Privacy Policy — Nuar Waitlist
Date: 10 March 2026
1. Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) is:
UAB Gera ferma Kriviu g. 5, LT-01204 Vilnius, Lithuania Registration number: 306670786 (Registru centras, Lithuania) VAT ID: LT100019053714 Director: Monika Narysyte Email: monika@nuar.app
Data Protection Officer
A Data Protection Officer has not been appointed pursuant to Article 37 GDPR, as the core activities of the controller do not involve the extensive processing of special categories of personal data or the extensive systematic monitoring of individuals. For data protection enquiries, please contact: monika@nuar.app.
2. Subject Matter of this Privacy Policy
This Privacy Policy informs you pursuant to Article 13 GDPR about the processing of your personal data in connection with the use of the waitlist for the Nuar Social Marketplace App at https://nuar.app.
3. Categories of Personal Data Collected
In connection with the waitlist, we process the following categories of personal data:
| Category | Data | Source |
|---|---|---|
| Registration data | Email address | Provided directly by the user |
| Consent data | Timestamp, consent version, IP address, user agent, consent text, source URL | Collected automatically during registration |
| Technical data | IP address, browser type, device information, operating system | Collected automatically via tracking pixels (only after consent) |
| Cookie and tracking data | Cookie identifiers, browsing behaviour | Collected automatically via tracking pixels (only after consent) |
| Session data | Session cookies, technical connection data | Collected automatically for website functionality |
4. Purposes and Legal Bases of Processing
4.1 Waitlist Registration
| Purpose | Management of the waitlist for the Nuar App; notification about the App launch |
| Data processed | Email address |
| Legal basis | Consent pursuant to Article 6(1)(a) GDPR |
| Withdrawal | You may withdraw your consent at any time (see Section 10) |
4.2 Email Communication
| Purpose | Sending information and updates in connection with the Nuar App |
| Data processed | Email address |
| Legal basis | Consent pursuant to Article 6(1)(a) GDPR |
| Note | The consent to receive emails is separate from the cookie consent. These are two independent legal acts. The so-called “soft opt-in” exception under applicable direct marketing legislation does not apply, as there is no pre-existing customer relationship. |
4.3 Campaign Tracking (Google Pixel)
| Purpose | Analysis of campaign performance; measurement of advertising effectiveness |
| Data processed | Cookies, IP address, device information, browsing behaviour |
| Legal basis | Consent pursuant to Article 6(1)(a) GDPR in conjunction with applicable cookie legislation (ePrivacy Directive) |
| Note | Google Pixel is only activated after the User’s express consent. Without consent, no data is transmitted to Google. |
4.4 Campaign Tracking (Facebook Pixel)
| Purpose | Analysis of campaign performance; measurement of advertising effectiveness |
| Data processed | Cookies, IP address, device information, browsing behaviour |
| Legal basis | Consent pursuant to Article 6(1)(a) GDPR in conjunction with applicable cookie legislation (ePrivacy Directive) |
| Note | Facebook Pixel is only activated after the User’s express consent. Without consent, no data is transmitted to Meta. |
4.5 Website Functionality
| Purpose | Technical operation of the website; ensuring security and stability |
| Data processed | Session data, technical connection data |
| Legal basis | Legitimate interest pursuant to Article 6(1)(f) GDPR |
| Legitimate interest | Ensuring the technical operation and security of the website |
4.6 Proof of Consent
| Purpose | Documentation and proof of consents given for compliance purposes |
| Data processed | Timestamp, IP address, user agent, consent version, consent text, source URL |
| Legal basis | Legitimate interest pursuant to Article 6(1)(f) GDPR in conjunction with the accountability obligation under Article 5(2) GDPR |
| Legitimate interest | Demonstrating compliance with data protection obligations |
5. Recipients and Processors
Your personal data is disclosed to the following recipients or categories of recipients:
| Recipient | Service | Purpose | Location |
|---|---|---|---|
| Mailchimp (The Rocket Science Group LLC / Intuit Inc.) | Email list management | Management of the waitlist and sending of email communications | USA |
| Google LLC | Google Pixel | Campaign performance analysis | USA |
| Meta Platforms Ireland Ltd / Meta Platforms, Inc. | Facebook Pixel | Campaign performance analysis | Ireland / USA |
Data processing agreements pursuant to Article 28 GDPR have been or will be concluded with all processors.
6. International Data Transfers
Personal data is transferred to processors in the USA (Mailchimp, Google, Meta). The transfers are based on the following safeguards:
(a) EU-U.S. Data Privacy Framework (DPF) The above-mentioned US recipients are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision (Implementing Decision (EU) 2023/1795).
(b) Standard Contractual Clauses (SCCs) Additionally, or as a fallback mechanism in the event that the DPF adequacy decision is revoked, Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR (Implementing Decision (EU) 2021/914) are agreed with all US recipients.
Note: The status of the DPF adequacy decision is reviewed regularly. Should it be revoked, the Standard Contractual Clauses in conjunction with a Transfer Impact Assessment (TIA) will serve as the primary transfer mechanism.
7. Retention Periods and Deletion
| Data category | Retention period |
|---|---|
| Email addresses (active waitlist) | Until the end of the waitlist campaign, until the user creates a full Nuar account (new terms will then apply), or until the user withdraws their consent — whichever occurs first |
| Unconfirmed DOI registrations | Automatic deletion after 30 days if the user does not confirm the double opt-in email |
| Tracking/pixel data | In accordance with the retention policies of Google and Meta (see their respective privacy policies). Cookie durations for profiling/marketing do not exceed 12 months |
| Consent records | 3 years after withdrawal of consent (retained as compliance evidence in accordance with the accountability obligation under Article 5(2) GDPR; taking into account the applicable limitation period for administrative offences) |
| Session data | Deleted at the end of the browser session |
8. Your Rights as a Data Subject
Under the GDPR, you have the following rights:
8.1 Right of Access (Article 15 GDPR)
You have the right to obtain information about the personal data we process about you, including the purposes of processing, the categories of personal data, the recipients, and the planned retention period.
8.2 Right to Rectification (Article 16 GDPR)
You have the right to request the rectification of inaccurate personal data and the completion of incomplete data.
8.3 Right to Erasure / “Right to be Forgotten” (Article 17 GDPR)
You have the right to request the erasure of your personal data, provided that the legal requirements are met.
8.4 Right to Restriction of Processing (Article 18 GDPR)
Under certain conditions, you have the right to request the restriction of the processing of your data.
8.5 Right to Data Portability (Article 20 GDPR)
You have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller.
8.6 Right to Object (Article 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) GDPR (legitimate interest). The controller shall then no longer process the data unless it can demonstrate compelling legitimate grounds that override the interests, rights and freedoms of the data subject.
8.7 Right to Withdraw Consent (Article 7(3) GDPR)
You have the right to withdraw your consent at any time. The withdrawal shall not affect the lawfulness of processing carried out on the basis of the consent prior to the withdrawal.
8.8 Right to Lodge a Complaint with a Supervisory Authority (Article 77 GDPR)
You have the right to lodge a complaint with a data protection supervisory authority. The primary competent supervisory authority is:
Valstybine duomenu apsaugos inspekcija (VDAI) L. Sapiegos g. 17, 10312 Vilnius, Lithuania https://vdai.lrv.lt
You may also contact the data protection supervisory authority in the EU/EEA Member State of your habitual residence or place of work.
9. Exercising Your Rights
To exercise your rights, please send an email to:
We will process your request within 30 days of receipt. In the case of particularly complex or numerous requests, this period may be extended by a further 60 days. In such cases, you will be informed of the extension and the reasons for it within the initial 30-day period.
The exercise of your rights is generally free of charge. In the case of manifestly unfounded or — particularly in the case of frequent repetition — excessive requests, the controller may charge a reasonable fee or refuse to act on the request (Article 12(5) GDPR).
10. Withdrawal of Consent
You may withdraw your consent at any time with effect for the future:
- By email: Send an email to monika@nuar.app
- By unsubscribe link: Click the unsubscribe link in our emails
- Cookie consent: Via the cookie settings on our website (“Cookie Settings” link in the footer of every page)
The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
11. Automated Decision-Making
No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place. No decisions are made based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
12. Necessity of Data Provision
The provision of your email address is voluntary. However, it is required in order to register for the waitlist. Without providing your email address, registration is not possible.
The granting of cookie consent is voluntary and not a prerequisite for using the waitlist (no cookie wall).
13. Origin of Data
All personal data is collected directly from you (the data subject). No personal data is obtained from third-party sources.
14. Cookies and Tracking Technologies
For detailed information about the cookies and tracking technologies used on this website, please refer to our Cookie Policy, available at https://nuar.app/en/cookie-policy.
In accordance with applicable cookie legislation (ePrivacy Directive), non-essential cookies and tracking technologies (including Google Pixel and Facebook Pixel) are only set after the User’s express consent. The “Accept” and “Reject” buttons in the cookie banner are designed with equal prominence (same size, colour and contrast), in line with European data protection guidance and best practices. No dark patterns are used.
15. Changes to this Privacy Policy
We reserve the right to update this Privacy Policy to reflect changes to our processing practices or legal requirements. In the event of material changes, registered users will be notified by email. The current version is available at https://nuar.app/en/privacy-policy.
This Privacy Policy was last updated on 10 March 2026.