Privacy Policy
This Privacy Policy explains how by Nu collects, processes, and protects personal data arising from the use of the Plenum product site and the Plenum service. It applies to website visitors, customers, and others who interact with by Nu.
Last updated: 2026-06-28
1. Who We Are and Scope
The controller within the meaning of the Swiss Federal Act on Data Protection (FADP / revDSG) is:
- by Nu
- Ueberlandstrasse 1, 8600 Dübendorf, Switzerland
- Email: hello@bynu.ch
This policy covers the Plenum product site at https://plenum.bynu.ch and the Plenum service at https://app.bynu.ch. Information about the company website is available at https://bynu.ch.
Where visitors or customers are located in the European Union, the General Data Protection Regulation (GDPR) may also apply. An EU representative is not required, as there is no systematic processing of EU data subjects.
2. Our Two Roles
By Nu acts in different legal roles depending on the context. It is important to distinguish between these two roles clearly.
By Nu as Controller
For data that by Nu processes in connection with operating the Plenum product site and the direct customer relationship, by Nu is the controller. This includes account and billing data, support correspondence, website usage, and contact-form submissions.
By Nu as Processor
For attendee and event data that Plenum reads and writes within the customer's HubSpot account, by Nu acts as a data processor on the customer's behalf. The customer is the controller and determines the purposes and means of that processing. This processing is carried out on the customer's documented instructions and is governed by a data-processing agreement, available on request at hello@bynu.ch.
3. Data We Process and Why
In our role as controller, we process the following categories of personal data:
| Data | Purpose | Legal basis |
|---|---|---|
| Account and billing data (name, email address, company details, billing address) | Entering into and fulfilling the contract, invoicing, customer communication | Contract performance (Art. 6(1)(b) GDPR; FADP) |
| Product usage data and logs (technical logs, error reports, session data) | Operating, troubleshooting, securing, and improving the service | Legitimate interest (Art. 6(1)(f) GDPR; FADP) |
| Support correspondence (enquiries by email or via the service) | Handling support requests and customer communication | Contract performance; legitimate interest |
| Website analytics | No third-party tracking tools are used; at most minimal, privacy-friendly review of server logs | Legitimate interest; no consent required as no personal profiling takes place |
| Contact-form submissions (name, email address, message content) | Responding to enquiries submitted via the Plenum product site; transmitted via Web3Forms | Pre-contractual measures; legitimate interest |
4. Swiss Hosting and Where Data Is Stored
The Plenum service is hosted exclusively on servers operated by Infomaniak Network SA in Geneva, Switzerland. All customer data remains in Switzerland. No data is stored in other countries unless expressly stated otherwise in this policy.
Each customer runs Plenum in an isolated container with its own dedicated data volume. This architecture ensures that the data of one customer is never mixed with that of another.
By Nu applies appropriate technical and organisational measures to protect your data against unauthorised access, loss, or misuse. Fonts are self-hosted; no external font services or third-party CDNs are used.
5. Data Shared with and via HubSpot
Plenum is software that runs natively on the customer's HubSpot account. Reading and writing data within HubSpot is central to the service. The following section explains in detail what data Plenum reads from and writes to HubSpot.
Connection via OAuth
The customer connects Plenum to their HubSpot account using the OAuth flow. Plenum only accesses the scopes the customer has authorised. The exact OAuth scopes are documented in the setup guide at plenum.bynu.ch/setup.
What Plenum Reads and Writes
| HubSpot object | Read | Write |
|---|---|---|
| Contacts | Existing contacts are imported as attendees (name, email address, and further contact fields) | Writing back participation status and check-in status; writing contact properties used by Plenum (e.g. QR-code links, cancellation links) |
| Companies | Company information is read for attendee grouping and VIP handling | Optional company fields, where enabled by the customer |
| Lists (static lists) | HubSpot lists are read to import attendees from them | Maintaining per-status static lists (e.g. "Registered", "Cancelled", "Attended") |
| Marketing Events | Existing Marketing Events are read and synchronised | Creating and updating the event in HubSpot Marketing Events; writing attendance status (registered, attended, cancelled) |
Role of HubSpot, Inc.
HubSpot, Inc. is a company that is legally and economically independent of by Nu. HubSpot processes data in the customer's HubSpot account as an independent controller under its own terms of service and privacy notice. Data in the HubSpot account may be processed by HubSpot outside Switzerland, subject to HubSpot's own data-protection safeguards.
6. Sub-Processors
By Nu uses the following sub-processors:
| Provider | Purpose | Location |
|---|---|---|
| HubSpot, Inc. | CRM platform that the customer connects to Plenum (reading and writing contact, company, list, and event data in the customer's account) | USA (data in the customer's HubSpot account) |
| Infomaniak Network SA | Hosting of the Plenum infrastructure | Geneva, Switzerland |
| Web3Forms | Transmitting enquiries submitted via the contact form on the Plenum product site | USA (servers, AWS US-East) |
The list of sub-processors may change. Material changes will be communicated with appropriate notice.
7. Data Retention
- Account and billing data: retained for the life of the subscription and a reasonable period thereafter, generally in line with statutory retention obligations.
- Technical logs: retained short-term, generally no longer than 30 days, unless a longer period is required for security purposes.
- HubSpot OAuth tokens: deleted immediately upon disconnection of the HubSpot integration or uninstallation of Plenum. After deletion, Plenum can no longer access the customer's HubSpot account.
- Data in the customer's HubSpot account: remains in the customer's HubSpot account after disconnection and is entirely under the customer's control.
8. Cookies and Tracking
The Plenum product site and service use only strictly necessary and functional cookies. No cookies or tracking technologies are used for advertising or marketing purposes.
- No third-party tracking services (e.g. Google Analytics, Meta Pixel).
- No external font CDNs: fonts are served entirely from our own servers hosted by Infomaniak in Switzerland.
- No social-media plugins that transmit data to third parties.
9. Your Rights
As a data subject, you have the following rights against by Nu in its role as controller, under the FADP and, where applicable, the GDPR:
- Right of access: you may request confirmation of whether, and which, personal data by Nu processes about you.
- Right to rectification: you may request the correction of inaccurate or incomplete data.
- Right to erasure: you may, under certain conditions, request the deletion of your data.
- Right to restriction of processing: you may request that the processing of your data be restricted.
- Right to object: you may object to the processing of your data on the basis of legitimate interests.
- Right to data portability: where provided by law, you may request delivery of your data in a structured, commonly used format.
To exercise your rights, please contact: hello@bynu.ch. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC / EDÖB): www.edoeb.admin.ch.
10. International Transfers
By Nu operates its infrastructure in Switzerland. Where data is transferred to other countries, by Nu ensures that appropriate safeguards are in place:
- HubSpot, Inc. (USA): data in the customer's HubSpot account is processed by HubSpot under its own privacy terms, standard contractual clauses, or equivalent protective mechanisms. HubSpot's own data-protection safeguards apply.
- Web3Forms: contact-form enquiries are forwarded to by Nu via Web3Forms (servers in the USA, AWS US-East). According to Web3Forms, form contents are not stored permanently but forwarded on; server logs are deleted periodically. As the servers are in the USA, this constitutes a transfer abroad; by Nu limits the data collected in the form to what is necessary (name, email address, message).
By Nu reviews sub-processors to ensure an adequate level of data protection.
11. Changes to This Policy
By Nu may update this Privacy Policy at any time. For material changes, customers will be informed with reasonable advance notice by email or via an in-app notification. The date of the most recent update is shown at the top of this page.
The current version of this policy is available at https://plenum.bynu.ch/legal/privacy.
12. Contact
For questions about data protection or to exercise your rights, please contact:
- by Nu
- Ueberlandstrasse 1, 8600 Dübendorf, Switzerland
- Email: hello@bynu.ch
- Website: https://bynu.ch