Privacy Policy

Effective Date: 25 November 2024

Last Updated: 6 October 2026

1. Data Controller

IT Nest ("we," "us," or "our") is the data controller responsible for your personal data.

Registered Name: IT Nest Limited
Registered Address: Office 3906, 39/F, The Center, 99 Queen's Road Central, Central, Hong Kong
Business Registration No. (BRN): 77297048
Contact Email: contact@itnest.agency

UK correspondence address: 66 Paul Street, London, EC2A 4NA, United Kingdom

1.1 EU Representative (Article 27 GDPR)

As we are established outside the European Economic Area, we have appointed a representative in the EU in accordance with Article 27 of the General Data Protection Regulation (EU) 2016/679.

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit: https://app.prighter.com/portal/15136688062

1.2 UK GDPR enquiries

For UK GDPR matters, please contact us directly at contact@itnest.agency or our UK correspondence address.

2. About This Policy

This Privacy Policy explains how we collect, use, store, and protect personal data when you use our website, services, or when we contact you as part of our business-to-business (B2B) activities. It applies to all individuals whose personal data we process, including our clients, website visitors, and business contacts.

This Privacy Policy covers all products and services operated by IT Nest Limited, including IT Nest agency (at itnest.agency), the free tools on that website, the hosted guest review pages and menus at qr.itnest.agency, TocoRate (at tocorate.com), and any future products launched by the Company. IT Nest Limited acts as the data controller for all of these products, except where Section 3.6 says otherwise.

3. Information We Collect

3.1 Information You Provide Directly

We collect personal data that you voluntarily provide when you:

• Register for an account or subscribe to our services
• Contact us via email, phone, or contact forms
• Make payments for our services
• Subscribe to our newsletters
• Join the Staff Checklist waiting list

This information may include: full name, email address, phone number, business name and address, job title or role, and payment information (processed by third-party payment processors).

3.2 Information We Collect Automatically

When you visit our website, we automatically collect certain technical data, including: IP address, browser type and version, device information, operating system, pages visited and time spent on pages, referring website addresses, and approximate geographic location (country or city level).

3.3 Information Obtained from Publicly Available Sources (Article 14 GDPR)

As part of our B2B commercial activities, we may collect business contact information from publicly available sources, including Google Maps, company websites, public business directories, and professional networking platforms. This data typically includes: business name, business email address (such as info@ or contact@ addresses), business phone number, business address, and publicly visible online ratings.

Where we obtain your personal data from such sources, we will inform you of this at the point of first contact, in accordance with Article 14 of the GDPR. We process this data on the basis of our legitimate interest in B2B commercial prospection (see Section 5).

In addition, for our TocoRate product, we collect publicly available pricing and availability data from online travel agencies and booking platforms (such as Booking.com, Airbnb, and Agoda). This data consists of commercial information about room rates and availability and does not constitute personal data.

3.4 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience and collect usage data. You can control cookie settings through your browser. Disabling cookies may limit some functionality. For details, see our Cookie policy on our website.

3.5 Free Tools on Our Website

Our website offers free tools: a Google review QR code and page builder, a QR menu maker, and a Google review removal checker. When you use them we collect:

• The email address you give us, together with a record of the terms and privacy notice you accepted, whether you agreed to receive marketing emails, the version of that notice and the time of your consent
• A keyed hash of your IP address (we do not keep the address itself), used to enforce the free limits and to prevent abuse
• For the QR code builder: the business name, subtitle, Google review link, logo and background image you upload, the page settings you choose, and the QR code files we generate for you
• For the QR menu maker: the restaurant name, the menu (dishes, prices, descriptions, allergens, weights and calories), the logo and background image you upload, the page settings you choose, and the QR code files we generate for you. Menu photos you add are sent to the Anthropic API (Section 7.5) only to read the menu. We do not store the photos: the text read from them goes back to your browser, and only the menu you publish is kept
• For the removal checker: the Google Maps link you paste, the publicly visible reviews of that profile that we collect (reviewer display name, star rating, review text, publication date and the reviewer's public review count), and our automated assessment of each review

We use this data to deliver the result you asked for, to email it to you, to enforce the limits of the free tools (one hosted page per email address, one menu per email address, one check per email address each week), and – only if you ticked the box – to send you marketing emails you can opt out of at any time (Section 10.2). We may also contact you about the result of a tool you used, as a business contact, on the basis of our legitimate interest (Section 5); you can object at any time. The reviews collected for a check are publicly available on Google Maps (Article 14 GDPR); we keep them together with our assessment so that we can discuss the result with you.

3.6 Hosted Guest Review Pages and Menus (qr.itnest.agency)

Businesses that use our review pages place a QR code on their premises. When a guest scans it we record the scan (device type, operating system, browser, language, referring page, a keyed hash of the IP address and the time), and, if the guest leaves feedback, the star rating, any note the guest writes, the browser's user agent and the time. A guest's email address is stored only if the guest ticks the box offering to be contacted, and is shown only to the business the feedback is about. Guest review pages set no cookies and load no analytics; they load their typefaces from Google Fonts, which receives the visitor's IP address in order to serve them.

For guest feedback and scan data, the business whose page it is decides why the data is collected and is the data controller; IT Nest Limited processes it on that business's behalf as its processor and shows it to that business only. Guests who want to exercise their rights over feedback they left should contact the business, or write to us at contact@itnest.agency and we will pass the request on.

Menu photos a business uploads for its digital menu are processed by an AI provider (Section 7.5) to transcribe the menu text; the photos are not used for any other purpose.

The same applies to personal data our clients give us to process on their behalf: the names, contact details and appointment times of patients for a clinic's online booking, reminders and AI assistant, and the lists of past guests a hotel sends us for its returning-guest emails. The client is the data controller of that data; IT Nest Limited processes it only on the client's documented instructions, as its processor under a data processing agreement (Article 28 GDPR), and deletes or returns it at the end of the service.

4. How We Use Your Information

We use collected information for the following purposes:

• Providing and maintaining our services, including the free tools and the waiting list you ask to join (performance of a contract or of steps taken at your request, Article 6(1)(b))
• Processing payments and managing subscriptions (contract, Article 6(1)(b), and legal obligation, Article 6(1)(c))
• Communicating with you about services and updates (contract, Article 6(1)(b)), and about relevant offers (consent, Article 6(1)(a), or our legitimate interest in B2B marketing, Article 6(1)(f))
• B2B commercial prospection: contacting businesses whose professional activities are relevant to the services we offer (legitimate interest, Article 6(1)(f))
• Analysing and improving our website and services (consent for analytics cookies, Article 6(1)(a); otherwise legitimate interest, Article 6(1)(f))
• Detecting and preventing fraud and security issues (legitimate interest, Article 6(1)(f))
• Complying with legal obligations (Article 6(1)(c))
• Enforcing our Terms & Conditions (legitimate interest, Article 6(1)(f))

5. Legal Basis for Processing (GDPR Article 6)

We process personal data on the following legal bases:

• Legitimate Interest (Article 6(1)(f)): For B2B commercial prospection, service improvement, fraud prevention, and direct marketing to business contacts where the communication is relevant to the recipient's professional activity. We have conducted a Legitimate Interest Assessment to ensure that our interests do not override your fundamental rights and freedoms.
• Contract Performance (Article 6(1)(b)): Processing necessary to perform a contract with you or to take steps at your request prior to entering into a contract.
• Consent (Article 6(1)(a)): Where you have given clear consent for us to process your personal data for a specific purpose, such as subscribing to marketing communications.
• Legal Obligation (Article 6(1)(c)): Where processing is necessary for compliance with a legal obligation to which we are subject.

6. B2B Commercial Prospection

We approach businesses offline: by letter to the business address, or in person at the venue. We do not run cold email or cold calling. When we make contact:

• our legitimate interest is the legal basis for processing business contact data
• we use only publicly available business details, for example from Google Maps or the company's own website
• we clearly identify ourselves and the purpose of our communication
• we disclose the source of the contact data, as required by Article 14 of the GDPR
• we give a simple and free way to opt out of further contact, honour opt-out requests within 48 hours, and keep a suppression list to prevent re-contact
• we send email only to businesses that approached us first or consented to it

If you received a communication from us and wish to know more about how we obtained your data, or wish to exercise any of your rights, please contact us at contact@itnest.agency.

7. Third-Party Services and Data Sharing

We share data with the following categories of third-party service providers to operate our business:

7.1 Payment Processing

We use Stripe as our payment processor. When you make a payment, your payment information is transmitted directly to Stripe and processed in accordance with their privacy policy. We do not store complete payment card details on our servers.

7.2 Analytics

We use Google Analytics and PostHog (hosted in the European Union) to analyse website traffic and user behaviour. They collect information such as pages visited, session duration, and browser type. Google Analytics data may be transmitted to and processed by Google in the United States; Google's use of this data is governed by the Google Analytics Terms of Service and Google Privacy Policy. Neither service runs on the hosted guest review pages or in our administration area.

7.3 Email and Messaging Communications

We use the following services for communications:

• Resend: For transactional emails, such as the QR code files and the checker result you asked for, and notifications to businesses about feedback left on their review pages
• Telegram: For internal notification of enquiries sent through our website

These services may collect data about email delivery, opens and clicks.

7.4 Other Third-Party Services

We use additional third-party services for data storage and hosting (Cloudflare, including its database and file storage), security and fraud prevention, and internal notification tooling. We require all third-party service providers to respect the security of your personal data and to treat it in accordance with the law.

7.5 Data and API Providers

For our TocoRate product, we use DataForSEO, Apify, and the Anthropic API to collect and process publicly available commercial pricing data only; that use does not involve personal data.

For the free Google review removal checker, we use DataForSEO to collect the publicly visible reviews of the Google Maps profile you link, and the Anthropic API to assess those reviews against Google's published review policy. The review text and the reviewer's public display name are sent to these providers for that purpose only; your own email address is not.

For digital menus, menu photos are sent to the Anthropic API for transcription and menu text to DeepL for translation. Neither contains personal data in the ordinary course.

8. International Data Transfers

Your personal data may be transferred to, stored, and processed in countries outside your country of residence, including Hong Kong, the United States, and European Union member states. Where we transfer personal data outside the EEA or UK, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission or UK Secretary of State
• Other lawful transfer mechanisms as required by applicable law

9. Data Retention

We retain personal data for the following periods:

• Client account data: For the duration of your active subscription plus 6 years after termination (for tax and legal compliance)
• B2B prospection data: Maximum 3 years from the date of collection or last meaningful contact, whichever is later. Non-responsive contacts are removed within 30 days of last attempted contact.
• Website analytics data: up to 14 months in Google Analytics, and up to 12 months for the PostHog identifier
• Payment records: 7 years (legal and tax obligations)
• Free tool data (Section 3.5): Your email address, consent record and hashed IP address for up to 24 months after you last used a tool; a hosted QR page you created for as long as it stays in use; checker results for up to 24 months, of which the first 30 days serve as a cache for repeat checks of the same profile. We delete sooner on request.
• Guest feedback and scan data (Section 3.6): For as long as the business uses the service, and deleted within 12 months after it ends or on the business's instruction
• Staff Checklist waiting list: Your email address until the email announcing the product's launch, and deleted within 30 days after it unless you have become a client
• Enquiries and audit requests sent through our forms, and our notifications about them: For 12 months after our last contact, unless you become a client
• Suppression list (opt-out records): Retained indefinitely to ensure we do not re-contact individuals who have opted out

After the applicable retention period, personal data is securely deleted or anonymised.

10. Your Rights

Under the GDPR and UK GDPR, you have the following rights in relation to your personal data:

• Right of Access (Article 15): Request a copy of the personal data we hold about you
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete data
• Right to Erasure (Article 17): Request deletion of your personal data, subject to legal obligations
• Right to Restriction (Article 18): Request restriction of processing in certain circumstances
• Right to Data Portability (Article 20): Request transfer of your data in a machine-readable format
• Right to Object (Article 21): Object to processing based on legitimate interest, including direct marketing. Where you object to processing for direct marketing purposes, we will cease processing without delay.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal
• Automated Decisions (Article 22): We make no decisions about you based solely on automated processing that produce legal or similarly significant effects; the automated review assessment in the removal checker concerns reviews, not you, and a person can be asked to look at it

To exercise any of these rights, contact us at contact@itnest.agency. We will respond within one month of receipt. In complex cases, this may be extended by a further two months, and we will inform you of any such extension.

10.1 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. Relevant authorities include:

• UK: Information Commissioner's Office (ICO) – ico.org.uk
• France: Commission Nationale de l'Informatique et des Libertés (CNIL) – cnil.fr
• Ireland: Data Protection Commission (DPC) – dataprotection.ie
• Sweden: Integritetsskyddsmyndigheten (IMY) – imy.se
• Croatia: Agencija za zaštitu osobnih podataka (AZOP) – azop.hr
• Portugal: Comissão Nacional de Proteção de Dados (CNPD) – cnpd.pt
• Poland: Prezes Urzędu Ochrony Danych Osobowych (UODO) – uodo.gov.pl
• Indonesia: Personal Data Protection Authority – kominfo.go.id
• Thailand: Personal Data Protection Committee – pdpc.or.th
• Uzbekistan: Personal Data Protection Agency
• Kazakhstan: Personal Data Protection Committee

Or any other supervisory authority in the EEA member state of your habitual residence, place of work, or place of the alleged infringement.

10.2 Opting Out of Marketing Communications

You can opt out of marketing emails at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Replying to the email with "unsubscribe" or "stop"
• Contacting us at contact@itnest.agency

We will process your opt-out request within 48 hours. Please note that even if you opt out of marketing communications, we may still send you transactional and service-related emails necessary for the performance of our contract with you.

11. Data Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS/SSL), access controls limiting data access to authorised personnel, secure credential storage (Bitwarden, EU servers), regular review of security practices, and third-party service providers selected for their security standards. However, no method of transmission over the internet or electronic storage is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

12. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will take steps to delete such information promptly.

13. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

14. UK GDPR and PECR

If you are located in the United Kingdom, your personal data is protected under the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations 2003 (PECR). You have the same rights as set out in Section 10 above. Under PECR the consent rule for marketing emails (Regulation 22) protects individual subscribers. We do not send unsolicited marketing emails to individual subscribers, including sole traders and some partnerships, without their prior consent.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website with a revised "Last Updated" date. Where required by law, we will provide additional notice (such as by email). Your continued use of our services after changes does not constitute automatic consent to the updated policy where consent is the relevant legal basis for processing.

16. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: contact@itnest.agency
Company: IT Nest Limited
Registered Address: Office 3906, 39/F, The Center, 99 Queen's Road Central, Central, Hong Kong
UK correspondence address: 66 Paul Street, London, EC2A 4NA, United Kingdom

EU Representative (Article 27 GDPR):
Prighter Group GmbH – https://app.prighter.com/portal/15136688062

UK GDPR enquiries:
For UK GDPR matters, please contact us directly at contact@itnest.agency or our UK correspondence address above.