Information on the processing of personal data in NiCo Workshop under the GDPR.
For registration, user accounts, contract administration, billing, payment processing, support and system security, NiCo Digital Technologies OÜ acts as controller.
For personal data entered by a workshop about its own customers, employees, prospects or other persons where the workshop determines the purposes of processing, the workshop is generally the controller and NiCo processes that data as processor under Article 28 GDPR.
Depending on use, we process registration/account data, company and billing data, customer and vehicle data, licence plates and VINs, jobs, appointments, work times, notes, media, rental vehicles and reservations, communications/support data, invoice/payment data and technical security, session, access and error data.
Processing is used to provide and administer NiCo Workshop, operate the trial and contract, bill and process payments, provide support, secure the service, prevent abuse and comply with legal obligations.
Legal bases include Art. 6(1)(b) GDPR (contract/pre-contractual steps), Art. 6(1)(c) (legal obligations), Art. 6(1)(f) (legitimate interests in secure operation, troubleshooting and receivables management) and, where required, Art. 6(1)(a) (consent).
Registration and login involve the account and company data provided. Passwords are stored as cryptographic hashes rather than plain text.
For password resets, a time-limited secure reset token or its hash, email address, timestamps and status are processed. The reset link is normally valid for 60 minutes and is invalidated after successful use.
When customer, vehicle, job, appointment, communications, rental or booking functions are used, the data entered for those functions is processed. Public contact, appointment or booking requests are transmitted to and handled by the selected workshop.
For billing, we process company and invoice data, prices, due dates, payment status and payment references. For PayPal payments, data necessary for the payment transaction is transmitted to and received from PayPal. PayPal also processes data for its own purposes under its privacy terms.
A user confirmation that a bank transfer has been initiated is not necessarily an automated confirmation of actual receipt of funds.
NiCo Workshop uses technically necessary session mechanisms, especially PHP session cookies, for authentication, language, security status and protected areas. Advertising or profiling cookies are not required for normal operation.
If optional analytics or marketing services are introduced in future, they will only be used on an appropriate legal basis and, where required, with consent; this policy will be updated.
Hosting/server providers, email infrastructure, payment providers and technical IT providers may be used to deliver the service. They receive data only as necessary and are contractually bound where they act as processors.
International providers may process data outside the EEA. Such transfers are made only using a GDPR-permitted mechanism such as an adequacy decision, Standard Contractual Clauses or other appropriate safeguards.
Personal data is retained only as long as necessary for its purpose. Contract, invoice and tax-related data may be retained longer where legal retention rules require this. Technical security and error logs are kept only as long as needed for security, troubleshooting or legal claims.
Data processed solely as processor for a workshop is deleted or returned according to the contract and workshop instructions unless legal obligations require retention.
NiCo Workshop may automatically restrict a workshop account to the billing area when invoices become overdue. This supports contract performance and the legitimate interest in receivables management. It is not profiling. Manual review can be requested through the contact details above.
We use appropriate technical and organisational measures, including access restrictions, role-based permissions, password hashing, session controls, security logging and tenant separation.
Where legal conditions are met, data subjects have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent for the future. Requests can be sent to nico@zsb-hg.de.
Where NiCo processes data solely as processor for a workshop, the request should generally first be addressed to that workshop as controller.
You may lodge a complaint with a data protection authority. The Estonian supervisory authority can be contacted at:
NiCo Workshop is business software for workshops and is not directed at children. Independent registration by minors is not intended.
We update this policy when features, providers, legal requirements or processing activities change.