Nexvisory Privacy Policy

1. Introduction

Nexvisory ("Nexvisory", "we", "us", or "our") provides a web-based business management platform (the "Platform" or "Service") that helps small businesses, freelancers, consultants, agencies, and other service-based organisations manage customer relationships, projects, HR administration, and financial record-keeping through a single online dashboard.

This Privacy Policy explains how we collect, use, share, and protect personal data in connection with your use of the Platform, our website, and any related services. It applies to visitors to our website, prospective customers, registered Customers, and Authorised Users who access the Platform on a Customer's behalf (together, "you").

We are committed to handling personal data responsibly and in accordance with applicable data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018, and, where relevant to our customers based elsewhere, other applicable data protection laws such as the EU General Data Protection Regulation.

This Privacy Policy should be read alongside our Terms and Conditions and our Refund Policy. If you do not agree with this Privacy Policy, please do not use the Platform.

Because Nexvisory brings together several categories of business information — customer records, project data, HR records, and financial records — we have tried to explain not only what personal data we collect about you directly, but also how we handle the personal data that our Customers store within the Platform about their own customers and employees. These are two distinct categories of information, and Section 9 explains the difference between them in detail.

2. Who We Are

Nexvisory is the data controller in respect of the personal data described in Sections 4 and 5 below — that is, personal data relating to our own website visitors, prospective customers, and the individuals who register for and administer Nexvisory Accounts.

Where a Customer uses the Platform to store and process personal data relating to its own customers, leads, or employees ("Customer Data"), Nexvisory acts as a data processor on the Customer's behalf, and the Customer acts as the data controller of that information. Section 9 explains this distinction, and the different roles and responsibilities that follow from it, in more detail.

If you have any questions about this Privacy Policy or about how we handle personal data, you can contact us using the details in Section 15.

3. Scope of This Policy

This Privacy Policy covers:

• Personal data we collect through our website, including when you browse our site, request information, or sign up for a Free Trial or Subscription.
• Personal data we collect and process when you register for and use a Nexvisory Account, including data relating to Authorised Users.
• Personal data we collect when you contact our support team or otherwise communicate with us.
• The categories of Customer Data that Customers may enter into the Platform, and our role as a data processor in relation to that data.

This policy does not cover the practices of third-party websites or services that may be linked to or integrated with the Platform, including Stripe. We encourage you to review the privacy policies of any third-party services you use in connection with Nexvisory.

4. Information We Collect

4.1 Information You Provide to Us

We collect personal data that you provide directly to us, including:

• Account and registration information: your name, business name, email address, phone number, job title, and password when you register for an Account.
• Billing information: billing name, billing address, and payment details, which are collected and processed by Stripe on our behalf, as described in Section 8.
• Communications: information you provide when you contact our support team, respond to surveys, or otherwise communicate with us, including the content of your messages.
• Marketing preferences: information about your communication preferences, including whether you have opted in or out of marketing communications.

4.2 Information We Collect Automatically

When you access our website or the Platform, we automatically collect certain information, including:

• Usage data: information about how you interact with the Platform, such as pages viewed, features used, session duration, and click patterns.
• Device and technical data: IP address, browser type and version, operating system, device identifiers, and general location information derived from your IP address.
• Log data: server logs recording access times, error reports, and system activity, used to maintain the security and performance of the Platform.

4.3 Cookies and Similar Technologies

We use cookies and similar tracking technologies to operate our website and the Platform, remember your preferences, and understand how our Service is used. Further detail is set out in Section 11.

4.4 Information from Third Parties

We may receive limited information about you from third parties, such as:

• Payment confirmation and transaction status information from Stripe;
• Information from analytics or marketing partners, where you have interacted with our advertisements or website through those partners;
• Information provided by a Customer who has invited you to join the Platform as an Authorised User.

4.5 Special Category Data

We do not intentionally collect special category data (such as data revealing racial or ethnic origin, health information, or religious beliefs) about our own website visitors or Account holders as part of the ordinary operation of our website or registration process. Where Customer Data entered into the Platform by a Customer happens to include special category data relating to that Customer's own employees or customers (for example, health information recorded in an HR file), the Customer is responsible for ensuring an appropriate lawful basis exists for that processing, as described in Section 9.

4.6 Information We Do Not Want You to Send Us

Please do not include sensitive personal data (such as national insurance numbers, bank account details, health information, or government identification numbers relating to yourself) in general correspondence with our support team, such as emails or support tickets, unless specifically requested as part of a verification process. Where such information needs to be stored as part of your ordinary use of the Platform — for example, as part of an employee record maintained through our HR administration tools — it should be entered through the relevant secure feature of the Platform itself, rather than shared informally with our support team.

5. How We Use Your Information

We use the personal data described above for the following purposes:

• To provide the Service: creating and managing Accounts, enabling access to the Platform, and delivering the core functionality of the CRM, project management, HR administration, and financial record-keeping tools.
• To process payments: processing Subscription Fees through Stripe and maintaining accurate billing records.
• To provide support: responding to enquiries, troubleshooting issues, and providing Support Services as described in our Terms and Conditions.
• To communicate with you: sending administrative communications, such as billing notices, renewal reminders, security alerts, and updates to our policies.
• For marketing purposes: with your consent or otherwise in accordance with applicable law, sending you information about product updates, new features, or promotional offers. You may opt out of marketing communications at any time, as described in Section 13.
• To improve the Platform: analysing usage patterns and feedback to develop new features, improve existing functionality, and enhance the overall user experience.
• To maintain security: detecting, investigating, and preventing fraudulent, unauthorised, or harmful activity, and protecting the security and integrity of the Platform.
• To comply with legal obligations: meeting our own accounting, tax, regulatory, and legal obligations, and responding to lawful requests from public authorities.

5.1 Automated Decision-Making

We do not use your personal data to make decisions that produce legal or similarly significant effects about you through fully automated means, without human involvement. Where the Platform includes features that summarise or organise information (such as reports generated from Customer Data), these are organisational tools intended to support a Customer's own decision-making, rather than automated decisions made about individuals by Nexvisory.

6. Legal Basis for Processing

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases to process your personal data:

• Performance of a contract: where processing is necessary to provide the Platform and fulfil our obligations under our Terms and Conditions.
• Legitimate interests: where processing is necessary for our legitimate business interests, such as improving the Platform, maintaining security, and understanding how our Service is used, provided these interests are not overridden by your own rights and interests.
• Consent: where you have given us specific consent, such as for certain marketing communications or non-essential cookies. You may withdraw your consent at any time.
• Legal obligation: where processing is necessary for us to comply with a legal or regulatory obligation, such as retaining billing records for tax purposes.

6.1 How We Balance Legitimate Interests

Where we rely on legitimate interests as our legal basis, we carry out a balancing exercise to weigh our business interests against your rights and freedoms as an individual. For example, when we use usage data to understand how features of the Platform are used, we consider whether this processing is proportionate, whether you would reasonably expect it given your relationship with us, and whether there are less intrusive ways of achieving the same outcome. If you would like more information about the legitimate interests we rely on for a particular type of processing, please contact us using the details in Section 15.

7. How We Share Information

We do not sell personal data. We may share personal data in the following circumstances:

7.1 Service Providers

We share personal data with trusted service providers who perform functions on our behalf, including hosting providers, payment processors, customer support tools, analytics providers, and email delivery services. These providers are contractually bound to process personal data only for the purposes we specify and in accordance with applicable data protection law.

7.2 Payment Processing

Billing and payment information is shared with Stripe for the purpose of processing Subscription Fees. Stripe processes this information in accordance with its own privacy policy, which we encourage you to review separately. Nexvisory does not itself store full payment card details.

7.3 Business Transfers

If Nexvisory is involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality protections and consistent with this Privacy Policy.

7.4 Legal Requirements

We may disclose personal data where required to do so by law, in response to a valid request from a public or regulatory authority, or where we believe disclosure is necessary to protect our rights, the safety of our users, or the public.

7.5 With Your Consent

We may share personal data with other third parties where you have given us your consent to do so.

8. Payment Data and Stripe

All Subscription payments made through the Platform are processed by Stripe. When you provide payment information, it is transmitted directly to Stripe and processed in accordance with Stripe's own security standards and privacy practices. Nexvisory receives limited information from Stripe necessary to confirm successful payment, manage your Subscription, and maintain accurate billing records — such as transaction status, the last four digits of a payment card, and billing address — but does not receive or store full card numbers or other sensitive payment credentials.

We encourage you to review Stripe's privacy policy for further information on how Stripe processes payment data.

8.1 Other Sub-Processors

In addition to Stripe, we may engage other reputable third-party sub-processors to support the operation of the Platform, such as cloud hosting providers, email delivery services, and customer support tools. Each sub-processor is subject to contractual obligations requiring them to protect personal data in a manner consistent with this Privacy Policy and applicable data protection law. A current list of our key sub-processors is available on request by contacting us using the details in Section 15.

9. Customer Data: Our Role as a Data Processor

9.1 The Distinction Between Nexvisory's Data and Customer Data

This Privacy Policy primarily addresses personal data that Nexvisory collects and controls as described in Sections 4 and 5 above — broadly, data relating to our website visitors, prospective customers, and the individuals who register and administer Accounts.

Separately, Customers use the Platform to enter and manage information about their own customers, leads, employees, and other individuals ("Customer Data") through the CRM, project management, HR administration, and financial record-keeping tools. Where Customer Data includes personal data, the Customer is the data controller of that information, determining what data is collected, why it is collected, and how it is used. Nexvisory acts as a data processor, providing the technological infrastructure through which that data is stored and processed on the Customer's behalf and instructions.

9.2 Our Obligations as a Processor

In our role as a processor, Nexvisory:

• Processes Customer Data only in accordance with the Customer's documented instructions, as reflected in the Customer's configuration and use of the Platform;
• Implements appropriate technical and organisational security measures to protect Customer Data, as described in Section 10;
• Assists Customers, where reasonably required, in responding to data subject requests relating to Customer Data and in meeting their own data protection obligations;
• Does not use Customer Data for its own independent marketing purposes or disclose it to third parties except as necessary to provide the Service or as required by law.

9.3 Customer Responsibilities

Customers remain responsible for ensuring that they have a lawful basis for collecting and processing any personal data they enter into the Platform, for providing appropriate privacy notices to the individuals whose data they process, and for responding to data subject requests relating to their own Customer Data, with reasonable assistance from Nexvisory where required. Further detail on Customer responsibilities is set out in our Terms and Conditions.

9.4 Data Processing Agreement

Customers who require a formal Data Processing Agreement reflecting the arrangements described in this Section may request one by contacting us using the details in Section 15.

10. Data Security

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit, access controls restricting who within our organisation can access personal data, regular security reviews, and secure hosting infrastructure.

While we take data security seriously, no method of electronic transmission or storage is completely secure, and we cannot guarantee the absolute security of personal data. If you have reason to believe your Account has been compromised, please contact us immediately using the details in Section 15.

10.1 Security Measures in More Detail

Our security measures include, among others: encryption of data in transit using industry-standard protocols; role-based access controls limiting internal access to personal data on a need-to-know basis; secure, reputable hosting infrastructure; regular monitoring for unauthorised access attempts; and periodic review of our security practices as the Platform evolves. We also require our staff and contractors who may access personal data to comply with confidentiality obligations.

10.2 Reporting a Security Concern

If you become aware of a vulnerability, security incident, or potential data breach affecting the Platform, please report it to us promptly using the details in Section 15 so that we can investigate and respond appropriately. Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority and affected individuals in accordance with applicable data protection law.

11. Cookies and Tracking Technologies

11.1 What Cookies Are

Cookies are small text files placed on your device when you visit a website. We use cookies and similar technologies (such as pixels and local storage) on our website and Platform for several purposes.

11.2 Types of Cookies We Use

• Essential cookies: necessary for the operation of the Platform, such as maintaining your logged-in session and remembering security settings. These cannot be disabled without affecting core functionality.
• Performance and analytics cookies: help us understand how visitors interact with our website and Platform, allowing us to improve functionality and user experience.
• Functionality cookies: remember your preferences, such as language or display settings, to provide a more personalised experience.
• Marketing cookies: used, where applicable and with your consent, to deliver relevant advertising and measure the effectiveness of marketing campaigns.

11.3 Managing Cookies

Where required by applicable law, we will request your consent to non-essential cookies through a cookie banner or preference centre on our website, where you can manage your preferences. You can also control cookies through your browser settings, though disabling certain cookies may affect the functionality of our website or the Platform.

12. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, including:

• For as long as your Account remains active, to provide the Service;
• For a reasonable period following Account closure or Subscription cancellation, to allow for data export, resolve disputes, and comply with our legal and regulatory obligations, such as retaining billing records for tax purposes;
• For website visitor and marketing data, until you withdraw consent or object to further processing, or until the data is no longer needed for the purposes for which it was collected.

Following the applicable retention period, personal data is securely deleted or anonymised in accordance with our data retention practices. Customers are encouraged to export any Customer Data they wish to retain prior to Account closure, as described in our Terms and Conditions.

12.1 Retention Following Refunds or Cancellation

Where a Subscription is cancelled, or a refund is processed under our Refund Policy, we generally retain a limited set of Account and billing information for a reasonable period afterwards, primarily to comply with our own accounting and tax record-keeping obligations, to handle any follow-up queries relating to the cancelled Subscription, and to maintain records required to prevent abuse of features such as our 14-day money-back guarantee. Customer Data stored within a cancelled Account is retained for a limited grace period to allow for data export before being permanently deleted, consistent with our Terms and Conditions.

12.2 Backups

Personal data may continue to exist in encrypted backup systems for a limited period after it has been deleted from our live systems, as part of our standard backup and disaster recovery processes. Data held in backups is not used for any active purpose and is purged in the ordinary course of our backup rotation schedule.

13. Your Rights

13.1 Data Subject Rights

Depending on your location and the applicable data protection law, you may have the following rights in relation to your personal data:

• Access: the right to request a copy of the personal data we hold about you.
• Rectification: the right to request correction of inaccurate or incomplete personal data.
• Erasure: the right to request deletion of your personal data in certain circumstances.
• Restriction: the right to request that we limit the processing of your personal data in certain circumstances.
• Portability: the right to receive certain personal data in a structured, commonly used, machine-readable format, and to have it transferred to another controller where technically feasible.
• Objection: the right to object to processing based on legitimate interests, including for direct marketing purposes.
• Withdrawal of consent: where processing is based on consent, the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

13.2 Exercising Your Rights

To exercise any of these rights, please contact us using the details in Section 15. We will respond to your request within the timeframe required by applicable law. Please note that where your request relates to Customer Data for which a Nexvisory Customer is the data controller, we may direct you to contact that Customer directly, and will support the Customer in responding to your request as described in Section 9.2.

13.3 Complaints

If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. In the United Kingdom, this is the Information Commissioner's Office (ICO), which can be contacted at www.ico.org.uk. We would appreciate the opportunity to address your concerns directly before you approach a supervisory authority, and encourage you to contact us first using the details in Section 15.

13.4 Verifying Your Identity

To protect your personal data from unauthorised access, we may need to verify your identity before responding to a request to exercise your rights under this Section. We will only request information reasonably necessary to confirm your identity and will not use that information for any other purpose.

13.5 No Fee Usually Required

You will not usually have to pay a fee to exercise any of your data protection rights. However, we may charge a reasonable administrative fee, or decline to act on a request, if your request is clearly unfounded, repetitive, or excessive, as permitted by applicable data protection law. Where a fee applies, we will inform you before proceeding with the request.

13.6 Response Times

We aim to respond to legitimate requests within one calendar month of receipt. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests at the same time. In such cases, we will notify you and keep you updated on the progress of your request.

14. Marketing Communications

Where you have consented to receive marketing communications from us, or where applicable law otherwise permits us to contact you, we may send you information about product updates, new features, or promotional offers by email. You can opt out of marketing communications at any time by clicking the "unsubscribe" link included in our emails or by contacting us using the details in Section 15. Opting out of marketing communications does not affect your receipt of essential administrative communications relating to your Account or Subscription.

15. International Data Transfers

Nexvisory and its service providers may process personal data in countries outside your own, including outside the United Kingdom or European Economic Area. Where such transfers occur, we take appropriate steps to ensure that personal data receives an adequate level of protection, including through the use of Standard Contractual Clauses, adequacy decisions, or other legally recognised transfer mechanisms, as required by applicable data protection law.

16. Children's Privacy

The Platform is intended for use by businesses and individuals acting in a business capacity, and is not directed at, or intended for use by, children. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected personal data from a child, we will take reasonable steps to delete that data promptly.

17. Third-Party Links

Our website and the Platform may, from time to time, contain links to third-party websites or services that are not operated by Nexvisory. This Privacy Policy does not apply to those third-party websites or services, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policy of any third-party website or service before providing your personal data to it.

18. Do Not Track Signals

Some browsers offer a "Do Not Track" feature that lets you signal to websites that you do not want your online activities tracked. Because there is not yet a common industry standard for how to interpret these signals, our website does not currently respond to Do Not Track browser signals in a uniform way. You can still manage cookie-based tracking through the cookie preferences and browser settings described in Section 11.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Service, or applicable law. Where changes are material, we will provide reasonable notice, such as by posting an updated version on our website with a revised "Last updated" date, or by emailing registered Customers where appropriate. We encourage you to review this Privacy Policy periodically to stay informed about how we handle personal data.

20. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data protection practices, please contact us at: