Legal
Privacy policy
What we collect, why we collect it, how long we keep it, and what you can ask us to do about it.
Effective from [to confirm]
Who we are
Nexur Technology Ltd is a software development agency based in High Wycombe, Buckinghamshire, United Kingdom. We are the data controller for the personal data described in this notice, which means we decide why and how it is processed.
This notice explains what we collect, why, how long we keep it, and the rights you have under the UK GDPR and the Data Protection Act 2018. If you are in the EU, the EU GDPR gives you equivalent rights.
What we collect, and why
We only collect what we need for a specific purpose. We do not buy personal data, and we do not sell or rent yours.
| What | When | Why | Lawful basis |
|---|---|---|---|
| Name, email, phone, company and your message | You submit the contact form | To read your enquiry and reply to it | Legitimate interests: responding to someone who has asked us to |
| Email address and the answers you give | You take part in an assessment or audit | To produce the report you asked for | Contract, or steps taken at your request before one |
| Project details, documents and notes you upload | You use the client portal | To deliver the work you have engaged us for | Contract |
| Pages visited, approximate location, device and browser | Only if you accept analytics cookies | To understand which pages are useful | Consent, which you can withdraw at any time |
| Your cookie choices | You respond to the cookie banner | To remember your preference and stop asking | Legal obligation, and strictly necessary |
We do not ask for special category data such as health, ethnicity or political opinions, and we would prefer you did not include any in a contact message.
What happens to a contact form submission
It is worth being specific here, because it is the thing most visitors do. When you submit the contact form, the contents are emailed to us. They are not written to a database or added to a marketing list.
Before the message is sent, it passes through Google reCAPTCHA so that we are not overwhelmed by automated spam, and through a rate limit that counts submissions per IP address for a short period. Google receives the information needed to run that check, which is governed by its own privacy notice.
We reply from a business mailbox, so your message and our reply are retained there as part of our ordinary correspondence.
How long we keep it
- Contact enquiries: Contact enquiries: 12 months after our last communication
- Client project data: For the duration of the project and up to 12 months after project completion
- Cookie preferences: 12 months from the date you set them
- Analytics data: as configured in Google Analytics, and only collected with consent
- Records we must keep for tax or accounting purposes: six years, as required by law
When a retention period ends, data is deleted or anonymised so it can no longer identify you.
Your rights
Under the UK GDPR you have the following rights. They are free to exercise, and we will respond within one month.
- Access: ask for a copy of the personal data we hold about you
- Rectification: have anything inaccurate corrected
- Erasure: ask us to delete it, where we have no overriding reason to keep it
- Restriction: ask us to pause processing while a concern is resolved
- Portability: receive data you gave us in a machine-readable format
- Objection: object to processing we carry out under legitimate interests
- Withdraw consent: for anything based on consent, such as analytics cookies, at any time
To exercise any of these, email info@nexur.co.uk. We may ask you to confirm your identity first, so that we do not disclose someone's data to the wrong person.
If you are unhappy with how we have handled your data, please tell us so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113.
How we protect it
- All traffic to this site is encrypted with HTTPS, enforced by HSTS
- Client portal access requires authentication, and admin access requires a second factor
- Access to client data is limited to the people working on that engagement
- Forms are rate limited and protected against automated abuse
- Our infrastructure is hosted on Microsoft Azure with encryption at rest
No system is perfectly secure. If a breach ever affected your rights and freedoms, we would notify the ICO within 72 hours and tell you directly where the risk to you was high.
Children
This site is aimed at businesses and is not intended for children. We do not knowingly collect data from anyone under 13. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this notice
If we change how we handle personal data, we will update this page and change the effective date. Where a change is significant, we will draw attention to it rather than rely on you noticing.
Contact us
Questions about this notice, or about how we handle your data, can go to either of these. Email is usually fastest.
- info@nexur.co.uk
- Telephone
- +442039962514
- Registered office
- High Wycombe, Buckinghamshire, United Kingdom
- Company
- Nexur Technology Ltd