Privacy Policy

Last updated: September 16, 2026

This Privacy Policy explains how GlobalBay, operating the NexoRush marketplace (“GlobalBay”, “NexoRush”, “we”, “us” or “our”), collects, uses, discloses, stores and protects personal data.

This Privacy Policy is a transparency notice. It does not itself constitute consent. Where consent is required, NexoRush requests it separately through a clear affirmative control that is not pre-selected. Refusing optional marketing or analytics consent does not prevent access to core marketplace functions.

1. Data controller

The controller responsible for the processing described in this Policy is:

GlobalBay (operating NexoRush)
De Nieuwe Erven 3 Unit 13664
5431 NV Cuijk
Netherlands
Email: support@nexorush.com

Use the contact details above for privacy requests, questions or complaints. We normally respond to a valid data-subject request within one month, subject to the extensions and identity-verification rules permitted by applicable law.

2. Scope

This Policy applies to NexoRush websites, accounts, public profiles, listings, purchases, freelance projects, messages, files, support, seller onboarding, tax review, self-billing, payouts, newsletters, analytics, advertising and approved integrations.

Third-party services have their own privacy notices. This Policy does not control independent processing performed by Stripe, Payoneer, Google, Meta, Microsoft, OpenAI or another third party under its own legal responsibilities.

3. Personal data we collect

3.1 Account and authentication data

• name, username and email address;

• password in hashed form;

• email-verification, authentication-session and security records;

• account role, status, preferences and consent records;

• newsletter subscription and email-notification preferences.

3.2 Public profile and marketplace data

• display name, username, public profile slug, profile photo and cover image;

• public biography, skills, languages, years-of-experience range and country where the user chooses to display them;

• published products, freelance services, categories, tags, descriptions, images and public seller statistics;

• public blogs, resources and other content submitted for publication.

Information marked public may be visible to visitors, search engines and approved public-discovery integrations. Private legal, tax, payout and project data is not included in the public profile merely because a person is a Seller.

3.3 Seller identity, tax, self-billing and payout data

To operate the Seller relationship and meet accounting and tax obligations, we may collect:

• Seller type, such as individual, self-employed person or company;

• legal name and optional business name;

• legal address, city, postal code, establishment country, Seller country and tax country;

• tax-registration status, VAT ID, tax ID and applicable exemption information;

• payout provider, Stripe connected-account identifier, Payoneer email or customer identifier, and payout status;

• self-billing agreement version, acceptance status and timestamp;

• Seller tax treatment, reviewed rate, price basis, review status, review reference and review timestamp;

• self-billing invoices, settlement statements, credit notes, payout references and document-response records;

• identity, business or payout verification status supplied by a payment or verification provider.

Some business information may identify an individual, particularly for sole traders and self-employed Sellers, and is therefore treated as personal data.

3.4 Purchase, project and accounting data

• orders, line items, licences, custom offers, project requirements and delivery status;

• prices, fees, discounts, Buyer Tax, Seller remuneration, Seller Tax and payout calculations;

• Stripe Checkout, payment, refund, dispute, chargeback and transfer references;

• billing name, billing address, country and tax information provided during checkout;

• invoices, receipts, proformas, credit notes, self-billing documents and immutable transaction snapshots;

• records showing the legal-policy versions accepted for a checkout or Seller action.

NexoRush does not store complete payment-card numbers or card security codes. Card information is handled by the payment provider.

3.5 Communications and files

• project messages, typing and read-status information;

• requirements, offers, revisions, deliveries and dispute evidence;

• attachments and associated file metadata;

• support requests, reports, complaints and responses;

• transactional email delivery and unsubscribe status.

Please do not place passwords, unnecessary contact details, health information, government identifiers or other sensitive personal data in project messages or files. If sensitive data is necessary for a project, disclose only the minimum required and ensure you have a lawful basis to provide it.

3.6 Technical, security and usage data

• IP address, approximate location, browser, device and operating-system information;

• request time, page and API activity, referral source and error information;

• authentication, rate-limit, fraud-prevention and security-event data;

• cookie identifiers, consent status and preference records;

• analytics events, advertising interactions and campaign parameters where permitted.

3.7 Data received from other sources

We may receive information from Buyers and Sellers participating in the same transaction, payment and payout providers, VIES, authentication providers, email providers, fraud-prevention services, advertising and analytics providers, and public authorities where permitted by law.

4. Why we use personal data and our legal bases

PurposeTypical legal basisCreate and secure accounts, authenticate users and provide requested marketplace functionsPerformance of a contract and steps requested before entering a contractProcess purchases, projects, messages, delivery, refunds, disputes and supportPerformance of a contract; legitimate interests in operating and protecting the marketplace; legal obligations where applicablePerform Seller onboarding, verify payout eligibility and administer Seller remunerationPerformance of the Seller relationship; legal obligations; legitimate interests in preventing payment and identity fraudAssess Seller-side tax treatment, issue and retain fiscal documents, and maintain accounting recordsLegal obligations; performance of the Seller relationship; establishment, exercise or defence of legal claimsDetect fraud, abuse, unauthorised access, sanctions risk and policy violationsLegitimate interests in security and fraud prevention; legal obligationsSend transactional messages about accounts, purchases, projects, security and payoutsPerformance of a contract and legitimate interests in operating the serviceSend newsletters or direct marketingConsent where required, with the right to unsubscribe at any timeUse non-essential analytics, advertising pixels, audience matching or personalised advertisingConsent where required by GDPR and ePrivacy rulesImprove accessibility, reliability, performance and user experience using necessary or aggregated informationLegitimate interests, subject to balancing and data minimisation; consent where a non-essential tracking technology is used

The self-billing agreement is a commercial and accounting agreement. It is separate from consent under data-protection law. Withdrawing optional privacy consent does not invalidate fiscal documents or remove records that GlobalBay must retain under law.

5. Seller tax review and VIES

Where a VAT ID is provided, NexoRush may submit the country code and VAT number to the European Commission’s VAT Information Exchange System (“VIES”). VIES may return a validity result and, where available, a name, address and request date.

A VIES response may support verification, but does not by itself determine the final Seller tax treatment. An unavailable service, failed check, country, legal form, payout provider or VAT identifier alone does not cause NexoRush to invent a VAT rate, exemption or reverse-charge conclusion. Incomplete, inconsistent or unsupported cases are marked for manual review.

Authorised administrators may review the Seller’s submitted information and record a treatment, rate, basis and review reference. New or materially changed Seller information may invalidate an earlier review and require reassessment.

6. Self-billing and fiscal documents

Where the Seller has separately accepted the applicable Self-Billing Agreement and the necessary review has been completed, GlobalBay may generate a self-billing invoice in the Seller’s name for the Seller’s supply to GlobalBay.

Fiscal documents may include legal identity, address, VAT or tax identifiers, description of supply, transaction date, net remuneration, tax treatment, tax amount, total payable and payment or payout references. These documents are not public.

Issued financial documents and their underlying snapshots are retained as accounting records. If a document is reported as incorrect, the original audit record is preserved and any correction, credit or replacement is recorded separately rather than silently rewriting the issued document.

7. Public profiles, search engines and integrations

Published profiles, listings, blogs and resources may be indexed by search engines and displayed in search results. Removing or changing public content on NexoRush may not immediately remove copies held by an independent search engine or archive.

At a user’s request, an approved public-discovery integration, including the NexoRush ChatGPT app, may return a limited public profile result such as public slug, display name, avatar and selected skills. These integrations must not receive private messages, tax identifiers, payout information, project files, private activity or authentication data through the public discovery tools.

AI-assisted publishing tools may use public marketplace information such as published listing summaries, categories, public titles and tags to prepare draft content. Private messages, project files, payment details and Seller tax records are not intended as input to those public-content generation workflows.

8. Communications, notifications and administrator access

Project communications and files are private to the relevant participants, except that authorised administrators may access them where reasonably necessary for support, delivery review, safety, fraud prevention, a dispute, legal compliance or enforcement of the Terms.

When a user is offline, NexoRush may send a transactional notification that a new project message is available. The message should be viewed within the authenticated platform. Users can manage non-essential conversation email notifications through the provided preference or unsubscribe controls.

Administrative access is role-restricted and should be used only on a need-to-know basis. Access to a private record does not make that record public.

9. Payment and payout providers

Stripe processes Buyer payments and may process identity, tax, fraud-prevention and Stripe Connect payout information. Payoneer may process identity and payout information for supported manual or provider-based payouts. These providers may act as processors, independent controllers or both, depending on the activity and applicable terms.

Payment and payout providers may request additional information directly from a user. Their collection and use of data is also governed by their own privacy notices:

• Stripe Privacy Policy

• Payoneer Privacy Policy

The payout provider selected for operational routing does not determine the Seller’s tax treatment.

10. Cookies and similar technologies

NexoRush uses cookies and similar technologies in the following categories:

• Strictly necessary: authentication, session security, fraud prevention, consent storage and core functionality. These cannot be disabled where they are necessary to provide the requested service.

• Functional: optional interface or preference features.

• Analytics: measurement of platform use and performance.

• Advertising and targeting: conversion measurement, campaign attribution, audience creation and, where enabled, personalised advertising.

Non-essential analytics and advertising technologies are activated only after the required consent. Users can change or withdraw consent through Cookie Settings. Withdrawal applies to future processing and does not make earlier consent-based processing unlawful.

Additional details are available in About Cookies.

11. Analytics and advertising providers

11.1 Google

With the required consent, NexoRush may use Google Analytics, Google Ads and Google Tag Manager to measure usage, attribution and advertising performance. Google may process cookie identifiers, device data, approximate location and interaction events under its own terms and privacy information.

11.2 Microsoft Advertising

With the required consent, Microsoft Universal Event Tracking may measure conversions and campaign interactions. Users can review Microsoft’s practices at Microsoft Privacy Statement.

11.3 Meta

With the required consent, the Meta Pixel may measure conversions and support custom or lookalike audiences. Meta processes information under its Privacy Policy.

11.4 OpenAI conversion measurement

With marketing consent, NexoRush may use the OpenAI conversion pixel to measure page views, marketplace-content interactions, registrations, checkout starts and completed orders. Event payloads are limited to information required for measurement, such as marketplace identifiers, public item labels, quantities, currency and transaction amounts.

NexoRush does not intentionally send project-message text, project requirements, private files, Seller tax information or complete payment-card information through conversion events. Where advanced matching is enabled, eligible identifiers may be normalised and hashed for attribution. The pixel is disabled before marketing consent and receives the applicable denial signal when consent is withdrawn.

11.5 Other providers

If another analytics or advertising provider is introduced, NexoRush will update the relevant notice and consent controls before using it where required. NexoRush does not sell personal data to data brokers.

12. When we disclose personal data

We may disclose the minimum necessary personal data to:

• payment, payout, identity-verification and fraud-prevention providers;

• VIES and competent tax or regulatory authorities;

• hosting, database, private-file storage, security, email and support providers;

• analytics and advertising providers after the required consent;

• professional legal, tax or accounting advisers where reasonably necessary and subject to confidentiality;

• a Buyer or Seller to the limited extent necessary to perform a transaction, provide support or comply with an invoice requirement;

• courts, law-enforcement bodies or public authorities where disclosure is legally required or necessary to protect legal rights; and

• a successor in a merger, acquisition, restructuring or transfer, subject to applicable confidentiality and notice requirements.

We do not disclose private Seller tax identifiers, payout identifiers or legal addresses through public APIs or public profile pages unless a specific disclosure is legally required and the user is informed.

13. International transfers

Some service providers may process data outside the European Economic Area. Where GDPR transfer restrictions apply, NexoRush relies on an applicable lawful transfer mechanism, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or another legally permitted safeguard.

The location and role of a provider may vary by service. Users may contact us for further information about safeguards relevant to their personal data.

14. Retention

We retain personal data only for as long as necessary for its stated purpose, a legal retention duty, fraud prevention, dispute resolution or the establishment, exercise or defence of legal claims.

• Account and profile data: while the account is active and generally up to two years after closure, unless a shorter period is appropriate or a longer period is required for an unresolved obligation or legal claim.

• Invoices and core accounting records: generally at least seven years under Dutch fiscal recordkeeping requirements.

• Records subject to OSS, IOSS or another longer fiscal rule: up to ten years or another period required by applicable law.

• Seller tax profiles, self-billing agreements and review records linked to a transaction: retained with the associated fiscal and accounting records.

• Profiles or verification submissions not linked to a transaction: retained only for the active onboarding or account relationship and a proportionate compliance, fraud-prevention or limitation period.

• Project messages, requirements, offers, delivery files and dispute evidence: for the project lifecycle and afterwards for the applicable dispute, fraud-prevention, limitation or legal-preservation period.

• Support communications: generally up to three years after resolution, unless linked to an active legal, financial or security matter.

• Authentication and security logs: for a limited security and fraud-prevention period determined by risk and operational necessity.

• Analytics and advertising data: according to the configured retention period and consent state, subject to the relevant provider’s controls.

• Newsletter data: until unsubscribe, objection or another reason requires removal, while retaining a minimal suppression record where necessary to respect the opt-out.

When retention is no longer justified, data is deleted or irreversibly anonymised. A deletion request cannot require GlobalBay to erase an invoice, consent record or audit trail that must still be retained by law.

15. Automated processing and human review

NexoRush may use automated rules to detect suspicious activity, enforce rate limits, check data completeness, route payouts, calculate financial amounts or flag an account or transaction for review.

NexoRush does not intend to make a final Seller tax determination solely from country, Seller type, payout provider or an automated VIES response. Unsupported cases use manual review. A Seller may correct submitted data and report an incorrect self-billing document through the available procedure.

Where a decision is based solely on automated processing and produces a legal or similarly significant effect, users have the rights provided by Article 22 GDPR, including the right to request human intervention where applicable.

16. Security

We apply proportionate technical and organisational measures designed to protect personal data. These include TLS in transit, hashed passwords, authentication and session controls, role-based administrative access, private storage for protected project files, input validation, rate limits, audit records and security monitoring.

No system is completely secure. Users must protect their credentials and promptly report suspected account compromise. Do not send complete payment-card data or passwords through messages or support requests.

Where a personal-data breach triggers a legal notification duty, GlobalBay will notify the competent supervisory authority within the applicable period and notify affected individuals where the breach is likely to create the level of risk requiring individual notice.

17. Your data-protection rights

Subject to applicable conditions and exemptions, you may have the right to:

• receive information about processing;

• access your personal data and receive a copy;

• correct inaccurate or incomplete data;

• request deletion where data is no longer needed and no legal duty requires retention;

• restrict processing in specified circumstances;

• receive eligible data in a structured, commonly used, machine-readable format;

• object to processing based on legitimate interests;

• object at any time to direct marketing;

• withdraw consent for future consent-based processing; and

• request safeguards relating to qualifying automated decisions.

To exercise a right, email support@nexorush.com. We may request information necessary to verify identity and prevent unauthorised disclosure. Rights are not absolute; for example, legal retention duties may prevent deletion of fiscal records.

You may lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens
Website: autoriteitpersoonsgegevens.nl

18. Children

NexoRush is not intended for persons under 16, and marketplace accounts and transactions require users to be at least 18. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us so that we can investigate and take appropriate action.

19. Changes to this Policy

We may update this Policy when processing activities, providers, security practices or legal requirements change. The current version and effective date will be displayed on this page. Where a change materially affects individuals, we will provide an appropriate notice before the new processing begins where required.

A Privacy Policy is a notice, not a substitute for consent. If a new activity requires consent, we will request that consent separately rather than treating continued use as agreement.

20. Contact

Privacy questions, requests or complaints may be sent to:

GlobalBay (operating NexoRush)
De Nieuwe Erven 3 Unit 13664
5431 NV Cuijk
Netherlands
Email: support@nexorush.com