Privacy notice

Who is responsible for your data

The data controller for the processing described in this notice is:

We have not appointed a Data Protection Officer, as we do not meet the criteria set out in Article 37 GDPR. Privacy enquiries are handled directly at the address above.

What this website does, and what it does not

This website is a single static page. It has no user accounts, no login, no comment function, no shopping basket and no embedded video or social media content. We do not build visitor profiles, we do not use advertising or retargeting technology, and we do not sell or rent personal data to anyone, ever.

There are only three ways personal data connected to this site reaches us:

• You choose to request a scoping call through our booking form.
• You send us an email.
• Our hosting provider records a technical log entry when your browser requests the page.

Each of these is described below.

Processing at a glance

The table below summarises every processing activity connected to this website. Fuller detail follows in the sections after it.

When you request a scoping call

Our booking form is hosted by Microsoft Forms, a service of Microsoft Ireland Operations Limited. Clicking the booking button on our site takes you to a page on a Microsoft domain; the form is not embedded in this website.

The form asks for your name, work email address and company name, together with optional detail about what you need. We ask for these because we cannot arrange or prepare for a call without knowing who you are, how to reach you and which organisation the enquiry concerns.

Providing this data is voluntary, but it is necessary for this purpose: if you prefer not to use the form, you are welcome to email us instead.

We use what you submit only to respond to your enquiry, prepare for the call and, if you go on to engage us, to set up that engagement. We do not add you to a marketing list on the basis of a booking request, and we do not use enquiry data for any unrelated purpose.

Because the form is operated by Microsoft, Microsoft processes your submission as our processor under a data processing agreement, and its own privacy statement also applies to your visit to its page. See Third-party services.

When you contact us by email

If you email us, we receive your address, your name as it appears on the message, and whatever you write. Our mailbox is hosted by Microsoft 365, who processes this on our behalf.

Email is not a secure channel by default. Please do not send us confidential technical detail about your environment, credentials, or the specifics of a live security incident in an unencrypted email. If you need to share sensitive material, ask us and we will provide a secure method.

Cookies and local storage

We use one cookie, and only for the purpose of remembering what you told us about cookies.

This cookie contains no identifier and cannot be used to recognise or track you across websites. Under Article 5(3) of the ePrivacy Directive it is exempt from the consent requirement, because it exists solely to give effect to a preference you expressed.

Analytics

No analytics or tracking technology is currently active on this website. Our consent banner offers an analytics option so that, if we introduce audience measurement in future, nothing will load unless and until you accept it. Until then, choosing "Accept all" enables nothing beyond what is described above.

You can change or withdraw your choice at any time using the Cookie settings link in the site footer, and you can delete the cookie through your browser at any point.

Third-party services and recipients

We keep third parties to a minimum. The following are involved in operating this website or in handling enquiries. We share personal data with them only as described, and never for their own marketing.

We may also disclose personal data where we are legally required to do so — for example in response to a valid order from a competent authority — or where necessary to establish, exercise or defend legal claims.

Server logs and security monitoring

Like every web server, the infrastructure serving this site records a short technical entry each time a page or file is requested: the IP address making the request, the date and time, the file requested, the browser's user-agent string and, where the browser sends one, the referring page.

We rely on these logs to keep the site available and to detect and investigate abuse such as scanning, brute-force attempts and denial-of-service traffic. This is our legitimate interest under Article 6(1)(f), and we consider it proportionate because the data is minimal, held briefly, and never used to identify or profile individual visitors. Logs are not combined with any other data set and are not used for analytics.

Transfers outside the European Economic Area

We choose EU-based providers and EU data residency wherever the option exists. Our contracting entities for Microsoft and Google services are their Irish companies, and personal data is processed within the EEA in the ordinary course.

Some of these providers are part of corporate groups with operations outside the EEA, and limited transfers may occur — for example for technical support. Where that happens, the transfer is protected by the European Commission's Standard Contractual Clauses, by an adequacy decision, or by another mechanism permitted under Chapter V GDPR. You may request further information about the safeguards applied by writing to us.

How long we keep your data

We keep personal data only as long as it serves the purpose it was collected for, then delete it. The specific periods are set out in the table in section 03.

Two things extend those periods. If you become a client, data relating to the engagement is retained under our client terms and to meet Belgian statutory record-keeping obligations — accounting records must be kept for 7 years. And where data is relevant to an actual or anticipated legal claim, we retain it until that matter is resolved.

If you ask us to delete your enquiry and there is no legal reason to keep it, we will.

How we protect your data

We apply the technical and organisational measures required by Article 32 GDPR, proportionate to the limited data this website involves. In practice that means encryption in transit (HTTPS across the site), multi-factor authentication on the accounts that can reach enquiry data, access restricted to the people who need it, providers selected partly on their security posture, and documented handling of any personal data breach — including notification to the supervisory authority within 72 hours where the regulation requires it.

Your rights

Under the GDPR you have the following rights in relation to your personal data:

• Access — to be told whether we hold data about you and to receive a copy of it, with the information set out in Article 15.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have your data deleted where one of the grounds in Article 17 applies.
• Restriction — to have processing limited while, for example, a dispute about accuracy is resolved.
• Objection — to object to processing based on legitimate interests, in which case we stop unless we can show compelling grounds that override your interests.
• Portability — to receive data you provided to us in a structured, machine-readable format, where processing is based on consent or contract.
• Withdraw consent — where processing rests on consent, to withdraw it at any time, without affecting anything done beforehand.

To exercise any of these, email contact@nexatechnology.eu. We respond within one month, as required by Article 12(3). If a request is complex we may extend this by up to two further months and will tell you if that happens. Exercising your rights is free; we may charge a reasonable fee only where a request is manifestly unfounded or excessive.

We may need to verify your identity before acting on a request, in order to avoid disclosing your data to someone else.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first — we would rather put it right. You also have the right to lodge a complaint with a supervisory authority. In Belgium that is:

You may also complain to the supervisory authority in the EU or EEA country where you live or work.

Automated decision-making and profiling

We do not carry out automated decision-making or profiling within the meaning of Article 22 GDPR. No decision affecting you is taken by automated means on the basis of data collected through this website.

Children

This website and our services are directed at organisations and their staff, not at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this notice

We update this notice when our processing changes or when the law requires it. The version number and dates at the top of the page show the current state. Material changes affecting people whose data we already hold will be communicated directly where we have a means of reaching them.

Contact

For any question about this notice or about how we handle personal data, write to contact@nexatechnology.eu or to the postal address in section 01.