Last Updated: November 15, 2025
Contact: hello@mynestup.com
Controller: MyNestup (Operating Globally)
1. Introduction
MyNestup is committed to safeguarding the privacy, security, and rights of individuals whose personal data we process. As a global digital platform, we operate under a hybrid privacy and compliance model, integrating:
- Pakistan’s data protection principles (primary jurisdiction)
- EU General Data Protection Regulation (GDPR)
- UK GDPR
- California CCPA/CPRA
- PIPEDA (Canada)
- Other mandatory international privacy laws applicable to users in specific regions
This Data Protection & GDPR Compliance Statement outlines the safeguards, policies, and procedures we implement to ensure the lawful, transparent, and secure processing of personal data.
2. Data Controller & Contact Information
Data Controller: MyNestup
Email: hello@mynestup.com
DPO (if appointed): Will be published upon designation
Individuals may contact us for inquiries, complaints, or data rights requests.
3. Principles of Data Processing (GDPR Art. 5)
MyNestup adheres to internationally recognized data protection principles:
- Lawfulness, Fairness, Transparency – Data is processed only with valid legal grounds.
- Purpose Limitation – Data is collected for explicit, legitimate purposes.
- Data Minimization – Only necessary data is collected.
- Accuracy – Data is kept accurate and up to date.
- Storage Limitation – Data is retained only as long as required.
- Integrity & Confidentiality – Security measures protect data from unauthorized access.
- Accountability – We document and demonstrate compliance.
4. Legal Bases for Processing (GDPR Art. 6)
We rely on one or more lawful bases depending on the type of processing:
- Consent – For newsletters, marketing, cookies.
- Contractual necessity – Account creation, subscriptions.
- Legal obligations – Tax, audit, regulatory compliance.
- Legitimate interests – Security, analytics, service improvement.
- Public interest – When applicable.
Legitimate interest balancing tests are documented internally.
5. Data Subject Rights
Depending on jurisdiction (EU/EEA, UK, California, Canada), users may have rights including:
- Right of Access – Obtain a copy of personal data.
- Right to Rectification – Correct inaccurate data.
- Right to Erasure – Request deletion where applicable.
- Right to Restrict Processing – Limit use of data.
- Right to Object – Including for marketing and profiling.
- Right to Data Portability – Receive data in structured format.
- Right to Withdraw Consent – At any time.
- Right to Lodge a Complaint – With supervisory authorities.
To exercise rights: email hello@mynestup.com with subject “Data Request.”
6. International Data Transfers
Because MyNestup operates globally, personal data may be transferred outside the user’s jurisdiction. We implement safeguards such as:
- Standard Contractual Clauses (SCCs)
- UK International Data Transfer Addendum (IDTA)
- Vendor compliance assessments
- Encryption and pseudonymization
We ensure third parties receiving data maintain adequate protection.
7. Security Measures (GDPR Art. 32)
We implement technical and organizational security measures including:
- HTTPS/TLS encryption for data in transit
- Access control and authentication
- Least-privilege access policies
- Regular vulnerability testing
- Server-side protections and firewall systems
- Employee training in cybersecurity and privacy
- Incident detection and response procedures
In case of a breach involving EU/EEA data subjects, we follow GDPR notification rules.
8. Data Protection Impact Assessments (DPIAs)
For processing activities that may result in high risk to individual rights, MyNestup conducts:
- DPIAs to assess impact
- Risk mitigation planning
- Documentation of outcomes
These are revisited periodically.
9. Vendor & Subprocessor Management
Third-party processors are reviewed through:
- Compliance assessments
- Contractual obligations
- Data Protection Agreements (DPAs)
- Regular risk reviews
Users may request a subprocessors list.
10. Cookies, Tracking & Profiling
MyNestup uses cookies, pixels, and tracking technologies for analytics, personalization, and advertising. GDPR-compliant cookie consent mechanisms are implemented for EU/EEA users.
More details are available in the Cookie Policy.
11. Children’s Data Protection
We do not knowingly collect personal data from children below the legal age of consent in their jurisdiction. If such data is discovered, it is deleted immediately.
12. Accountability & Documentation
To demonstrate compliance, we maintain:
- Processing activity registers (GDPR Art. 30)
- Records of consent
- Internal security documentation
- Incident response records
- Vendor audit logs
- DPIA reports
13. Complaints & Supervisory Authorities
Users may contact us directly regarding concerns. EU/EEA users may also file complaints with their national supervisory authority.
14. Updates to This Statement
This Compliance Statement may be updated periodically to reflect regulatory or operational changes.
Last Updated: November 15, 2025
