Privacy Policy

1. About This Policy

This Privacy Policy explains how NMT Security collects, uses, discloses, and protects personal data, and the rights available to individuals whose data we hold. It applies to our public website at nmtsecurity.com, to the NOVA AI platform and related products and services (the "Platform"), and to our sales, marketing, support, and business operations.

This policy applies to every individual we deal with, wherever they are located. Where a specific law gives you additional or different rights (for example in the European Economic Area, the United Kingdom, the United States, or India), those region-specific terms are set out in Section 15 and prevail over the general terms for individuals covered by them.

Controller and processor roles. NMT Security acts as a controller for the personal data described in this policy, meaning we decide why and how it is processed. When we process personal data on a customer's behalf to deliver the Platform (for example, data that a customer loads or that the Platform ingests about the customer's own users and assets), we act as a processor under a data processing agreement. For that data, the customer is the controller and the customer's own privacy policy governs.

2. Who We Are

"NMT Security", "we", "us", and "our" refer together to:

• NMT Security LLC, a company formed in Delaware, United States; and
• NMT Security Innovations Pvt Ltd, a company formed in India.

These affiliated entities share common ownership and operate the NMT Security business and the NOVA AI platform jointly. The entity that acts as controller for a given individual is normally the entity that holds the business relationship or that operates the tenant serving that individual. For any privacy question, you may contact us at the single address in Section 19 and we will route your request to the correct entity.

3. Personal Data We Collect

The categories of personal data we collect as a controller are set out below. We collect only what we need for the purposes in Section 6.

• Business contact data: Name, work email, telephone number, job title, employer, and business address of prospects, customers, partners, and suppliers.
• Account and identity data: Login identifiers, authentication data, role and access permissions, single sign-on identifiers, and preference settings.
• Audit and activity data: Audit logs of actions taken in the Platform, timestamps, and the identifier of the acting user, used for security and accountability.
• Usage and device data: Product telemetry, feature usage, IP address, browser and device type, operating system, approximate (city or country level) location derived from IP, and referring pages.
• Communications data: Enquiries, support tickets, chat and email correspondence, demo and event registrations, and survey responses.
• Marketing data: Subscription status, communication preferences, and engagement with our emails and campaigns.
• Transaction data: Billing contact, purchase and subscription records, and, where applicable, limited payment reference data (card and bank details are handled by our payment processors, not stored by us).
• Cookie and analytics data: Identifiers and signals collected through cookies and similar technologies, as described in Section 5.

We do not seek to collect special category or sensitive personal data (such as health, biometric, or government identifiers) through our website or business relationships. Please do not send us sensitive data unless we specifically ask for it.

4. How We Collect Personal Data

• Directly from you: when you complete a form, request a demo or free risk score, register a Platform account, subscribe to communications, attend an event, or contact us.
• Automatically: through cookies, server logs, and product telemetry when you use our website or the Platform, as described in Sections 3 and 5.
• From third parties: from your employer or colleagues (for example when a customer administrator creates an account for you), from business-data and lead-enrichment providers, from event co-hosts and referral partners, and from public sources, all consistent with applicable law.

5. Cookies and Similar Technologies

We use cookies and similar technologies on our website to make it work, to remember your preferences, to understand how the site is used, and to support our marketing. We group them as:

• Strictly necessary: required for the site and secure sign-in to function. These cannot be switched off.
• Functional: remember your choices and improve your experience.
• Analytics: help us measure and improve site performance using aggregated statistics.
• Marketing: help us measure campaigns and show relevant content. These are set only where you have consented, in regions where consent is required.

Where the law requires consent for non-essential cookies, we ask for it through our cookie banner and you can change your choices at any time there. You can also control cookies through your browser settings. We honour recognised opt-out signals, including Global Privacy Control (GPC), where applicable law requires us to treat them as a request.

6. Why We Process Personal Data, and Our Legal Bases

We process personal data for the purposes below. Where the EEA or UK GDPR applies, the legal basis for each purpose is shown; individuals elsewhere have equivalent protections under this policy and the region-specific terms in Section 15.

• Provide, secure, and support the Platform and our services: Performance of a contract; legitimate interests (running and protecting our services).
• Manage the business relationship, billing, and communications: Performance of a contract; legitimate interests.
• Respond to enquiries and provide customer support: Legitimate interests; performance of a contract.
• Send marketing about our products and events: Consent where required; otherwise legitimate interests, with an opt-out in every message.
• Improve our products using aggregated, de-identified metrics: Legitimate interests (we do not train models across tenants on customer data).
• Detect, prevent, and investigate fraud, abuse, and security threats: Legitimate interests; legal obligation.
• Comply with legal, tax, accounting, and regulatory obligations: Legal obligation.
• Establish, exercise, or defend legal claims: Legitimate interests; legal obligation.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may ask us for information about that balancing, and you may object as described in Section 13.

7. Artificial Intelligence and Automated Processing

The Platform uses NOVA AI to analyse security and risk data and to generate insights and recommendations. In relation to the personal data covered by this policy:

• We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, without human involvement.
• We do not train models across tenants on customer data. Any model improvement uses aggregated, de-identified metrics or, for a customer's own environment, only with that customer's opt-in.
• AI inference runs in the same region where the customer's data is stored, so data does not leave its region for processing. We agree AI processing terms with each customer.

8. Marketing Communications

We send business marketing only in line with applicable law. Every marketing email includes an unsubscribe link, and you can opt out at any time by using it or by contacting us at privacy@nmtsecurity.com. Opting out of marketing does not stop essential service messages, such as security, billing, or account notices, which we send as part of the relationship.

9. How We Share and Disclose Personal Data

We do not sell personal data, and we do not share it for cross-context behavioural advertising as those terms are defined under United States state privacy laws. We disclose personal data only as follows:

• Group affiliates: between NMT Security LLC and NMT Security Innovations Pvt Ltd to operate the business, under intra-group agreements.
• Service providers (sub-processors): vendors who support hosting, AI inference, communications, analytics, payments, and customer support, under contracts that require them to protect the data and use it only on our instructions.
• Professional advisers and auditors: such as lawyers, accountants, and certification bodies, under confidentiality obligations.
• Legal and safety: where required by law, court order, or regulator, or to establish, exercise, or defend legal rights, or to protect the rights, safety, and property of NMT Security, our customers, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to the protections in this policy.

Sub-processors. Our core infrastructure and AI inference run on established cloud and model providers within the same region where the customer's data is stored. A current list of the sub-processors we use is available on request.

10. Data Residency and International Transfers

We store customer data in the customer's own region and keep it there for processing, including NOVA AI inference. For example, data from customers in the United States is stored in the United States, data from customers in India is stored in India, and data from UK and European customers is stored in the United Kingdom. Business-relationship and website data may be processed in the United States and India, where our entities operate.

Where personal data protected by EEA, UK, or other transfer-restricting laws is accessed from another country by our affiliates or sub-processors (for example for support), we put in place a lawful transfer mechanism, which may include:

• the EU Standard Contractual Clauses (SCCs), with supplementary measures where needed;
• the UK International Data Transfer Addendum (IDTA) or the UK Addendum to the SCCs; and
• adequacy decisions or other recognised mechanisms where available.

You may request a copy of the relevant safeguard using the contact details in Section 19.

11. Data Retention

We keep personal data only for as long as we need it for the purposes in this policy and to meet legal, tax, and regulatory obligations, after which we delete or anonymise it. In practice:

• Business-relationship and account data are kept for the life of the relationship and for a reasonable period afterwards for legal and record-keeping purposes.
• Audit logs are retained for the period needed for security and accountability.
• Marketing data are kept until you unsubscribe or become inactive, subject to a suppression record so we can honour your opt-out.
• Customer data are handled under our customer agreement, including a thirty (30) day post-termination export window, after which the data are deleted or returned as agreed.

Where we cannot delete data immediately (for example when it sits in secure backups), we isolate it from active use and delete it on our normal backup cycle.

12. How We Protect Personal Data

We apply the technical and organisational measures described in our Technical and Organizational Measures (TOMs) document, including encryption in transit and at rest, role-based access control and least privilege, network and application security controls, logging and monitoring, secure development practices, vendor due diligence, and a documented incident-response process. NMT Security maintains an information-security programme aligned to recognised standards. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect personal data and to notify affected parties and regulators of incidents where the law requires.

13. Your Privacy Rights

Subject to your local law, you may have the following rights over your personal data. We honour these rights for all individuals to the extent the law allows, and additional or different rights for specific regions are set out in Section 15.

• Access: obtain confirmation of whether we process your data and a copy of it.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data in certain circumstances.
• Restriction: ask us to limit processing in certain circumstances.
• Portability: receive certain data in a structured, machine-readable format, or have it sent to another controller.
• Objection: object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent: where we rely on consent, withdraw it at any time without affecting prior processing.
• Non-discrimination: not be treated unfairly for exercising your rights.
• Complain: lodge a complaint with your supervisory or data-protection authority.

14. How to Exercise Your Rights

To exercise any right, contact us at privacy@nmtsecurity.com. We will respond within the timeframe your law requires, and we will not charge a fee unless the law permits it (for example for manifestly unfounded or excessive requests). To protect your data, we may ask you to verify your identity before we act, and we will only ask for information reasonably necessary to do so.

If you are an employee or user of one of our customers and your data is in the Platform as customer data, we act as a processor for that data. Please direct your request to that customer (the controller), and we will assist them in responding.

You may use an authorised agent to submit a request where the law allows, provided the agent gives proof of authorisation and we can verify your identity.

15. Region-Specific Disclosures

The following terms add to the rest of this policy for individuals in the named regions. Where they conflict with the general terms, these region-specific terms prevail for those individuals.

15.1 European Economic Area, United Kingdom, and Switzerland

Our legal bases are set out in Section 6. You have the GDPR and UK GDPR rights listed in Section 13, including the right to lodge a complaint with a supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ICO). International transfers are handled as described in Section 10. Where we rely on legitimate interests or, for special cases, other bases, you may ask us for further detail. We do not use solely automated decision-making that produces legal or similarly significant effects, as noted in Section 7.

15.2 United States

We do not sell your personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act as amended (CCPA/CPRA) and comparable state laws. Depending on your state (for example California, Virginia, Colorado, Connecticut, Utah, and others with comprehensive privacy laws), you may have rights to know or access, to correct, to delete, to obtain a portable copy, to opt out of sale, sharing, and certain targeted advertising and profiling, and to non-discrimination for exercising your rights. Sensitive personal information, where collected, is used only for permitted purposes. To exercise these rights, use the contact details in Section 19; we will verify your request and may permit an authorised agent to act for you. We honour Global Privacy Control (GPC) signals where required.

Categories collected, purposes, and disclosure recipients are described in Sections 3, 6, and 9 and, together with this section, form the notice required by California and comparable state laws.

15.3 India

For individuals in India, we process personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023, where it applies to us. You may access and correct your data, request erasure, nominate another person to exercise your rights in the event of death or incapacity, withdraw consent where processing is based on consent, and raise a grievance with us. We provide a readily available means to withdraw consent and to make a grievance, and we will respond within the period the law requires. Our grievance contact is set out in Section 19.

15.4 Other Jurisdictions

For individuals in Brazil (LGPD), Canada (PIPEDA), and other jurisdictions with data-protection laws, we honour the equivalent rights available under your local law. Contact us using the details in Section 19 and we will handle your request in accordance with that law.

16. Children's Privacy

Our website, Platform, and services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children under the age applicable in their jurisdiction (for example, under 18 in the United States context of this policy, and the relevant threshold under GDPR and the India DPDP Act). If you believe a child has provided us with personal data, contact us and we will delete it.

17. Third-Party Links and Services

Our website and communications may contain links to third-party sites and services that we do not control. This policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review the privacy notices of any third-party site you visit.

18. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, technology, or the law. We will post the current version with its version number and effective date on nmtsecurity.com/privacy. Where a change is material, we will provide additional notice as the law requires. Your continued use of our website or the Platform after an update means you are aware of the current policy.

19. How to Contact Us

For any privacy question or to exercise your rights, contact our data-protection team:

If you are in the EEA or the UK and wish to reach us about EEA or UK personal data, contact us at the address above and we will direct your request to the responsible entity and, where required, our representative for that region.

This policy is provided by NMT Security (NMT Security LLC and NMT Security Innovations Pvt Ltd). It supersedes version 2025-11.