LEGAL

Service Privacy Notice

Version pcba-cost-estimate-service-privacy-2026-09-14 · Effective September 14, 2026

Schedule 1 Service Privacy Notice

This notice explains how NEXIOT handles Personal Data for the PCBA Cost Estimate Service. It applies to Service Administration Data for which NEXIOT determines the purposes and means of processing as an organisation under the PDPA and, where applicable, a controller under the GDPR or a business under the CCPA. For Customer Personal Data processed on a Customer's instructions, clause 9 applies; we assist that Customer with individual requests. We remain responsible for any duties that apply directly to us in either role.

A Information and sources

A.1 We collect contact and request details, including name, business email, optional company name, country or region, optional city, requested quantity and enquiries; submitted project content and results, including file names, hashes, extracted information, analysis and estimates, which may contain Personal Data; and Service records, including submission times, IP address, browser information and the document versions accepted at upload.

A.2 Information comes directly from you, automatically from Service interactions, from files and communications supplied by you or your authorised colleagues, and, when used, through a Connected Platform. A Connected Platform may separately collect account, conversation and usage information under its own privacy notice. Files uploaded through the Service's embedded interface are submitted to NEXIOT; content separately entered or attached to the platform is handled by that platform. We generate analysis and estimates from submissions and supplier-pricing information. Clause 9 governs Customer Personal Data within those inputs and Outputs.

A.3 Business contact details and the requested technical information are needed to process the request; company name and city are optional. Without necessary information, we may be unable to provide an estimate or requested assistance. Please keep your details accurate. The minimisation and sensitive-data restrictions in clause 4.2 apply.

B Purposes recipients and shared safeguards

B.1 NEXIOT processes Service Administration Data to deliver and communicate about your requested estimate, respond to requested assistance, maintain and troubleshoot the Service, detect misuse and security incidents, evidence acceptance, answer privacy requests and complaints, meet applicable legal duties and handle legal claims. Processing must be necessary and proportionate to the relevant purpose. The Permitted Purpose in clause 5.1 sets the overall limits; it does not supply a lawful basis for every kind of Personal Data processing.

B.2 Clauses 5 and 6 identify the permitted recipients, task-specific disclosure limits and prohibitions on marketing, sale, advertising and model training. A Connected Platform may receive the limited account, instruction, status and result information needed to invoke and display the Service, but NEXIOT does not send the original engineering package to the platform through the connected Service. Clauses 8, 10 and 11 explain security, retention and international processing. Professional advisers and public authorities receive information only as lawfully permitted or required under clause 5.4.

B.3 We will give any additional notice, establish a valid legal basis and obtain consent where required before a new purpose begins. Neither acceptance of these Terms nor a later notice update retrospectively authorises an incompatible use of data already collected.

C Cookies and automated analysis

C.1 Where we use cookies or similar technologies, we will identify their purposes, providers and duration and provide legally required choices before use. Non-essential technologies will not operate before consent where consent is required. Browser controls may also block or delete cookies, although blocking necessary technologies can affect the Service. Providers are not permitted to track Service users across unrelated websites for their own advertising purposes.

C.2 Automated file analysis generates a preliminary technical and cost estimate about the submitted project. When you use a Connected Platform, limited status, confirmation fields and aggregate results may be displayed through that platform. The Service does not make a solely automated decision about an individual with legal or similarly significant effects. You may question a result or request a reviewed quotation through the Service.

D Singapore PDPA

D.1 We notify individuals of the purposes of collection, use and disclosure and obtain consent where the PDPA requires it. Deemed consent is relied on only where its statutory conditions are met. Processing without consent occurs only where the PDPA or another written law permits or requires it and the relevant conditions are satisfied. We do not condition the Service on consent to purposes beyond what is reasonable for providing it.

D.2 You may withdraw consent, including deemed consent, by giving reasonable notice to the Data Protection Officer in clause 14.1. We will explain the likely consequences and when withdrawal takes effect. Withdrawal may prevent completion of an estimate or assistance. We and our data intermediaries and agents will stop the affected processing unless processing without consent is legally permitted or required; lawful retention remains subject to clause 10.

D.3 Subject to statutory exceptions, you may request access to your Personal Data and information about how it has been or may have been used or disclosed in the preceding year, and correction of errors or omissions. We provide access as soon as reasonably possible and make corrections as soon as practicable. If we cannot respond to an access or correction request within 30 days, we will notify you in writing within that period when we expect to respond.

D.4 We may charge a reasonable access fee after providing a written estimate and obtaining your agreement; corrections are free. We will explain any refusal as required, preserve relevant data where the law requires, and send corrections to previous recipients where required. We consider deletion requests under the PDPA and our retention duties; the PDPA does not give an unrestricted erasure right. You may complain to Singapore's Personal Data Protection Commission at www.pdpc.gov.sg. These fee rules do not override another applicable law's requirement to handle a request free of charge.

E European and UK privacy rights

E.1 Where the GDPR or UK data protection law applies to NEXIOT's independent processing, the legal bases are as follows. For a requested service where you personally are the contracting party, necessary processing to perform that contract or take requested pre-contract steps relies on Article 6(1)(b). For representatives of business customers, necessary service communications and relationship management rely on Article 6(1)(f), reflecting our and the Customer's legitimate interests in delivering the requested business service.

E.2 Necessary Service operation, security, troubleshooting, acceptance records and legal claims rely on Article 6(1)(f), reflecting our interests in a reliable and secure Service and protecting legal rights. We assess whether individuals' interests and fundamental rights override those interests before relying on them. Article 6(1)(c) applies only to a binding obligation under applicable EU or Member State law, or UK law for UK processing; a foreign legal demand alone is not sufficient. Article 6(1)(a) applies to a specified optional activity where we request consent. Consent may be withdrawn at any time without affecting earlier lawful processing.

E.3 Subject to legal conditions and exceptions, you may access and obtain a copy of your data, correct it, seek erasure or restriction, and obtain data you supplied in a portable format where processing is automated and based on consent or contract. You may request direct transfer to another controller where technically feasible. You may object to legitimate-interest processing on grounds relating to your situation; we will stop unless we establish overriding compelling grounds or the processing is necessary for legal claims. Any direct-marketing objection will be honoured without that balancing test.

E.4 We respond without undue delay and normally within one month. Where legally permitted because of complexity or the number of requests, we may extend by up to two further months and explain why within the first month. Requests are normally free; a fee or refusal is possible only where the law permits, including a manifestly unfounded or excessive request. Identity checks must be proportionate. We will explain a refusal and available remedies.

E.5 Contact the Data Protection Officer under clause 14.1. You may complain directly to the supervisory authority in the EEA country of your habitual residence, workplace or the alleged infringement, or to the UK Information Commissioner's Office where applicable. You need not contact us first. Where legally required, NEXIOT will appoint an EEA or UK representative and publish the representative's identity and contact details with this notice before the relevant processing begins.

F California disclosures and rights

F.1 This section applies where the CCPA governs the processing, including covered business-contact information. The table identifies collection categories and recipients for business purposes. Sources are in section A, purposes in section B, and retention periods and criteria in clause 10; those provisions apply to each relevant category. We disclose only the minimum information allowed by clause 6. We will maintain the historical category disclosures required for the preceding 12 months in the notice published with the Service and update them at least annually.

F.2 The sale, sharing and other use prohibitions in clause 5.2 apply to all Personal Data, including data of individuals under 16. We do not use sensitive Personal Data to infer characteristics about people. Incidental sensitive information is handled only within uses permitted by the CCPA and any stricter applicable law. We do not offer financial incentives for Personal Data.

F.3 Subject to applicable exceptions, you may request the categories and specific pieces of Personal Data collected, sources, purposes and categories of recipients; obtain a portable copy; and request correction or deletion. You have rights to opt out of sale or sharing and to limit use and disclosure of sensitive Personal Data where those rights apply. We will not unlawfully discriminate or retaliate because you exercise a privacy right.

F.4 Send requests to the Data Protection Officer's email or postal address in clause 14.1, or through additional designated methods published with this notice where required. NEXIOT will provide a website request method and a toll-free telephone method if required by the CCPA; the email-only exception will be used only where the business operates exclusively online and has a direct relationship with the relevant consumer. You may use an authorised agent as permitted by law. We may proportionately verify identity and agent authority for requests requiring verification, without requiring you to create an account. Opt-out requests do not require identity verification.

F.5 We acknowledge requests to know, delete or correct within 10 business days and respond within 45 calendar days. A legally permitted extension may add up to 45 calendar days, with notice and reasons within the initial period. Applicable sale-or-sharing opt-outs and sensitive-information limitation requests will be implemented as soon as feasible and no later than 15 business days, or sooner if the law requires. Requests are free except where the CCPA expressly permits a fee. We will explain any refusal or applicable exception and provide required information about complaints.

F.6 We recognise Global Privacy Control and other legally required opt-out preference signals. Under the practices stated in this notice there is no sale, advertising sharing or targeted advertising to stop. Conventional Do Not Track browser signals do not change processing necessary to provide the Service. You may complain to the California Privacy Protection Agency or California Attorney General.

G Other applicable rights and updates

G.1 Where another applicable US state law gives you privacy rights, we will honour those rights and the applicable verification, response, appeal and opt-out requirements. Send requests or appeals to the Data Protection Officer using clause 14.1. We will explain any refusal and, where required, how to contact the competent authority.

G.2 We publish the current notice and its effective date with the Service and review it regularly. We will notify material changes and obtain fresh consent where required. Changes do not retrospectively authorise incompatible processing. Questions and complaints may be sent to the Data Protection Officer.

Connected platform implementation details

The following operational details supplement Schedule 1 for plugin sign-in and connections to platforms such as ChatGPT and Claude.

Plugin sign-in and account linking

When you sign in to the plugin, we use your email address to send a one-time verification code and derive a keyed identifier that links your account to its estimates. The plugin login database does not retain your raw email address; contact details you separately provide with a submission are stored with that submission. A keyed identifier remains linkable to your activity and is not treated as anonymous data.

We store encrypted authentication records separately from estimate records. These include the connecting client's identifier and callback details, authorized permissions, account-to-estimate links, token verification records, expiry times, and security and rate-limit records derived from email or IP addresses. We use necessary cookies to secure sign-in and maintain access to uploads and results. These records and cookies support authentication, access control, and abuse prevention, not advertising or marketing enrollment.

Verification emails

We use Google Workspace SMTP relay to deliver sign-in codes from notifications@nexpcb.com. Google receives the recipient email address, the code message, and delivery-related information needed to send the email. The verification email does not include your engineering files or estimate report. The code should be entered only on the NexPCB sign-in page, not in ChatGPT, Claude, or a support message.

Connected platforms and estimate information

When you authorize ChatGPT, Claude, or another supported client, that client receives an OAuth authorization code and access credentials to use the permissions shown during connection. These authorization credentials are exchanged through the sign-in protocol, not returned as estimate content. The client can request processing status, manufacturing parameters requiring confirmation, quantity and currency, aggregate cost ranges, component identities and coverage, file-check findings, request status, and protected estimate references or links needed to display and reopen your estimate. These are associated with your use of the Service and may be processed by the connected platform under its own privacy notice and account settings.

Files selected through the NexPCB secure upload card are sent to NEXIOT storage, including direct upload to our Amazon S3 storage in Singapore, rather than attached to the chat by the plugin. This does not cover files or other information you independently send to a chat platform. The upload form sends contact details and acceptance records to NEXIOT. Keep estimate and upload links private because they can grant access to the associated workflow or result.

International processing and authentication retention

Customer Files, core Service data, and the plugin authentication database remain hosted in Singapore. Google Workspace, connected platforms such as ChatGPT and Claude, and customer-contact, analysis, and pricing providers may process the limited data described in Schedule 1 in locations where they operate. Singapore hosting therefore does not mean that every service-provider or connected-platform activity occurs only in Singapore.

Plugin email codes are valid for up to 10 minutes and may be used only once. Access tokens are valid for up to one hour; a connection's refresh credentials expire after up to 30 days unless revoked earlier. Account-to-estimate link records expire after 31 days. Expired authentication records are rejected for access and removed during subsequent authentication or security requests, rather than necessarily being deleted at the exact expiry time. Client registration records may remain while the integration is supported. Email providers and connected platforms apply their own retention policies to the data they receive.

Disconnecting and privacy requests

You can disconnect the plugin using the connected platform's settings and contact us to request revocation of NEXIOT-side access or deletion of your records. Disconnecting a client does not by itself delete submitted files, estimates, acceptance records, information already received by that platform, or previously issued result links. Tell us separately if you need those records or links removed or access disabled. We may need to verify your identity before acting; do not send passwords or verification codes with your request.

Contact

NEXIOT PTE. LTD.
UEN: 202312306Z
36 ROBINSON ROAD, #21-01, CITY HOUSE, SINGAPORE 068877
pcba.estimate@nexiot.sg