Data Protection & Data Footprint

Licensing and Billing Communication

Once per day, the product sends limited licensing data to our licensing server hosted at https://nuvens.info via a secure API call. The following information is transmitted:

• License Number

• Product Version

• Count of Licenses in Use

This data is used strictly for licensing validation and billing purposes.

Nuvens stores the following customer information for licensing and account management purposes:

• License Number

• Company Name

• Contact Name

• Contact Number

• AWS Marketplace ID

• Number of Licenses Purchased

• Number of Licenses in Use

• Last Bill Date

• Version Installed

• Date of Signup

IP-based Geolocation Lookup (Third-Party API)

WorkSpaces Manager can display approximate login-location information based on the source IP address associated with a WorkSpaces connection event.

When this feature is used, the customer-hosted WorkSpaces Manager appliance sends the source IP address to Nuvens services. Nuvens uses MaxMind GeoIP services to resolve approximate geographic metadata, such as country, region, city, latitude/longitude, and accuracy radius where available. The result is returned to the customer-hosted appliance and displayed in the WorkSpaces Manager UI.

MaxMind API credentials are held only within Nuvens-managed services and are not stored in, exposed to, or distributed with the customer-hosted appliance.

IP geolocation is approximate and should not be treated as a precise physical location, street address, or identity verification control.

What Is Collected and Sent

When a location lookup is required, WorkSpaces Manager sends the source IP address associated with the relevant WorkSpaces login or connection event to a Nuvens-hosted geolocation lookup service.

Nuvens uses a third-party IP geolocation provider to resolve non-precise geographic metadata. The lookup may return:

• Country, region, and city

• Approximate latitude and longitude

• Time zone

• Network metadata, such as ISP or ASN, where available

The geolocation lookup uses only the source IP address required to infer these attributes. No device identifiers, GPS data, precise physical addresses, browser location data, or operating system location data are requested or transmitted.

MaxMind API credentials are held only within Nuvens-managed services and are not stored in, exposed to, or distributed with the customer-hosted appliance.

Purpose of Use

This geographic context is used to support:

• Login-location visibility within the WorkSpaces Manager UI

• Regional reporting and analytics

• Security monitoring and anomaly detection

• Operational troubleshooting

• Compliance or policy review where regional context is relevant

IP geolocation provides an approximate location only. It does not determine an exact physical location, street address, household, or user identity. Results may be affected by VPNs, proxies, mobile networks, corporate networks, ISP routing, and other network configurations.

Data Protection and Handling

Only the source IP address required for the lookup is sent to the Nuvens API and then to MaxMind GeoIP services.

The lookup is performed in real time. Nuvens does not store, cache, retain, or log the source IP address or the geolocation result as part of this lookup process. The resulting approximate geographic metadata is returned to the customer-hosted WorkSpaces Manager appliance for display in the UI.

Nuvens does not use the lookup results to create or maintain a standalone IP geolocation database.

IP addresses and derived geolocation metadata may be considered personal data under GDPR and UK GDPR when combined with other identifiers. For this reason, the lookup process is designed to minimise data processing and avoid storage, caching, retention, or logging by Nuvens

MaxMind API credentials are held only within Nuvens-managed services and are not stored in, exposed to, or distributed with the customer-hosted appliance.

All calls between the customer-hosted appliance, Nuvens services, and the geolocation provider are made over secure HTTPS.

This service is optional and distinct from explicit user location permissions, such as browser, device, GPS, or operating system location services.