PRIVACY STATEMENT EXTERNAL WEBSITES 2026 NLIGHTEN

GENERAL

The companies listed under the “Contact” section (hereinafter: “the organisation”, “we” or “us”) may collect your personal data when you use our products or services, visit our websites, order or purchase services, use our app(s),) or when you contact us. This Privacy Statement applies to the collection and processing of the personal data of visitors to our data centers and our customers of our products, services, websites, social media channels and apps (hereinafter: “you”).

Protecting the privacy and security of your personal data is very important. We process your personal data in accordance with the EU and UK General Data Protection Regulation and/or local privacy laws (if applicable).

We may change this Privacy Statement from time to time. You can always request the previous version of the Privacy Statement from our Group Privacy contact person. We recommend that you visit this website regularly to determine whether you have the most recent version of the Privacy Statement, and that you do so each time you share your personal data with us.
This Privacy Statement was last modified in July 2026.

THE ORGANISATION’S PRIVACY PRICIPLES

We handle data protection and privacy in accordance with the following privacy principles:

1. We have experience in processing personal data. We adhere to strict legal requirements. We process certain personal data and do not store it longer than necessary. We are open and clear about this in our privacy statement.
2. We have strict rules for processing personal data, and we regularly check how the rules work. We process personal data that is relevant and necessary to serve our customers and to be a good employer for our employees. We decouple personal identification data from personal data as soon as this is possible and permitted when we use it for data analysis. We use information obtained from data analysis to improve our products and services and to provide our customers with targeted information about our products and services.
3. We have taken appropriate organisational and technical (security) measures for the processing of personal data of customers, suppliers and employees. Only persons with the correct authorization have access to personal data. If we involve external parties, we do so only after we have made good agreements about the secure processing of personal data. We take measures to prevent data leaks. If a data leak does occur, we will inform the persons involved and the supervisory authority where necessary.
4. The organisation strives to provide transparent, clear information about which personal data we process, why this is necessary and how we handle it. We help customers, employees or other stakeholders who want more insight or information.

WHO IS RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA?

We are responsible for the processing of your personal data. Our contact details can be found at the end of this Privacy Statement, under the section “Contact”. In many cases, we qualify as a processor on behalf of one of our customers. In that case, it is best to contact our customer directly.

WHY DO WE COLLECT YOUR DATA?

nLighten is an organisation that values data protection and privacy. In the area of privacy and protection of personal data, a data center provider, such as nLighten, can be seen as a real estate manager. Our activities can be compared with renting out a space. In that space, our organisation supplies electricity, security and air conditioning. nLighten does not have access to the data in that space. nLighten does not know what our customers do on their servers. That is the responsibility of the customer.

On the other hand, nLighten does process personal data for itself, for example: administering personal data of employees, keeping a log of visitors who were granted access to a rack space in a data center or processing personal data of job applicants, customers and suppliers. The GDPR applies in full to these latter processing operations. That is why nLighten has decided to establish its privacy compliance by means of a Privacy Policy and various Privacy Procedures that apply all nLighten entities. It establishes how nLighten handles personal data and what employees must adhere to when processing personal data within the organisation. We collect the following personal data:

• To access to our data centers
• To offer you our products and services
• To provide you with the use of our products, services, websites and apps
• To send you our email newsletter
• To promote effective security policies at our locations and hosted environments (for example by using access control, implementing camera surveillance or recording incidents)
• To comply with legal obligations to which we are subject
• To manage your requests and questions
• To invite you to participate in research relating to us, provided you have chosen to be contacted by us

WHAT PERSONAL DATA DO WE COLLECT FROM YOU?

We may process the following items of your personal data:

• name, email address, address, telephone number
• date and place of birth, gender
• nationality
• security camera footage
• Audio recordings of customer service for training and quality improvement purposes
• if applicable: transaction data, such as bank account, type of debit or credit card, part of the card number, expiry date, location of the store, time of purchase, country of origin of the credit/debit card. When you pay online, the IP address of your mobile device or your computer

NEWSLETTERS AND OTHER COMMERCIAL COMMUNICATIONS

After your consent, we will inform you about new products, specials and other promotional activities by sending you our newsletter. All our customers receive our newsletters, release updates and other mailings such as invitations to events and surveys. This is necessary to keep our customers informed. You always have the possibility to unsubscribe from further commercial communications from us by clicking on the ‘unsubscribe’ link at the bottom of the relevant e-mail, by contacting our Customer Service or by indicating this in writing to our Customer Service using the postal address at the end of this Privacy Statement.

When you unsubscribe from commercial communications from us, we will remove you from the mailing list as soon as possible. The fastest and automated way to unsubscribe is to click on the ‘unsubscribe’ link at the bottom of the email.

HOW DO WE COLLECT YOUR PERSONAL DATA AND FOR WHAT PURPOSE?

• To deliver our data center solutions: When you place an order through our products, services, website(s) or apps, we collect your name, email address, billing information and billing address to complete and deliver our service to you. We may also provide you with the option to store your credit card information in an encrypted form. If you choose to receive a digital invoice when purchasing one of our products or services, we may collect your email address and a record of the items you purchased.
• Camera surveillance at our data centers and our offices: we use security cameras to ensure your safety and the safety of our employees at our data centers and our offices and to comply with legal obligations. You will be informed about the cameras upon entering the office and the cameras are clearly visible. The camera images are stored for at least 24 hours, if possible, for a maximum of 1 week, if necessary for a maximum of 4 weeks, unless an incident has occurred, in which case the period is extended under strict conditions. Only a limited number of trained employees have access to surveillance images. The images can be provided to the police and the judiciary in the event of an incident.
• Contacting Customer Service: If you contact our customer service, we collect your name, email address (and any additional information you provide to us), the content of correspondence and call notes and call recordings in the case of telephone contact in order to respond to your questions or comments, to provide better service and for training purposes.
• Applying for a job: If you apply for a job with us, we will collect your name, email address, phone number, resume, photo and cover letter. All this in accordance with our privacy statement for job applicants which can be found on our website.
• Write an online review: When you write a review, you can always do so anonymously or under your own name.
• We may personalize our services by creating a marketing profile. We do not make important decisions based on automated decision-making. This means that the way in which we compile your profile does not have significant legal implications for you. We do not use special personal data for marketing purposes. We can create marketing profiles of our customers because this is necessary to optimize our activities and to offer you better offers and services. For example, we use your feedback, information about your orders and the use of our services to make your experience while using our products and services as good as possible. We use this data to personalize our products and services and to recommend products that you may be interested in. We can also use this data to find patterns that can be used to further optimize our marketing. We process data about your online behaviour on our services, media and e-mail data for business intelligence purposes, to improve our products and services. We can also store data that we have received from third parties (including other companies) in our platform. When you log in to our products, services, websites and apps, we may link this data to your customer ID. The sources from which we collect data change regularly. If you want to know which sources we currently use, you can contact us at the address indicated in the section “Contact”. By using a data management platform, we can improve our products and services and show our customers specific (targeted) information about our products and services, or products and services of other companies. We never sell your personal information to third parties. We have also set up our systems in such a way that the accuracy of personal information is guaranteed. We have taken the usual technical and organisational security measures to protect your data. If you want to be removed from the data management platform or want to opt out of targeting, you can send a request to the address indicated in the section “Contact” below.
• We use our own technologies and technology service providers to better understand the needs of the users of our products and services in order to optimize our products and services and experience (e.g. how much time you spend on which pages, which links you click, what users like and don’t like, etc.) and this enables us to build and maintain our service with user feedback. In this context, we use cookies and other technologies to collect data about the behaviour of our users and their devices. This may include a device’s IP address (e.g. processed during your session and stored in an anonymized form), device screen size, device type (unique device identifiers), operating system, browser type, geographic location (country only), the preferred language used to display our products and services, mouse events (movements, locations, clicks), keystrokes, referring URL and domains, pages visited, date and time our pages were visited. You can generally prevent some data from being collected automatically by disabling cookies in your web browser. See also our Cookie Statement.
• We use technology service providers such as Google to collect and display detailed statistics of our products, services and websites. The purpose of this service is to give us a clear overview of visitor flows, traffic sources and page views. Based on this information, we can improve our products, services and websites and improve your user experience on our products and services.
• We may engage in interest-based advertising. As described above, we may automatically collect information about how you use applications, products and services, and visit websites to enhance your customer experience, improve our customer service, and provide you with communications and promotions from us or others. The purpose of interest-based advertising is for the organisation or its advertising partners to show you advertisements that are more relevant to your interests. You may limit the organisations and our partners’ ability to collect and use your information for these purposes. To opt out of interest-based advertising, please click on our Cookie Statement at the bottom of the page on this website. You may opt out there.
• If applicable: Payments and fraud prevention: When you pay for a product or service, your debit or credit card purchases are processed by a payment provider. This information is used to process your order. We may also use your information for analysis and optimization purposes (on an aggregated level). The information may also be used to identify and detect/prevent fraud.
• If applicable: Creating a User or Online Account: If you can create a user or online account to use our products, services and on our websites or apps, we collect your personal information on a secure server. You will be asked to enter your name, email address, billing information and password to place orders for our products and services. We store your billing and shipping address so that you do not have to enter this information for any future purchases.

SOCIAL MEDIA

When you participate in social media, such as Instagram, LinkedIn, Facebook, Twitter/X, Pinterest, you should be familiar with and understand the tools provided by those sites that allow you to make choices about how you share the personal information in your social media profiles. We are bound by the privacy practices and policies of these third parties, so we encourage you to read the applicable privacy notices, terms of use, and related information about how your personal information is used in these social media environments. Depending on the choices you have made with respect to your settings on various social media sites and in combination with your settings on our products, services, websites and apps, certain personal information may be shared with us about your online activities and social media profiles, for example through Facebook Connect or Google Connect. If you do not want us to share your personal information with a social media site or application, you should not access such social media site or social media application. For example, you should not click a “like” button on a product detail page.

LEGAL BASES

The legal bases for processing this personal data (depending on the person and the circumstances) are:

• Use of information based on your consent: If you have not purchased a product or service from us, we will only send you direct marketing communications (such as newsletters, promotions, product news or service updates) via email, other electronic means, via telephone or via hard copy post (such as flyers) after we have received your consent to do so. You can withdraw your consent at any time via the unsubscribe link at the bottom of our emails or see the Your Privacy Rights section below.
• Our legitimate interests: We use your personal data both on an aggregated and individual basis for the use and marketing of our products and services, to contact you via email, social media or otherwise for interest-based advertising or other commercial purposes. We may also use your personal data to create a marketing profile for the purpose of analysing and improving the quality of our products and services, to assess what may interest you, to measure or understand the effectiveness of improvements and advertising we provide to you and others, and to deliver relevant advertising. We may also use your personal data for our other legitimate interests, such as to operate and expand our business activities; to develop, improve or modify our products and services; to ensure network and information security; to generate aggregated statistics about the users of our products and services; to facilitate our business operations; to operate company policies and procedures; to enable us to make corporate transactions, such as a merger, sale, reorganisation, transfer of our assets or businesses, acquisition, bankruptcy or similar event; or for other legitimate purposes permitted by applicable law. By this we mean a legitimate interest as described in Article 6, paragraph 1, subparagraph f of the EU General Data Protection Regulation. We have carried out a balancing test to weigh our legitimate interests (as described above) against your interests, rights and freedoms. We believe that the processing is necessary to achieve our interests. It is relevant to note that the interference with your privacy rights and freedoms is kept to a minimum as we use pseudonyms, aggregates and other Privacy by Design principles where possible. We have a policy to monitor and continually improve this. Our internal audit will oversee this. Only a limited number of employees have access to your personal data, only when necessary to perform their duties. We have carefully secured your personal data (see ‘How we protect your personal data’ below). In view of the above, we believe that there are no interests, rights or freedoms that are more important to you than our legitimate interest in conducting our business in the best possible way.
• To comply with our legal obligations: Personal data that we collect may be used to comply with a legal obligation to which we are subject, such as regulators, tax authorities or investigative bodies, for example to provide camera images to the police and judicial authorities in the event of incidents.

HOW DO WE PROTECT YOUR PERSONAL DATA?

We have taken technical and organisational measures to protect your personal data against loss or any form of unlawful processing. We protect your personal data using a range of security measures, including secure storage. Our information security policy is based on the ISO 27001 standards and includes regulations on the security of personal data (assignment of responsibilities in job profiles), management of company assets, physical security of the buildings, access control and authorizations for staff members, maintenance and development of systems, disasters, business continuity, monitoring of potential threats (external or internal), monitoring of information security incidents and performing a periodic security audit of the systems.

RETENTION PERIODS

We will only retain your personal data for as long as is necessary for the specific purpose of the data. We will retain marketing-related personal data for 2 years after your last contact with us. Invoices will be retained for at least 7 years, or in accordance with local tax legislation. We will delete personal data sooner if you request us to delete your personal data, unless another law prohibits us from doing so.

DO WE SHARE YOUR PERSONAL DATA WITH THIRD PARTIES?

Our basic principle is that we (a) do not sell your personal data to third parties, (b) only share your personal data with other companies if necessary and (c) store your personal data in Europe. However, in some cases we need to share your data with third parties, for example in the context of the performance of a contract, to help us provide our products and services or to send marketing messages, including:

• business partners, suppliers (such as IT service providers) and subcontractors, or in the event of a sale of (part) of our business;
• contact centers, to assist us with customer service;
• analytics and search engine providers that assist us in improving and optimizing our products, services, websites and apps;
• advertising and media companies that carry out marketing and media activities on our behalf.

We sign a Data Processing Agreement with these companies. If our suppliers or third parties we work with are located in a country outside the European Economic Area (EEA) or store their data outside the EEA, we have an agreement with these parties to protect privacy in a way that is comparable to data protection in the EEA, such as the EU Standard Contractual Clauses, because the data protection regulations in these countries do not always offer the same level of protection as within the EEA. We may also provide your personal data to third parties to comply with laws and regulations or in the context of judicial proceedings, a court order or other enforceable title.

YOUR PRIVACY RIGHTS

You have the right at any time to ask us for access to the personal data we have stored about you. You have the right to request:

• access to your personal data (access)
• change or correct your personal data (rectification)
• Request that we delete your personal information (erasure/right to be forgotten). Please note that while we will honor a request to delete information where required by law, in many situations we may need to retain certain personal information to comply with our legal obligations, resolve disputes, enforce our agreements, or for one of our other business purposes.
• restrict the processing of your personal data (restriction).
• to transfer your data to another controller or to yourself, if we process your data based on your consent or based on the agreement you have entered with us (data portability).
• object to the (further) processing of your personal data if we have processed your data based on our legitimate interests (objection).

To ensure that the request for access has been made by you, we ask you to send a copy of your ID with the request. In this copy, black out your passport photo, MRZ (machine readable zone, the strip with numbers at the bottom of the passport), passport number and Citizen Service Number (BSN). This is to protect your privacy. We will respond to your request as soon as possible, but in any case, within four weeks.
If you would like to know more or exercise your rights, please contact us

Minors who provide personal data
The age limit for minors to obtain parental consent is set by each EU Member State and can vary from 13 to 16 years. Minors may only provide us with personal data if they have written permission from one of their parents or a legal guardian.

COMPLAINTS

If you have a complaint about our products or services, please contact us via Customer Service. For contact details, see the “Contact” section below.

If you are not satisfied with the handling of your privacy complaint about the way the organisation processes your personal data, please contact our Group privacy contact person.

If you are still not satisfied with the handling of your privacy request or the way in which the organisation processes your personal data, you can contact the Dutch Data Protection Authority, PO Box 93374, 2509 AJ The Hague. Or in case of the UK you can contact the UK ICO https://ico.org.uk/global/contact-us/contact-us-public/

CONTACT

Edge Data centers
nLighten HQ B.V. (the Netherlands) with its subsidiaries in Belgium, France, Germany, Ireland, Poland, Spain, Switzerland and UK.

Privacy email: privacy@nlighten.com

Address: Koolhovenlaan 120 1119 NH Schiphol-Rijk Netherlands

Customer Service: info@nlighten.com