (super-administrator, administrator or collaborator), password (stored hashed), two-factor authentication secret and recovery codes (hashed), creation and last login dates, failed logins. Purpose: managing secure access. Legal basis: legitimate interest in protecting the service, within the employment or partnership relationship.
• Audit log. Date, account, action (login, account management, rescue codes, adding, updating or deleting an application, tablet registration) and IP address. Purpose: security and traceability of actions. Legal basis: legitimate interest.
• Application history. For each application file uploaded: version, date and uploader (name and e-mail address). Purpose: knowing who published each version distributed to the tablets. Legal basis: legitimate interest.
• Service e-mails. Invitations and password reset links, sent to the account's address.
• Cookies. A strictly necessary session cookie keeps you logged in; a preference cookie remembers the language you chose (French or English). See section 5.

3. Retention periods

• E-mail exchanges: as long as needed to handle the request, then at most three years from the last contact if no contractual relationship is established.
• Technical logs: twelve months at most.
• Preference cookies (language and theme): twelve months from the date they are set or last updated, or until you delete them from your browser.
• NexStore-web accounts: as long as the person is authorised. The account is deleted by an administrator when the authorisation ends.
• NexStore-web audit log (actions and IP addresses): six months, then automatic deletion. Application history: for as long as the service is operated, to ensure the traceability of the versions distributed.
• Registered tablets: as long as the tablet is in service. An administrator deletes its record when it is withdrawn.
• Data stored on the tablet by NexControl and NexHome: until it is deleted in the application, the application is uninstalled or the tablet is reset.

4. Recipients and processors

The data is intended solely for authorised staff at Nexsim. It may be processed by our technical service providers within the limits of their assignment:

• Website host: OVH SAS, for hosting and technical logs.
• Google Hosted Libraries: the 3D viewer component is loaded from servers operated by Google LLC, and only when a 3D viewer comes close to the visible area of the page. During that load, your browser sends your IP address to Google, where it may be processed in the United States under the European Commission's standard contractual clauses. The site's typefaces are hosted on our own servers: displaying them triggers no third-party request.
• Google LLC (Gmail): store.nexsim.fr service e-mails (invitations, password resets) are sent from a Gmail address. Google processes the recipient's address and the content of the message, possibly in the United States, under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
• Hosting of store.nexsim.fr: provided by Nexsim itself, on its servers located in France. No third-party host has access to this data.

No data is sold or transferred to third parties for commercial purposes.

5. Cookies and trackers

The website www.nexsim.fr uses no advertising cookie, no audience measurement cookie and no third-party tracker. Only two preference cookies, set by the site itself, are used:

Both cookies are strictly necessary to provide a service you expressly requested: displaying the site in the language and with the theme you selected. They hold nothing but a preference value, with no identifier and no personal data, are issued with the SameSite=Lax attribute and are not accessible to any third party.

As such they fall within the trackers exempt from consent under Article 82 of the French Data Protection Act and the CNIL guidelines, so no consent banner is displayed. This policy will be updated should trackers subject to consent ever be added.

You can delete these cookies at any time from your browser settings. Once deleted, the site again displays the language announced by your browser (English if none of ours matches) and the dark theme by default.

The NexControl and NexHome applications use no cookie or tracker; when they display the legal pages, those pages set the two preference cookies above within the application. The store.nexsim.fr service uses a session cookie, strictly necessary for logging in (the session expires at the latest three hours after login), and the nexstore_lang preference cookie (chosen language, 12 months): both are exempt from consent.

6. Your rights

Under the GDPR you have the rights of access, rectification, erasure, restriction, objection and portability regarding your data, as well as the right to give instructions on what happens to your data after your death.

To exercise these rights, write to us at contact@nexsim.fr or by post to the address of the data controller. Proof of identity may be requested in the event of reasonable doubt. We answer within one month, extendable by two months for complex requests.

If, having contacted us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Data stored only on a tablet (pathologies, preferences, Wi-Fi networks) is not accessible to Nexsim: you can delete it from the applications or by resetting the tablet.

7. Security

Nexsim implements appropriate technical and organisational measures to protect your data against loss, unauthorised access or disclosure: encryption of exchanges (HTTPS), mandatory two-factor authentication and hashed passwords on store.nexsim.fr, a protected administrator code on the tablets, restricted access to mailboxes and regular system updates.

8. Links to third-party sites

The site contains links to third-party services, in particular LinkedIn. These services have their own privacy policies, which we encourage you to read. Nexsim is not responsible for the processing carried out by those third parties.

9. Changes to this policy

This policy may be updated at any time, in particular if the site or the applicable regulations change. The date of the latest update appears at the top of this page.