Privacy Policy

We collect information in three ways: information you give us directly, information collected automatically as you use our website and product, and — for customers — business data you choose to connect to Nexoryx One.

2.1 Information you provide directly

When you request a demo, contact us, create an account or otherwise interact with us, you may provide:

• Name
• Work email address
• Company or business name
• Job title
• Company size
• Product interest and business challenges or goals you share with us
• Demo request details (the information you submit through our Book a Demo form)
• Account and login information, if you use the Nexoryx One product
• Any other information you choose to include in messages to us

2.2 Information collected automatically

When you visit our website or use our product, certain information is collected automatically:

• IP address
• Device and browser information (type, version, operating system)
• Website usage data (pages viewed, referring pages, time on page, navigation paths)
• Analytics data collected via Google Analytics 4 and Google Tag Manager
• Cookie identifiers and similar technologies — see our Cookie Policy for full detail
• Technical and security logs (e.g. error logs, request logs)

Analytics and cookie-based data is only collected in line with the consent choices you make in our cookie consent manager — see our Cookie Policy.

2.3 Customer-connected business data

If you are a Nexoryx One customer, our product is designed to connect to business systems you choose to integrate — for example Google Analytics (GA4), Google Ads, Meta, Shopify, HubSpot and other supported platforms — so that Nexoryx One can analyse, detect changes in and generate recommendations from that data. This may include business, marketing, sales, revenue and operational data, and, depending on what you connect, personal data about your own customers, leads or employees contained within it.

For this category of data, Nexoryx One acts as a data processor on your instructions, under the terms of your agreement with us. You remain the data controller and are responsible for having the appropriate legal basis and permissions to connect that data to Nexoryx One.

We only process personal data where we have a valid legal basis to do so under UK GDPR and, where applicable, the EU GDPR. The table below summarises our main purposes and the legal basis we rely on for each.

Responding to demo requests and enquiries

We use the information you submit through our Book a Demo form or other enquiry channels to respond to your request, schedule and deliver a demo, and answer your questions. Legal basis: steps taken at your request prior to entering into a contract (contractual necessity), and our legitimate interest in responding to business enquiries.

Product and service communications

Where you request a demo, we may contact you regarding that request and, where legally permitted or where you have consented, may provide relevant information about Nexoryx One products and services. Legal basis: legitimate interests (for closely related B2B communications following a genuine enquiry) or consent, depending on the communication and your jurisdiction. You can opt out at any time — see "Marketing communications and opt-out" below.

Legitimate interests

We rely on legitimate interests to operate and improve our business, including: understanding how our website is used, maintaining the security of our website and product, preventing fraud and misuse, responding to business enquiries, and improving our product and marketing based on aggregated insights. We balance these interests against your rights and freedoms and do not rely on legitimate interests where doing so would be unwarranted.

Consent

Where required by law — including for non-essential analytics, functional and marketing cookies — we rely on your consent, obtained through our cookie consent manager. You can withdraw consent at any time; see our Cookie Policy.

Contractual necessity

Where you or your organisation are a Nexoryx One customer, we process account, login and usage data as necessary to provide the product under our agreement with you, including hosting, processing and displaying data you connect to the platform.

Legal obligations

We may process personal data where necessary to comply with a legal obligation, such as responding to a lawful request from a public authority or maintaining records required by law.

Analytics and product improvement

Where you have given analytics consent, we use aggregated and pseudonymised usage data to understand how our website and product are used, diagnose issues and prioritise improvements. Legal basis: consent (for website analytics cookies) and legitimate interests (for product usage analytics necessary to operate and improve the service for customers).

Security and fraud prevention

We process technical and log data to detect, investigate and prevent security incidents, fraud and abuse of our website and product. Legal basis: legitimate interests and, where applicable, legal obligation.

Where you request a demo or otherwise engage with us as a prospective customer, we may contact you regarding that specific request and, where legally permitted or where you have given consent, may also provide relevant information about Nexoryx One products, features and updates.

You can opt out of marketing communications at any time by using the unsubscribe link in any marketing email, or by emailing us at privacy@nexoryxone.com. We will still need to contact you regarding any active demo request, ongoing enquiry or contractual relationship, even after you opt out of marketing.

Our website uses cookies and similar technologies, including for analytics via Google Analytics 4 and Google Tag Manager. Non-essential cookies are only set with your consent, which you can give, decline or change at any time through our cookie consent manager (accessible via "Cookie Settings" in the footer of every page). Full detail is available in our Cookie Policy.

We share personal data with a limited number of service providers who process it on our behalf, under contractual terms that require them to protect it and only use it as instructed. These include:

• Website hosting and infrastructure providers
• Google (Google Analytics 4 and Google Tag Manager) for website analytics, subject to your cookie consent choices
• Email and communication tools used to respond to demo requests and enquiries
• Customer relationship management (CRM) tools used to manage our sales pipeline

We do not sell personal data to third parties.

Nexoryx One serves customers in the UK and internationally, including the EU/EEA and UAE. Where personal data is transferred outside the UK or EEA — for example to a service provider located elsewhere, or because you are located outside the UK/EEA — we put appropriate safeguards in place, such as the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses, or reliance on an applicable adequacy decision, as relevant to the transfer.

We retain personal data only for as long as necessary for the purposes it was collected, including to satisfy legal, accounting or reporting requirements. Demo request and enquiry data is generally retained for the duration of our engagement with you plus a reasonable period afterwards for record-keeping and relationship management. Website analytics data is retained in line with the retention settings of the underlying analytics tools. Customer-connected business data is retained in line with the terms of the customer's agreement with Nexoryx One and deleted or returned on request in accordance with that agreement.

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including access controls, encryption in transit, and restricting access to personal data to personnel and processors who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to maintain a level of security appropriate to the risk.

If you are located in the UK, you have rights under UK GDPR. If you are located in the EEA, you have equivalent rights under the EU GDPR. Depending on the legal basis for processing and applicable law, these rights include:

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — ask us to delete your personal data, subject to legal exceptions
• Right to restriction — ask us to limit how we use your data in certain circumstances
• Right to data portability — request your data in a portable format, where technically feasible and where processing is based on consent or contract
• Right to object — object to processing based on legitimate interests, including for direct marketing
• Right to withdraw consent — withdraw consent at any time, without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, contact us at privacy@nexoryxone.com. We may need to verify your identity before responding, and we will respond within the timeframe required by applicable law.

We would welcome the opportunity to address any concerns before you approach a regulator — please contact us at privacy@nexoryxone.com. If you are in the UK and remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EEA, you have the right to lodge a complaint with your local data protection supervisory authority.

Nexoryx One is a business-to-business (B2B) service intended for business users aged 18 and over. We do not knowingly collect personal data from children, and our website and product are not directed at them. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites, and we encourage you to review their privacy policies before providing any personal data.

We may update this policy from time to time to reflect changes in our practices or for legal, regulatory or operational reasons. We will update the "Last updated" date at the top of this page when we do. We encourage you to review this policy periodically.

If you have questions about this policy or how we handle personal data, contact us at privacy@nexoryxone.com.

• NEXORYX ONE LTD
• Company number: 17427846
• Website: www.nexoryxone.com
• Privacy email: privacy@nexoryxone.com