Data protection matters to us.

Privacy Policy

This Privacy Policy explains how Nexops360 LLC processes your personal data when you visit our website, use our Project Builder, contact us, buy a Check, or engage our consulting services. It also explains what rights you have under applicable data protection laws.

We believe that transparency is an essential component of responsible business relationships. This Privacy Policy is provided to meet our legal obligations and clearly outline how we handle personal data.

We are a company established in the United States and we work with clients internationally. Which data protection law applies to you depends on where you are. Section 2 explains this.

1. Who is responsible

Nexops360 LLC

3833 Powerline Rd, Suite 701/M, Fort Lauderdale, FL 33309, United States

Data protection enquiries: legal@nexops360.com

General enquiries: hello@nexops360.com

We are the controller for the processing described in this Policy, except where we process personal data on behalf of a client. Section 9 explains that case.

2. Who we work with and which law applies to you

Who we work with. Our website and our services are directed at business customers. We do not knowingly process the personal data of children.

Which law applies to you. We are established in the United States and our clients are in a number of countries. Which data protection law applies to you depends on where you are. The countries below are listed alphabetically.

Australia. We handle personal information about individuals in Australia in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We give this commitment in our contracts and we apply it here.

European Economic Area. The General Data Protection Regulation applies. Where section 3 states a legal basis, it cites that Regulation.

New Zealand. The Privacy Act 2020 applies to us, because we carry on business in New Zealand within the meaning of that Act. Its Information Privacy Principles govern what we collect, how we use it and when we disclose it.

Switzerland. The Federal Act on Data Protection applies, because it covers processing that has an effect in Switzerland. Where section 3 states a legal basis under the GDPR, we rely on the corresponding basis under that Act. Section 10 sets out your rights.

United Kingdom. The UK GDPR and the Data Protection Act 2018 apply. Where section 3 cites an Article of the GDPR, the equivalent provision of the UK GDPR applies to you.

United States. No general federal privacy law applies to our processing. Some states give their residents specific rights, and where those apply to us we honour them. We apply the standard set out in this Policy to you in any event.

Anywhere else. We apply the standard set out in this Policy to everyone, wherever you are.

3. What we process and why

Where we state a legal basis below, we cite the General Data Protection Regulation, because it is the only law listed in section 2 that requires a legal basis to be named for each purpose. Section 2 explains what applies to you under the other laws.

3.1 Visiting our website

When you visit nexops360.com, our hosting provider automatically processes technical access data, including your IP address, the date and time of access, the pages requested, browser type, operating system and referring page. This is necessary for the secure and stable operation of the website.

Legal basis: our legitimate interest in operating a secure and functioning website, Article 6(1)(f) GDPR.

3.2 Analytics

With your consent, we use analytics tools to understand how visitors use our website. Our Cookie Policy describes them in detail. In summary:

Google Analytics 4 and Google Tag Manager, provided by Google LLC, United States. We receive pages visited, session duration, approximate location at country or region level, device type, browser type and the source of your visit. IP anonymisation is enabled, so your IP address is truncated before transmission to Google.
Platform analytics within our website builder, provided by Hostinger and using Amplitude, Inc., United States. This collects usage data that does not directly identify you.

Neither tool is loaded before you give consent. Both can be switched off at any time through the cookie settings on our website.

Legal basis: your consent, Article 6(1)(a) GDPR, and the national law on cookies and similar technologies that applies to you, which in the European Union is the law implementing the ePrivacy Directive and in the United Kingdom is the Privacy and Electronic Communications Regulations 2003. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

3.3 Contacting us

If you contact us by email or through a form, we process the data you provide, which typically includes your name, business email address, company name and the content of your message, in order to respond.

Legal basis: performance of a contract or steps taken at your request before entering into a contract, Article 6(1)(b) GDPR, and our legitimate interest in responding to business enquiries, Article 6(1)(f) GDPR.

3.4 The Project Builder

Our Project Builder helps you describe what you want to improve and shows you an indicative route. While you are completing it, your answers stay in your browser and are not stored by us.

Your data is transmitted to us only when you actively choose to have your result sent to you by email or to request a review. At that point we process the business and contact details you provide, together with your answers, in order to respond and to prepare a proposal.

Legal basis: steps taken at your request before entering into a contract, Article 6(1)(b) GDPR.

The Project Builder does not make any decision that produces a legal effect for you or similarly significantly affects you. Any route or price range it shows is indicative and is reviewed by a person before we contact you.

3.5 Buying a Check

When you buy a Small Business Check or a Business Operations Check, we process your name, business contact details, company and billing address, tax registration number where you provide one, your order and payment data, your intake form answers, any material you upload or send us, your booking data, and the result we produce for you.

Card details are entered directly with our payment provider and are not stored by us.

Legal basis: performance of a contract, Article 6(1)(b) GDPR, and compliance with legal obligations in respect of invoicing and accounting, Article 6(1)(c) GDPR.

3.6 Project engagements

When you engage us for a Focused Fix, an Improvement Project or an Improvement Programme, we process contact and company data, contract and billing data, project content such as process documentation and workshop material, and communication data.

Where that material contains personal data about your employees or third parties, we process it on your behalf as a processor. Section 9 explains what that means.

Legal basis: performance of a contract, Article 6(1)(b) GDPR, and compliance with legal obligations, Article 6(1)(c) GDPR.

3.7 Meetings, recordings and transcripts

We hold meetings by video conference. We record or transcribe a meeting only where all participants have agreed beforehand. We ask at the start of the meeting and record the agreement. Transcripts are produced by the transcription function of our meeting system and are stored within that system.

You can ask us not to record or transcribe at any time, and you can ask us to delete a recording or transcript.

Legal basis: your consent, Article 6(1)(a) GDPR.

3.8 Newsletter and marketing emails

If you opt in, we send you occasional insights, resources and operational updates. We confirm your subscription by a confirmation email before we start sending, and we process whether and when you open a message and which links you click, in order to understand what is useful.

You can unsubscribe at any time using the link in any message or by writing to legal@nexops360.com.

Legal basis: your consent, Article 6(1)(a) GDPR.

3.9 Messaging on request

Where you ask us to communicate with you through WhatsApp, we do so only for scheduling and short organisational messages. We do not send project content, documents or personal data about third parties that way. If you prefer not to use it, we use email or our own systems.

Legal basis: your consent, Article 6(1)(a) GDPR.

3.10 Spam protection on our forms

Our forms use a captcha provided by Zoho as part of its form service, processed within the European Union. It may process your IP address, device information and interaction data in order to detect automated abuse.

Legal basis: our legitimate interest in protecting our website and our users from automated abuse, Article 6(1)(f) GDPR.

3.11 Business records and security

We keep records of our contracts, invoices, correspondence and security events, and we maintain access and incident records for the security of our own systems.

Legal basis: compliance with legal obligations, Article 6(1)(c) GDPR, and our legitimate interest in running and securing our business, Article 6(1)(f) GDPR.

3.12 Business contact details we obtain from other sources

We sometimes identify businesses that may benefit from our services and approach the person responsible. For that purpose we process business contact details, such as name, role, business email address, business telephone number and publicly available professional profile information, obtained from the company's own website, from public professional networks, from business registers and from comparable sources.

When we contact you for the first time on this basis, we tell you where we obtained your details, why we are writing to you, and how to stop it. You can object at any time by replying or by writing to legal@nexops360.com, and we will then delete your details. We do not use this data for anything other than approaching you about our services.

Legal basis: our legitimate interest in direct business-to-business marketing, Article 6(1)(f) GDPR. Article 14 GDPR governs the information we give you when we did not obtain your data from you. Where the New Zealand Privacy Act 2020 applies, Information Privacy Principle 3A applies to personal information we collect from a source other than you.

4. Who receives your data

We use the service providers listed below. Each of them processes personal data on our behalf under a data processing agreement, or, where stated, acts as a sub-processor of one of them. The current list is also published at nexops360.com/subprocessors.

Zoho Corporation B.V., Netherlands. European Union. CRM, invoicing, scheduling, automation, email, internal chat, electronic signature, video meetings and transcription, file storage, checkout, email campaigns, documents, forms, analytics, application platform, calendar, tasks, projects.
Hostinger International Ltd., Lithuania. European Union. Website hosting, website builder, server logs, platform usage analytics.
Amplitude, Inc., United States, as sub-processor of Hostinger. Usage analytics within the website builder, with your consent.
Google LLC, United States. Google Analytics 4 and Google Tag Manager, with your consent.
Miro. European Union. Visual collaboration and workshop boards.
Nord Security. European Union (Germany). Encrypted network access and password management.
Stripe Payments Europe Ltd., Ireland. Card payments, through our invoicing and checkout system.
WhatsApp Ireland Ltd. / Meta. International. Messaging, only where you ask us to use it.

We also disclose personal data where we are required to do so by law, or where it is necessary to establish, exercise or defend legal claims, for example to our accountants or legal advisers, who are bound by professional confidentiality.

We do not sell personal data and we do not share it for the purposes of third party advertising.

5. International transfers

We store and process personal data in the European Union wherever we can.

Transfers to Google LLC in the United States take place on the basis of the EU-U.S. Data Privacy Framework, to which Google LLC is certified. For visitors in the United Kingdom the UK Extension to that Framework applies, and for visitors in Switzerland the Swiss-U.S. Data Privacy Framework applies.

Transfers to Amplitude, Inc. in the United States take place on the basis of the contractual safeguards agreed between us and Hostinger.

We are established in the United States. Where personal data is accessible to us there, and you are in the European Economic Area, the United Kingdom or Switzerland, the transfer takes place on the basis of the Standard Contractual Clauses adopted by the European Commission, with the UK Addendum or the Swiss adjustments where applicable, supported by a documented transfer risk assessment. We are not certified under the Data Privacy Framework ourselves.

Where we handle personal information of individuals in Australia, we do so consistently with the Australian Privacy Principles, including APP 8 on cross-border disclosure. Where we handle personal information of individuals in New Zealand, we do so consistently with the Privacy Act 2020, including Information Privacy Principle 12.

You can request a copy of the relevant safeguards by writing to legal@nexops360.com.

6. Cookies

Our website uses cookies and similar technologies. Strictly necessary cookies are always active. Analytics cookies and similar technologies are used only with your consent, which you can give, refuse, change or withdraw at any time through the cookie settings on our website. Our Cookie Policy describes each category and each provider.

7. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal effects for you or similarly significantly affect you.

8. How long we keep your data

Contracts, invoices and accounting records: 10 years.
Project records and working material: 18 months after the end of the engagement.
Check intake answers, uploaded material and results: 18 months after delivery.
Correspondence and communication data: 24 months after the last contact.
CRM records of prospects who do not become clients: 24 months after the last contact.
Meeting transcripts: 90 days.
Newsletter data: until you unsubscribe, then deleted within 30 days.
Server logs: 30 days.
Google Analytics data: 14 months on Google's servers.
Security and access records: 12 months.
Backups: overwritten or irreversibly anonymised within 90 days.

Where a statutory retention obligation requires a longer period, we keep the data for that period and restrict its processing. Where you ask us to delete data earlier and no legal, contractual or accounting obligation prevents it, we will do so.

9. When we act on behalf of a client

When we work on a project for a client, that client's materials, systems and communications may contain personal data about its employees, contractors, customers or partners. In respect of that data our client is the controller and we act as a processor on its documented instructions, under a data processing agreement.

If you are one of those individuals and want to exercise your rights, please contact the business that engaged us. We will support that business in responding.

We ask our clients to limit the personal data in the material they share with us and to redact or anonymise names and personal details that are not needed for the work.

10. Your rights

You have the right to access your personal data, to have inaccurate data corrected, to have data erased, to have processing restricted, to receive your data in a portable format, to object to processing based on legitimate interests, and to withdraw consent at any time, without affecting processing carried out before the withdrawal.

The list above sets out the rights given by the GDPR and the UK GDPR. Under the Swiss Federal Act on Data Protection you have rights of access, correction, deletion and objection, and the right to receive a copy of your data. Under the New Zealand Privacy Act 2020 and the Australian Privacy Principles the core rights are access and correction. We apply the full list above to everyone, wherever you are.

To exercise any of these rights, write to legal@nexops360.com. We respond within one month. Where your request falls under the New Zealand Privacy Act 2020, we respond within 20 working days. If we need longer, we tell you within that period and explain why.

You also have the right to complain to a supervisory authority:

In Australia, the Office of the Australian Information Commissioner, oaic.gov.au.
In the European Union, the data protection authority of your country.
In New Zealand, the Office of the Privacy Commissioner, privacy.org.nz.
In Switzerland, the Federal Data Protection and Information Commissioner, edoeb.admin.ch.
In the United Kingdom, the Information Commissioner's Office, ico.org.uk.

11. Security

We protect personal data using encryption in transit and at rest, multi-factor authentication, role-based access on the principle of least privilege, encrypted remote access, device encryption, and a documented incident response procedure. We review these measures at least annually.

No transmission over the internet is entirely secure. If you need to send us something sensitive, ask us and we will provide a secure upload link.

12. Changes to this Policy

We update this Policy when our processing changes. The version and date at the top tell you which version applies. We keep previous versions and will provide one on request.

13. Language

This Privacy Policy is drawn up in English and may be provided with a German translation for convenience only. In the event of any discrepancy or conflict, the English version prevails and is legally binding. This does not affect any right you have under the data protection law that applies to you, which applies regardless of the language of this Policy.