Privacy Policy

1. Introduction

Nexa AI ERP Ltd (“Nexa”, “we”, “us” or “our”) is committed to protecting your privacy and handling your personal information responsibly, securely and transparently.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you:

• Visit our website.
• Contact us through our website.
• Submit a business enquiry.
• Request information about our products or services.
• Request or arrange a product demonstration.
• Communicate with us about a potential business relationship.

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations (PECR).

This policy applies to the public Nexa website and related business communications.

It does not govern all personal information processed within the Nexa ERP platform on behalf of customers. Such processing is subject to the applicable customer agreements and data protection arrangements.

2. Who We Are

Legal company name: Nexa AI ERP Ltd

Company registration number: 16863050

Registered office:

Unit 17 Orbital 25 Business Park
Dwight Road
Watford
WD18 9DA
United Kingdom

Website: www.nexaai.co.uk

Email: info@nexaai.co.uk

Nexa AI ERP Ltd is the data controller responsible for personal information collected and processed for the purposes described in this policy.

This means that we determine why and how that information is processed.

If you have any questions about this policy or wish to exercise your data protection rights, please contact us using the email address above.

3. Personal Information We Collect

We collect only the personal information reasonably necessary to respond to enquiries, provide requested information and operate our website.

3.1 Information you provide directly

When you complete our website contact form, we may collect:

• Your full name.
• Your work email address.
• Your company or organisation name.
• Your telephone number, if provided.
• The contents of your message.
• The website form or page from which your enquiry was submitted.
• The date and time of your enquiry.

If you contact us directly by email, we may also receive your email address, correspondence and any other information you choose to include.

You should avoid including sensitive personal information in general website enquiries unless it is necessary for your request.

3.2 Technical and security information

When you access our website or submit a contact form, certain technical information may be processed to support website functionality, security and reliability.

This may include:

• Internet Protocol (IP) addresses.
• Information relating to website requests.
• Submission timestamps.
• Information used to detect automated or abusive submissions.
• Technical error information.

Our contact form uses an IP-based rate-limiting mechanism to reduce spam and excessive submissions.

For this purpose, the application creates a one-way hash derived from the IP address.

The rate-limiting mechanism is intended to restrict excessive submissions within a defined period.

Our website hosting provider may also process technical information necessary to deliver and protect the website.

3.3 Information from business communications

If you communicate with Nexa regarding a business enquiry or potential commercial relationship, we may retain relevant correspondence and information necessary to respond to your request.

This may include information about your organisation, your business requirements and the products or services you have asked us to discuss.

We do not intentionally collect special category personal information through our public website.

4. How We Use Personal Information

We use personal information for the following purposes.

4.1 Responding to enquiries

We use the information you provide to:

• Respond to your questions.
• Provide requested product information.
• Discuss Nexa’s ERP capabilities.
• Respond to partnership enquiries.
• Arrange follow-up communications relating to your enquiry.

4.2 Product demonstrations and business discussions

Where requested, we may use your contact information to:

• Arrange a demonstration.
• Discuss your business requirements.
• Assess whether Nexa may be suitable for your organisation.
• Provide information relevant to a potential commercial relationship.

4.3 Website security and operation

We process limited technical information to:

• Maintain website functionality.
• Prevent spam and misuse.
• Investigate technical problems.
• Protect the website against unauthorised or abusive activity.
• Maintain the reliability of our contact form.

4.4 Legal and regulatory compliance

Where necessary, we may process personal information to:

• Comply with applicable legal obligations.
• Respond to lawful requests from public authorities.
• Establish, exercise or defend legal claims.

4.5 Marketing communications

We do not use information submitted through our website contact form to automatically enrol individuals in marketing mailing lists.

We use enquiry information to respond to the enquiry and communicate about the matters requested.

We do not send unsolicited marketing emails to individuals solely because they have submitted a website enquiry.

If we introduce separate marketing activities in future, we will establish an appropriate lawful basis, comply with applicable electronic marketing rules and provide any required notices or consent mechanisms.

5. Lawful Bases for Processing

Under UK GDPR, we must have a lawful basis for processing personal information.

The lawful basis depends on the purpose and circumstances of the processing.

5.1 Legitimate interests

We rely on legitimate interests where necessary and appropriate to:

• Respond to ordinary business enquiries.
• Maintain communications with business contacts.
• Manage prospective business relationships.
• Protect our website against spam, misuse and security threats.
• Maintain reliable website operations.

Our legitimate interests include operating our business effectively, responding to individuals who contact us and protecting our website and communications systems.

We consider whether these interests are overridden by individuals’ rights, freedoms or reasonable expectations.

5.2 Steps before entering into a contract

Where an individual requests information or action relating to a potential contract with them personally, processing may be necessary to take steps at their request before entering into that contract.

This basis is not automatically applied to every business enquiry made on behalf of a company.

5.3 Legal obligations

We may process personal information where necessary to comply with legal obligations applicable to Nexa.

5.4 Consent

Where a particular activity requires consent under applicable law, we will obtain that consent before carrying out the activity.

We do not treat the submission of an ordinary business enquiry as blanket consent to receive unrelated marketing communications.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

6. How Long We Retain Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

6.1 Business enquiries

Where you contact Nexa but do not become a customer, we will ordinarily retain your enquiry information and related business correspondence for:

24 months after the last meaningful interaction.

A meaningful interaction includes substantive correspondence, a requested demonstration, a meeting or another genuine business discussion.

The retention period is not automatically extended by routine administrative activity or an unanswered follow-up.

At the end of this period, the information will be deleted or anonymised unless there is a documented reason for retaining it longer.

6.2 Customer relationships

If an enquiry results in a customer relationship, relevant information may be retained in accordance with the applicable customer agreements, business record-keeping requirements and legal obligations.

Such information may be subject to retention periods different from the 24-month enquiry period.

6.3 Legal obligations and disputes

We may retain relevant information for longer where necessary to comply with legal requirements, resolve disputes or establish, exercise or defend legal claims.

Any extended retention will be limited to information reasonably necessary for that purpose.

6.4 Technical and security records

Technical records, including contact-form rate-limiting information and error logs, are kept for security and operational purposes. Contact-form rate-limiting records are stored as one-way hashes of IP addresses, and expired records are deleted automatically the next time the contact form is used after the rate-limiting period has ended. Contact-form error logs are kept on our web server for troubleshooting and are not automatically deleted.

The precise retention periods for hosting logs and application security records depend on the applicable system configuration and service-provider arrangements.

We review these arrangements and aim to avoid retaining identifiable technical information longer than necessary.

6.5 Deletion and review

We periodically review personal information held for business enquiries.

Where information is no longer required, we take reasonable steps to delete or anonymise it.

Information contained in backups may remain for a limited period under the applicable backup retention arrangements before being overwritten or deleted.

7. Who We Share Personal Information With

We do not sell personal information.

We share personal information only where reasonably necessary to operate our website, respond to enquiries, deliver requested services or comply with legal requirements.

7.1 Website hosting — Hostinger

Our website is hosted using services provided by Hostinger.

Hostinger may process technical information necessary to host, deliver, maintain and secure the website.

This may include information relating to website requests, network connections, security events and hosting infrastructure.

Hostinger processes relevant information in accordance with its applicable contractual and data protection arrangements.

7.2 Business email — Google Workspace

Nexa uses Google Workspace for business email.

When you submit an enquiry through our website, the information is delivered to our business email account.

Google Workspace is therefore used to receive, store and manage business correspondence, including website enquiries.

Google processes relevant information in accordance with the applicable Google Workspace service terms and data processing arrangements.

7.3 Authorised personnel

Personal information may be accessed by authorised Nexa personnel who need it to respond to enquiries, manage relevant business communications or maintain website operations.

Access should be limited to legitimate business purposes.

7.4 Legal disclosures

We may disclose personal information where required by applicable law, a court order or a lawful request from an authorised public authority.

We may also disclose information where necessary to establish, exercise or defend legal claims.

7.5 Other service providers

If we engage additional providers that process website enquiry information on our behalf, we will assess the relevant data protection requirements and update this policy where appropriate.

We do not share website enquiry information with third parties for their independent marketing purposes.

8. International Transfers of Personal Information

Our website hosting and business email arrangements involve external service providers.

Depending on their infrastructure, support arrangements and processing activities, personal information may be accessed, stored or processed outside the United Kingdom.

Where a transfer is subject to UK international data transfer restrictions, we will ensure that an appropriate legal mechanism applies.

Depending on the destination and recipient, this may include:

• Applicable UK adequacy regulations.
• The UK Extension to the EU-US Data Privacy Framework, where the recipient and transfer qualify.
• The UK International Data Transfer Agreement.
• The UK Addendum to the European Commission’s Standard Contractual Clauses.
• Another transfer mechanism permitted by applicable UK data protection law.

We will assess the safeguards applicable to the services we use.

Where required, we will carry out an appropriate transfer risk assessment.

You may contact us to request further information about the safeguards applicable to your personal information.

9. Cookies and Similar Technologies

9.1 Current website functionality

The Nexa website does not currently intentionally use advertising cookies, behavioural tracking cookies or third-party analytics scripts.

We do not currently use website analytics tools to track individual visitors for advertising or profiling purposes.

Website fonts, images and JavaScript files are hosted locally rather than being requested from external font or analytics services.

9.2 Essential technical functionality

Our hosting infrastructure may use technical mechanisms necessary to deliver, secure or maintain the website.

Where cookies or similar technologies are strictly necessary for a service requested by a visitor, they may be used without consent where permitted by applicable law.

9.3 Non-essential cookies

We will not intentionally introduce non-essential cookies or similar tracking technologies without implementing any required transparency and consent controls.

If we introduce analytics, advertising or other non-essential technologies in future, we will review our obligations and update this policy accordingly.

9.4 Changes to cookie use

We may update this section if the website’s functionality or hosting configuration changes.

10. How We Protect Personal Information

We take reasonable technical and organisational measures to protect personal information against unauthorised access, accidental loss, misuse, alteration and disclosure.

Our approach includes:

• Limiting access to information according to legitimate business requirements.
• Using established hosting and business email providers.
• Maintaining controls intended to protect website operations.
• Using contact-form measures intended to reduce automated spam and misuse.
• Reviewing relevant technical and organisational security arrangements.
• Taking appropriate action when security concerns are identified.

Nexa AI ERP Ltd holds Cyber Essentials certification within its assessed organisational scope.

Cyber Essentials certification does not mean that every component of the Nexa ERP product has been separately certified.

Although we take reasonable steps to protect personal information, no internet-based system can guarantee absolute security.

11. Your Data Protection Rights

Under UK data protection law, you may have the following rights, depending on the circumstances.

11.1 Right to be informed

You have the right to receive clear information about how your personal information is collected and used.

11.2 Right of access

You may request confirmation of whether we process your personal information and obtain access to information covered by your rights.

11.3 Right to rectification

You may request correction of inaccurate personal information or completion of incomplete information.

11.4 Right to erasure

You may request deletion of your personal information in circumstances where the law provides this right.

11.5 Right to restrict processing

You may request that we restrict certain processing activities where applicable.

11.6 Right to object

You have the right to object to processing based on our legitimate interests.

Where you object, we will assess your request in accordance with applicable law.

You also have the right to object at any time to the use of your personal information for direct marketing.

If we process your information for direct marketing and you object, we will stop that processing.

11.7 Right to data portability

Where the relevant legal conditions are met, you may request personal information in a structured, commonly used and machine-readable format.

11.8 Rights relating to automated decision-making

You may have rights concerning decisions made solely through automated processing that produce legal or similarly significant effects.

We do not use information submitted through our website contact form to make such decisions.

11.9 Right to withdraw consent

Where we rely on consent for a particular processing activity, you may withdraw it at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

12. Exercising Your Rights

To exercise your data protection rights, contact:

info@nexaai.co.uk

Please explain the nature of your request so that we can respond appropriately.

We may request reasonable information to verify your identity before disclosing or changing personal information.

We will respond without undue delay and normally within one month of receiving a valid request.

Where the law permits an extension, we will explain the reason and notify you within the applicable period.

We do not ordinarily charge a fee for exercising data protection rights.

However, the law permits a reasonable fee or refusal in certain limited circumstances, including requests that are manifestly unfounded or excessive.

13. Complaints

If you have concerns about how Nexa handles your personal information, please contact us so that we can investigate and respond.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Information Commissioner’s Office

Website: ico.org.uk

You may contact the ICO whether or not you have contacted Nexa first.

14. Third-Party Websites

Our website may contain links to websites operated by other organisations.

These may include technology providers, business partners or external information services.

We do not control the privacy practices of independent third-party websites.

Their collection and use of personal information are governed by their own privacy notices.

We recommend reviewing those notices before providing personal information.

15. Children’s Privacy

Our website and ERP-related business services are intended for business users and professional audiences.

They are not directed at children.

We do not knowingly seek to collect personal information from children through our public website.

If we become aware that personal information has been submitted by a child in circumstances requiring action, we will assess the situation and take appropriate steps in accordance with applicable law.

16. Automated Decision-Making and Artificial Intelligence

Nexa develops AI-native ERP technology, including an integrated Nexa AI.

However, submitting an enquiry through our public website does not mean that your personal information will be used to train artificial intelligence models.

We do not use website contact-form submissions to make solely automated decisions that produce legal or similarly significant effects.

The operation of AI features within the Nexa ERP platform is separate from the processing of public website enquiries.

Any customer-specific processing within the ERP platform is subject to the relevant product terms, customer agreements and data protection arrangements.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to our website.
• Changes to our services.
• Changes to our data processing activities.
• Changes to our service providers.
• Changes to applicable legal requirements.

Where we make changes, we will update the date shown at the beginning of this policy.

Where legally required, we will provide additional notice or obtain consent before implementing material changes to relevant processing activities.

We encourage visitors to review this policy periodically.

18. Contact Information

If you have any questions about this Privacy Policy, our handling of personal information or your data protection rights, please contact:

Nexa AI ERP Ltd

Unit 17 Orbital 25 Business Park
Dwight Road
Watford
WD18 9DA
United Kingdom

Email: info@nexaai.co.uk

Website: www.nexaai.co.uk