PRIVACY POLICY

1. Who We Are

Nextena Limited is a software development consultancy registered in England & Wales. We are the data controller responsible for the personal data collected through this website.

Registered address: United Kingdom
Data protection enquiries: legal@nextena.com

2. What Data We Collect

Depending on how you interact with us, we may collect:

• Contact information (name, email address) submitted via our enquiry or contact form.

• Usage data — pages visited, time on site, referrer URL — collected via analytics cookies only with your consent.

• Technical data — IP address, browser type, device type — automatically collected by our hosting infrastructure.

• Communications data when you email or message us directly.

We collect only what is necessary for the purposes described in this policy.

3. How We Use Your Data

We use the data we collect to:

• Respond to your enquiries and deliver the services you have requested.

• Improve our website and user experience using aggregated, anonymised analytics.

• Maintain the security and integrity of our systems.

• Comply with our legal and regulatory obligations.

We do not sell, rent, or trade your personal data to third parties.

4. Legal Basis for Processing

We rely on the following lawful bases under UK GDPR:

• Consent — for analytics and marketing cookies (you can withdraw at any time).

• Contract — to fulfil services you have engaged Nextena to perform.

• Legitimate interests — for security monitoring and continuous service improvement.

• Legal obligation — where processing is required to comply with applicable law.

5. Data Retention

We retain your data only as long as necessary for its stated purpose:

• Enquiry and correspondence data — up to 2 years from last contact.

• Analytics data — aggregated and anonymised after 26 months.

• Financial and legal records — up to 7 years as required by UK law.

6. Third-Party Services

Our website uses third-party services that may process your data on our behalf:

• Sanity.io — headless CMS powering our blog and website content.

• Vercel — website hosting and edge network.

• Google Analytics (only if accepted via cookie consent) — website usage analytics.

All third-party processors are bound by data processing agreements that ensure your data is handled lawfully and securely.

7. International Transfers

Some of our third-party providers may process data outside the UK or EEA. Where this occurs, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses or an adequacy decision — in accordance with UK GDPR Chapter V.

8. Your Rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.

• Rectification — ask us to correct inaccurate or incomplete data.

• Erasure — request deletion of your data ("right to be forgotten"), subject to legal obligations.

• Restriction — ask us to limit how we use your data in certain circumstances.

• Data portability — receive your data in a structured, machine-readable format.

• Object — object to processing based on our legitimate interests.

• Withdraw consent — at any time for consent-based processing, without affecting prior processing.

To exercise any of these rights, email us at legal@nextena.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

9. Cookies

This website uses cookies. For full details of the cookies we set and how to manage your preferences, please read our Cookie Policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Where changes are material, we will take reasonable steps to bring them to your attention.