DEVIS
Request a Session

Privacy

Privacy Notice

DEVIS OS by Nathan Office Inc.

1. Who is responsible

Nathan Office Inc., registered at 30 N Gould St, Sheridan, WY 82801, United States, and trading as DEVIS OS from Dorfstrasse 44, 2544 Bettlach, Switzerland, is responsible for personal data handled through this site and through DEVIS engagements. Contact: gavin.nathan@devisos.com.

2. What this Privacy Notice covers

This Privacy Notice explains how DEVIS handles personal data through:

  • this website;
  • enquiry, booking, and communication channels, including requests for the redacted sample (see section 14);
  • client onboarding;
  • scoping conversations;
  • DEVIS engagements and sprint work;
  • client administration, security, record-keeping, and service operation.

3. What we collect

Through this site, we may collect limited information such as: name; contact details; company or organisation; role or professional context; enquiry details; scheduling information; technical and security data; and privacy-respecting analytics.

In an engagement, we may process information provided by the client and information obtained from open, public, registry, commercially obtainable, and lawfully accessible sources about companies, individuals, counterparties, transactions, ownership structures, management teams, commercial relationships, disputes, insolvency records, sanctions, regulatory records, litigation, media, and related subjects within the agreed scope.

4. Why we process personal data

We process personal data to:

  • respond to enquiries;
  • assess whether an engagement is appropriate;
  • conduct onboarding and administration;
  • scope, perform, deliver, and manage DEVIS engagements;
  • identify, structure, qualify, and map exposure signals;
  • produce evidence-qualified deliverables;
  • operate, secure, maintain, and improve the service;
  • maintain records for legal, contractual, business, auditability, security, and dispute-protection purposes;
  • comply with legal obligations;
  • protect the legitimate interests, rights, and security of DEVIS, clients, and relevant third parties.

5. Legal basis and justification

Depending on the context, DEVIS processes personal data on the basis of contract performance, pre-contractual steps, consent where applicable, legal obligations, and legitimate interests in operating a professional exposure-intelligence service, protecting business and legal interests, maintaining security, and carrying out client-authorised engagements.

Where applicable law requires a separate justification, DEVIS processes personal data only where the processing is lawful, proportionate, purpose-limited, and consistent with the agreed engagement purpose.

6. Information about third parties

Exposure intelligence may involve information about individuals connected to a company, transaction, counterparty, ownership structure, management team, commercial relationship, legal record, regulatory record, or public source.

DEVIS processes such information for the specific professional purpose of the engagement, subject to applicable law, proportionality, confidentiality, source limitations, and evidence qualification. Material findings are qualified by verification status: corroborated, partially corroborated, inconclusive, or contradicted.

7. Sensitive information

DEVIS does not seek special-category or highly sensitive personal data unless it is lawful, proportionate, directly relevant to the engagement purpose, and reasonably necessary in context.

If such information appears in lawful source material, DEVIS limits its use to what is material, proportionate, and relevant to the professional decision being assessed.

8. Who we share personal data with

DEVIS does not sell personal data. We may share personal data with:

  • hosting, infrastructure, email, security, and operational service providers; Calendly (appointment scheduling, on the booking page) and Microsoft Clarity (privacy-respecting website analytics on selected pages, loaded only where you have given analytics consent);
  • professional advisers;
  • authorised client recipients within the agreed engagement scope;
  • regulators, courts, authorities, or other parties where required by law or necessary to protect legal rights.

Service providers are used under appropriate confidentiality, security, and contractual obligations. Client confidential engagement material is not provided to other clients.

9. International handling

Nathan Office Inc. is registered in the United States and trades as DEVIS OS from Switzerland. Personal data may be processed in Switzerland, the European Union and the United States, including by the service providers named in this notice. Where data is transferred to a country without an adequate level of protection, DEVIS relies on the safeguards permitted by applicable law, such as standard contractual clauses, together with security controls.

10. Retention

DEVIS retains personal data and engagement material only for as long as necessary for the purpose collected, the engagement terms, client access, legal and business record obligations, auditability, security, dispute protection, and legitimate administration.

Retention periods may differ depending on the type of data, the engagement, legal obligations, operational requirements, and the need to preserve an accurate record of work performed. Where appropriate, information may be deleted, anonymised, restricted, or archived after the relevant retention period.

11. Security

DEVIS applies organisational and technical measures designed to protect personal data and engagement material against unauthorised access, disclosure, alteration, loss, misuse, or destruction. Access is limited on a need-to-know basis. Engagement material is handled according to scope, confidentiality requirements, and operational controls.

No system can be guaranteed completely secure. DEVIS maintains security controls proportionate to the sensitivity of the work and the risks involved.

12. Your rights

Subject to applicable law, you may have rights to:

  • request access to personal data held about you;
  • request correction of inaccurate personal data;
  • request deletion or restriction of personal data;
  • object to certain processing;
  • withdraw consent where processing is based on consent;
  • request data portability where applicable;
  • complain to a competent data protection authority.

To make a request, contact gavin.nathan@devisos.com. DEVIS may need to verify your identity before responding. Rights may be limited where necessary to protect confidentiality, legal privilege, trade secrets, the rights of others, legal claims, regulatory obligations, or the integrity of an engagement.

13. Automated decision-making

DEVIS does not use website data to make solely automated decisions with legal or similarly significant effects.

DEVIS deliverables support professional decision-making by clients. They do not make the client's decision and do not replace the client's independent judgement.

14. Sample requests

When you request the redacted sample through the form on this site, DEVIS processes:

  • your full name, company and work email address;
  • your role and your answer on whether a live decision applies, if you give them;
  • whether you agreed to a follow-up about the sample;
  • the date and time of the request and the version of the notice shown to you;
  • a one-way hashed form of your network address, used only to limit repeated requests.

DEVIS uses these details to send you the sample, to record that it was sent, and to protect the form from misuse. Each copy of the sample is stamped on every page with your name, company, email address and the date of issue, so that each copy can be traced to its recipient.

The sample is sent to the email address you give, as a link that is valid for 7 days and for up to 3 downloads. DEVIS also receives a notification of each request at gavin.nathan@devisos.com.

DEVIS contacts you about the sample after it is sent only if you tick the follow-up box on the form. You can withdraw that agreement at any time by writing to gavin.nathan@devisos.com.

Service providers for sample requests: Cloudflare, Inc. (hosting, request storage and the private sample file); Resend (email delivery); Google (the gavin.nathan@devisos.com mailbox that receives notifications).

Legal basis: DEVIS processes these details to respond to your request and send you the sample, and in its legitimate interest in protecting the form from misuse and keeping a record of what was sent. Follow-up about the sample is based on your agreement, which you can withdraw at any time.

Retention: Sample request records are kept for 24 months from the request, or from our last contact with you if later, and then deleted. If you withdraw your agreement to follow-up, we stop contacting you and keep only the record that the sample was sent.

15. Changes

DEVIS may update this Privacy Notice from time to time. The current version will be published on this page.

Last updated: 25 September 2026.