NEXAQUANTA
Privacy Policy
V2 – Last updated 24 September 2026
PRIVACY POLICY
UZAM LIMITED (“NexaQuanta”, “we”, “us” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain and protect Personal Data when you visit nexaquanta.ai or another NexaQuanta website, portal or online service that links to this Policy (collectively, the “Website”), communicate with us, register for an event, request information, or otherwise interact with us in a business context.
This Policy is a notice, not a contract and not a request for blanket consent. Where consent is legally required-such as for certain non-essential cookies-we will request it separately. If you do not wish to provide optional Personal Data, you may choose not to do so, although some requested features may then be unavailable.
1. Who We Are and Our Privacy Role
For the processing described in this Policy, UZAM Limited (“NexaQuanta”, “we”, “us” or “our”) is the controller responsible for deciding why and how Personal Data is processed. Our registered address and contact details are provided in Section 18.
When NexaQuanta processes Personal Data contained in a customer’s systems, applications or use of our AI, cloud, technical or professional services solely on that customer’s documented instructions, NexaQuanta generally acts as a processor or service provider. That processing is governed by the applicable customer agreement, Statement of Work, Data Processing Agreement, and customer privacy notice, rather than this Website Privacy Policy.
Customer-specific restrictions concerning where customer data may be accessed or processed remain binding. NexaQuanta will enforce those restrictions through written contractual instructions, role-based access controls and appropriate technical measures.
Personal Data submitted in connection with employment, contracting or recruitment is governed by NexaQuanta’s Applicant Privacy Notice. Applicant and workforce processing is outside the scope of this Website Privacy Policy.
2. Scope
This Policy applies to Personal Data collected through the Website and related business interactions, including Website browsing, contact forms, demo requests, proposals, marketing subscriptions, events, business correspondence and authorised Website accounts.
This Policy does not apply to:
• customer-controlled Personal Data processed under a customer agreement and Data Processing Agreement;
• applicant or workforce Personal Data governed by a separate Applicant or Workforce Privacy Notice;
• third-party websites, products or services governed by their own privacy notices; or
• activities for which NexaQuanta provides a separate privacy notice at the point of collection.
3. Personal Data We Collect
| Category | Examples | Typical source |
|---|---|---|
| Identity and contact data | Name, business email, telephone number, company, role, country, address and communication details. | You; your employer; business contacts; public professional sources. |
| Enquiry and relationship data | Contact-form content, demo requests, meeting notes, correspondence, preferences, contract and account relationship information. | You; your organisation; NexaQuanta personnel. |
| Website and device data | IP address, browser, operating system, device identifiers, approximate location, timestamps, referring pages, viewed pages, clicks, performance and security logs. | Automatically from your device, cookies, pixels, logs and security tools. |
| Cookie and advertising data | Consent choices, cookie identifiers, campaign source, ad interaction and audience/measurement information. | Cookie tools and, if enabled, analytics, LinkedIn, Meta or other advertising partners. |
| Event and marketing data | Registrations, attendance, interests, newsletter subscription, campaign engagement and opt-out status. | You; event or marketing platforms; business partners. |
| Account and support data | Username, authentication records, support tickets, service interactions and account administration information. | You; your organisation; our systems. |
| Professional and recruitment data | CV, employment history, education, qualifications, work authorisation, application and interview data. | You; referees; recruitment platforms-if recruitment is within this Policy. |
| Audio/visual data | Images, recordings or event photographs where notice is provided. | Events, meetings or content you submit. |
| Inferences | Likely business interests, lead scoring or engagement indicators based on interactions. | Derived from lawful business and Website interactions. |
| Sensitive Personal Data | We do not intentionally request sensitive or special-category Personal Data through general Website forms. If such information is genuinely necessary for a specific purpose, we will provide additional notice and obtain any authorisation required by applicable law. Please do not submit confidential customer datasets, credentials, financial account information, health information or regulated production data through a general Website form. | You, only when necessary and permitted. |
Please do not submit confidential customer datasets, special-category data, credentials, financial account information or regulated production data through a general Website form unless NexaQuanta has expressly requested it through an approved secure channel.
4. How We Collect Personal Data
• Directly from you when you complete and submit a form, request a demo, communicate with us, subscribe to marketing, attend an event or create an authorised Website account.
• Automatically through server logs, security tools, cookies, software development kits, pixels and similar technologies, subject to consent requirements.
• From your employer or organisation in connection with a prospective or existing business relationship.
• From service providers and partners, including hosting, CRM, analytics, event, marketing and recruitment providers.
• From professional networks and public business sources where collection is lawful and reasonably expected.
5. Purposes and Legal Bases
Where EU or UK data-protection law applies, we rely on the legal bases below. The applicable basis depends on the context. We do not rely on consent where another basis is more appropriate, and withdrawing consent does not affect prior lawful processing.
| Purpose | Typical data | EU/UK legal basis |
|---|---|---|
| Respond to enquiries, demos and proposals | Identity, contact, enquiry and relationship data | Steps at your request before contract; legitimate interests in business communications. |
| Provide and administer Website, accounts and services | Identity, contact, account, device and support data | Contract; legitimate interests in service administration. |
| Operate, secure and troubleshoot | Device, security, logs, account and interaction data | Legitimate interests in cybersecurity, fraud prevention, availability and service integrity; legal obligation where applicable. |
| Business relationship management | Contact, role, correspondence, contract and meeting data | Contract; legitimate interests in managing customers, suppliers and partners. |
| Marketing and events | Contact, preferences, event and engagement data | Consent where required; otherwise legitimate interests subject to opt-out and electronic-marketing law. |
| Analytics and Website improvement | Cookie, device, usage and interaction data | Consent for non-essential technologies where required; legitimate interests for strictly necessary and privacy-preserving analytics where permitted. |
| Legal, compliance and claims | Relevant records, communications and security data | Legal obligation; legitimate interests in legal rights, audits, compliance and dispute management. |
| Corporate transactions | Relevant business, account and relationship data | Legitimate interests in evaluating and completing a transaction; legal obligation. |
| AI-enabled assistance or analysis | Inputs, interaction data and generated outputs described at collection | Contract, steps before contract, legitimate interests or consent depending on use; additional safeguards for regulated or high impact uses. |
Where we rely on legitimate interests, we consider the purpose and necessity of the processing and its potential effect on individuals. We will not rely on legitimate interests where an individual’s rights and interests override ours.
6. Cookies and Similar Technologies
We use strictly necessary technologies to operate and secure the Website. We use analytics, functional or advertising technologies only as described in our Cookie Notice and, where required, after obtaining consent. You may review or change your non-essential cookie choices through Cookie Preferences
Where applicable law requires Nexa Quanta to recognise a valid opt-out preference signal, and the signal applies to the relevant browser or device, we will process that signal as required by law.
| Category | Purpose | Consent approach |
|---|---|---|
| Strictly necessary | Security, network management, load balancing, session and consent records. | Used where necessary for the Website; not disabled through the consent tool where legally exempt. |
| Preferences | Remember language, region or interface settings. | Consent where required. |
| Analytics | Understand visits, performance, navigation and Website effectiveness. | Prior consent in the EEA/UK and other jurisdictions where required. |
| Advertising / social media | Campaign attribution, audience measurement, cross-site tracking or social integrations. | Prior opt-in consent where required; California opt-out if activity is "sale" or "sharing". |
7. AI and Automated Processing
This Website Privacy Policy governs Website and business-contact Personal Data. It does not govern customer content processed under a customer agreement and Data Processing Agreement. Any permitted use of customer content, including processing involving AI model providers, is determined by the applicable customer contract, Data Processing Agreement, approved technical configuration, and NexaQuanta’s AI governance policies.
We may use automated tools to route enquiries, identify spam, support Website security, summarise communications, or prioritise business follow-up. We do not use Website Personal Data to make decisions about individuals solely by automated means where those decisions produce legal or similarly significant effects, unless permitted by applicable law and accompanied by the required notice and safeguards.
• We do not use confidential customer content or production data to train general-purpose models for other customers unless the relevant customer expressly authorises that use under its contract.
• AI outputs may be inaccurate and should be reviewed by appropriately authorised personnel before being used for consequential decisions.
• Where required, we provide a means to request human review, express a viewpoint and contest a qualifying automated decision.
8. How We Disclose Personal Data
We disclose Personal Data only as reasonably necessary for the purposes described above, subject to contractual, organisational and legal safeguards. Recipients may include:
• Affiliates within the Nexa Quanta group that support our operations, subject to appropriate access controls and transfer safeguards.
• Service providers supporting cloud hosting, cybersecurity, Website operations, CRM, communications, analytics, cookie management, events, recruitment, professional advice and customer support.
• Authorised business partners where you request or reasonably expect a joint interaction and appropriate notice has been provided.
• Professional advisers, auditors, insurers, banks and investors subject to confidentiality obligations.
• Public authorities, courts, law-enforcement or regulators where disclosure is required or permitted by law and proportionate.
• A buyer, investor or successor in connection with a merger, financing, restructuring, sale or similar transaction, subject to confidentiality and appropriate notice where required.
NexaQuanta does not sell Personal Data or share Personal Data for cross-context behavioural advertising, as those terms are defined under applicable privacy law.
9. International Transfers
Nexa Quanta operates internationally. Personal Data may be accessed, stored or otherwise processed outside the country in which it was collected, including by our affiliates and by service providers acting on our behalf. We do not transfer Personal Data to another country unless the transfer is permitted by applicable data-protection law. Those countries may have data-protection laws that differ from the laws of the country in which the Personal Data was collected.
Where EU or UK transfer restrictions apply, we use an applicable lawful mechanism, such as an adequacy regulation/decision, the European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, together with transfer-risk assessments and supplementary safeguards where required. Where no such mechanism is available and applicable law permits us to rely on your explicit consent, we will inform you of the possible risks and obtain your explicit consent before making the transfer, and you may withdraw that consent at any time. We do not otherwise transfer Personal Data internationally.
You may request information about the countries concerned and the safeguards we apply by contacting us using the details in Section 18, subject to appropriate redactions for confidentiality and security reasons.
10. Retention
We retain Personal Data only for as long as reasonably necessary for the purposes described in this Policy. In determining the relevant period, we consider the nature and sensitivity of the data, the purpose of processing, the duration of the relationship, legal and regulatory requirements, security requirements, applicable limitation periods and the need to establish, exercise or defend legal claims.
• Website and security logs: retained under the approved security and logging schedule and for longer only where necessary to investigate an incident or comply with law.
• Cookies and analytics identifiers: retained for the periods stated in the Cookie Notice or consent-management tool.
• Enquiries and proposals: retained until the enquiry is resolved and for a reasonable follow-up and legal-claims period.
• Customer and supplier business records: retained during the relationship and afterwards for applicable contractual, tax, accounting, audit and limitation periods.
• Marketing records: retained until the individual opts out, withdraws consent or the approved inactivity period expires. A suppression record may be retained to honour the opt-out.
• Privacy requests and complaints: retained for the period required by applicable law and for any related limitation period.
11. Security
We use technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and access. Measures may include access controls, multi-factor authentication, encryption, logging, vulnerability management, secure development, backup and recovery, personnel confidentiality, supplier controls and incident response. No method of transmission or storage is completely secure, but we maintain controls proportionate to the nature and risk of the processing.
If a Personal Data Breach occurs, we will investigate and provide notifications to authorities or affected individuals where required by applicable law.
12. Your Privacy Rights
To exercise an applicable privacy right, email [email protected] and describe the right you wish to exercise. We may request information reasonably necessary to verify your identity, authority and the scope of the request. We may deny or limit a request where permitted by applicable law and will explain the basis where legally required.
We will respond within the period required by applicable law and will not discriminate against an individual for exercising a legally protected privacy right.
Direct marketing objection
You may object to direct marketing at any time. Use the unsubscribe link in an email or contact [[email protected]]. We may retain limited suppression information to honour your choice.
Submit a request through by email to [[email protected]], or through another method required in the jurisdiction-specific section. We may verify your identity and authority. We will respond within the applicable legal period. We do not ordinarily charge a fee, but may charge or refuse a request where permitted by law, for example, if it is manifestly unfounded or excessive.
13. Children
The Website is intended for business users and is not directed to children. We do not knowingly collect Personal Data from children under 16 Age required by applicable law through the Website. If you believe a child has provided Personal Data without appropriate authorisation, contact us so we can investigate and take appropriate action. We do not knowingly sell or share the Personal Data of consumers under 16 for cross-context behavioural advertising.
14. Third-Party Sites and Services
The Website may link to third-party sites, social networks or services. Their privacy practices are governed by their own notices. A link does not mean Nexa Quanta controls or endorses their privacy practices. Review the relevant notice before providing Personal Data.
15. Changes to This Policy
We may update this Policy to reflect changes in law, technology or our practices. We will update the “Last updated” date and provide additional notice of material changes where required, such as a prominent Website notice or direct communication. We will request new consent if a change requires it.
16. Jurisdiction-Specific Provisions
The following provisions supplement the main Policy when the relevant law applies. If a supplemental provision conflicts with the main Policy, the supplemental provision controls for the relevant jurisdiction.
16.1 – European Economic Area – GDPR
• The controller identity, contact details, purposes, legal bases, categories, recipients, transfers and retention information are stated in this Policy and must be completed before publication.
• You may lodge a complaint with the Supervisory Authority in your habitual residence, place of work or place of the alleged infringement. We encourage you to contact us first, but this is not a condition of complaining.
• If Article 27 GDPR requires an EU representative, its details are: [email protected]
• Data Protection Officer, contact details are [email protected]
16.2 – United Kingdom – UK GDPR and Data Protection Act 2018
• UK individuals have applicable rights described in Section 12 and may complain to the Information Commissioner’s Office at ico.org.uk.
• Restricted UK transfers use an applicable adequacy regulation, UK IDTA, UK Addendum or another lawful mechanism, with risk assessment where required.
• If Article 27 UK GDPR requires a UK representative, its details are: [email protected]
• NexaQuanta will account for applicable changes under the Data (Use and Access) Act 2025 and related commencement regulations when implementing this Policy and rights procedures.
17. Additional United States Privacy Rights
Residents of certain US states may have privacy rights under applicable state law, including rights to access, correct, delete or obtain a copy of Personal Data and opt out of targeted advertising, sale or certain profiling. Submit a request using Section 18. We will apply the law relevant to your verified residence and our legal status, including any appeal process required by law.
18. Contact Us
| Contact purpose | Details |
|---|---|
| Controller | NEXAQUANTA |
| Registered address | 60 Tottenham Court Road, Suite 1198a, Fitzrovia, London, United Kingdom, W1T 2EW |
| Privacy enquiries / rights | [email protected] |
| Security reports | [email protected] |
| EU representative | [email protected] |
| UK representative | [email protected] |