NemkiBI
NemkiBI
This policy explains how personal data collected through this website and in connection with the NemkiBI software subscription is processed, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
Controller: BI Analytics Labs 42, S.L.
Tax ID (CIF): B71564090
Registered address: Pl. del Arga, 2, 4.º A, 31600 Burlada, Navarra, Spain
Email: privacy@nemkibi.com
There is no obligation to appoint a data protection officer, and none has been appointed. For any privacy matter please write to the address above.
| Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|
| Responding to enquiries received by email or contact form | Name, email address and the content of the message | Consent of the data subject (Art. 6(1)(a) GDPR) and pre-contractual measures at the data subject's request (Art. 6(1)(b) GDPR) | For the duration of the exchange and up to 1 year thereafter, unless a legal retention obligation applies |
| Managing the licence, software activation and technical support | Name, email address, country, licence identifier and technical data about the installation | Performance of the licence agreement (Art. 6(1)(b) GDPR) | For the term of the subscription and 5 years thereafter, for potential contractual liabilities |
| Complying with tax and accounting obligations | Identification and billing data | Legal obligation (Art. 6(1)(c) GDPR) | 6 years under the Spanish Commercial Code and 4 years under tax legislation |
| Sending commercial communications about product updates and news | Name and email address | Express consent, or legitimate interest in respect of existing customers for similar products (Art. 21(2) LSSI) | Until unsubscribe is requested |
| Analysing use of the website through analytics cookies | Browsing data and device identifiers | Consent of the data subject (Art. 6(1)(a) GDPR) | As set out in the cookie policy |
All data requested is necessary for the purpose indicated in each case. If it is not provided, the corresponding enquiry cannot be answered or the service cannot be provided.
Data is obtained from the data subject, either because they provide it directly when writing or subscribing, or because it is generated while using the software and the website. It may also come from Creem (Armitage Labs OÜ), which passes on the identification data required to activate the licence after a purchase.
No personal data is disclosed to third parties except where legally required. The following providers are involved, acting as processors under the corresponding agreement pursuant to Article 28 GDPR, or as independent controllers where applicable:
| Provider | Service | Location |
|---|---|---|
| Netlify | Website hosting and content delivery | United States and global network |
| Zoho Mail (Zoho Corporation B.V.) | European Union | |
| Modal Labs, Inc. | Compute infrastructure on which the controller runs the model for the free cloud mode. Execution region pinned to the European Union. | European Union (pinned region); parent entity in the United States |
| Creem (Armitage Labs OÜ) | Sale, payment collection and invoicing of subscriptions, acting as seller and as an independent controller of payment data | Estonia (European Union) |
| Google Fonts | Web font service. When the fonts load, the visitor's browser discloses its IP address to Google. This can be avoided by self-hosting the fonts. | United States |
The controller never has access to the user's full bank card details, which are processed directly by the payment provider.
Some of the providers listed are located outside the European Economic Area or may access data from third countries. In those cases, the transfer relies on one of the safeguards set out in Chapter V of the GDPR: an adequacy decision of the European Commission, the provider's certification under the EU-US Data Privacy Framework, or the signature of standard contractual clauses together with any necessary supplementary measures.
NemkiBI is a desktop application that runs on the user's own computer and operates on Power BI report files stored locally. Neither the content of those reports nor the business data they contain is stored on the controller's systems.
The application offers three AI processing modes, and the choice determines what information leaves the computer. Users should understand the difference before working with confidential data:
| Mode | Where processing takes place | What leaves the computer |
|---|---|---|
| Local model ("Local AI") | On the user's own computer | Nothing. No transmission occurs. |
| User's own AI ("Cloud AI") with their own credentials |
On the servers of the artificial intelligence provider the user has contracted (Gemini, ChatGPT, Claude or another) | The fragments needed to handle the request. The user configures the endpoint, model and API key; the relationship is between the user and their provider and is governed by that provider's terms, outside the controller's control. |
| Free cloud model ("Free Cloud AI") | On servers operated by the controller on Modal Labs infrastructure, with the execution region pinned to the European Union | The fragments needed to handle the request: table, column and measure names, DAX or Power Query M expressions, report structure, and the text the user types into the chat. |
About the free cloud model. It is offered as a convenience so that users can start without configuring anything. Unlike the local mode, it does involve transmitting report information outside the user's machine, to the servers where the controller hosts the model.
The model used is Mistral Small, an open-weight model distributed under the Apache 2.0 licence which the controller hosts and runs itself. No artificial intelligence model provider acts as an intermediary: requests are not sent to any third-party AI company. Compute infrastructure is supplied by Modal Labs, Inc., acting as a processor, with its execution region pinned to the European Union.
Requests are not used to train or improve any model, either by the controller or by third parties. They are processed to generate the response and are not retained afterwards.
Users working with confidential information, information subject to professional secrecy, or information covered by confidentiality agreements with third parties are advised to use the local model or their own credentials instead of the free cloud model. The active mode can be changed at any time in the application settings.
The controller does not access the content of requests sent to the free model and does not retain copies of them. Only the licence identifier and the number of requests made are logged, for quota control and billing purposes, without their content.
No automated decisions are taken and no profiling is carried out that produces legal effects concerning the data subject or similarly significantly affects them.
Appropriate technical and organisational measures have been adopted to ensure a level of security appropriate to the risk, including encrypted transmission over HTTPS, access control to systems, and the selection of providers offering sufficient guarantees under Article 28 GDPR.
You may exercise the following rights at any time by writing to privacy@nemkibi.com, stating the right you are exercising and enclosing a copy of a document proving your identity:
A response will be provided within a maximum of one month, extendable by a further two months where the complexity of the request so requires. Exercising these rights is free of charge.
If you consider that the processing does not comply with applicable law, you may lodge a complaint with the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid, or through its electronic office at www.aepd.es. Users resident in another Member State may also contact their own national supervisory authority.
This policy may be updated to reflect legislative changes or new processing activities. The version in force will always be the one published on this page, showing the date of its last update.
This document is published in Spanish and English. In the event of any discrepancy between the two versions arising from translation, the Spanish version shall prevail, without prejudice to the rights that data protection and consumer legislation grant to users.