This explains what we do with personal data, both yours as a visitor and your customers’ if we build systems that touch it. Written to be read rather than to be defensible.
Who we are
Nex AI, registered in England & Wales, company number [00000000], registered office [address]. We are the data controller for this website and a data processor when we build and run systems on your behalf.
For anything about data, contact Info@Nex.bz or 0330 220 1231. There is no data protection officer because we are below the threshold that requires one; enquiries come to [name].
What we collect on this website
Enquiry form: your name, work email, company and the description of the task you want automated, plus a budget range if you give one. We ask for nothing else.
Analytics: aggregated page views and referrers. We do not build advertising profiles and we do not sell data to anyone, ever.
Server logs: IP address and user agent, retained for [30] days for security.
Why we are allowed to hold it
Enquiries: legitimate interest in responding to a business enquiry you sent us, and the performance of a contract once one exists.
Analytics: consent, given through the cookie banner. Decline it and the site works exactly the same.
Client data during a build: a written processing agreement with you as controller and us as processor.
AI providers and sub-processors
Where a system we build sends data to a language model, we use business or enterprise API tiers under which prompts and outputs are not used to train the provider’s models. Consumer chat products are never used for client data.
You get a written list of every sub-processor touching your data before the build goes live, including the provider, the region and what it sees. Current list: [provider], [hosting], [monitoring].
We will not add a sub-processor to a live client system without telling you first.
Where data is processed
UK or EU regions by default, for hosting, databases, queues and logs.
Where a specific model is only available outside the UK or EEA, we say so before you commit, and the transfer relies on the UK International Data Transfer Addendum or adequacy regulations.
How long we keep it
Enquiries that do not become work: [24] months, so we can pick up a conversation you restart.
Client records: for the length of the engagement plus [6] years, which is what our accountants and insurers require.
System logs on client automations: [90] days rolling unless your own retention rules say otherwise.
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to processing based on legitimate interest, and withdraw consent for analytics at any time.
Email Info@Nex.bz and we will respond inside one month, usually the same week. There is no charge.
If we get it wrong you can complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113. We would rather you told us first.
Security
Credentials are held in a secret manager, never in code or a spreadsheet, and rotated at handover. Access is logged. Automations run on infrastructure we maintain with restricted access.
If a breach affects your data we will tell you without delay, and the ICO within 72 hours where the rules require it.