Privacy Policy
Last Updated: September 2026
NEXQAF LTD (“we”, “our”, “us”) is dedicated to protecting your privacy and handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains how we collect, process, disclose, and safeguard information collected through our website (https://www.nexqaf.com) and our client service workflows.
1. Data Controller
NEXQAF LTD is the designated Data Controller responsible for your personal data.
Company Registration Number: 17447438
Registered Office: 128 City Road, London, EC1V 2NX, United Kingdom
Phone: +44 7480 248540
Data Protection & Privacy Contact: contact@nexqaf.com
2. Personal Data We Collect
We collect personal and business information strictly necessary to provide our digital and WaaS services:
Identity and Contact Data: Name, business name, business email address, and job title.
Financial & Transactional Data: Payment card details and transaction records. (Full card details are processed directly by our PCI-DSS compliant processors; we do not store full payment card numbers on our servers).
Technical and Access Data: IP addresses, browser specifications, operating systems, and device identifiers collected automatically when interacting with our website.
Service & Marketing Data: Campaign tracking, form submissions, and interaction records generated through client ad campaigns (Meta, Google) and CRM automations.
3. Lawful Basis for Processing
We process your personal information under the following UK GDPR lawful bases:
Performance of a Contract: To deliver web development, CRM setup, cloud hosting, AI workflows, and digital marketing services, and to process subscription billings.
Legitimate Interests: To monitor infrastructure security, prevent fraudulent transactions, analyze web performance, and improve our services.
Legal Obligation: To maintain accurate financial, tax, and accounting records in compliance with UK statutory requirements (HMRC).
Consent: Where explicitly provided, to send relevant digital agency newsletters or service updates.
SMS & Communications: By providing a telephone number and submitting our forms, you consent to receive SMS notifications and marketing messages. Message and data rates may apply. You can opt-out at any time by replying STOP.
4. Third-Party Service Providers & Sub-Processors
We do not sell, rent, or lease personal data. We share necessary data only with verified third-party providers who support our core operations:
Payment & Financial Gateways: Stripe, Airwallex, Wise, and PayPal (for international payment processing, banking, and subscription billing).
Telephony & SMS Infrastructure: Twilio & HighLevel (GoHighLevel) (for automated client communications and messaging workflows).
CMS & CRM & Hosting Infrastructure: HighLevel (GoHighLevel), AI Website Builder, WordPress, Webflow, Framer, Lovable, Hostinger, Cloudways and Amazon Web Services (AWS) (for client portals, database storage, and hosting).
Marketing & Analytics: Google Analytics, Meta Business Suite, and Google Ads (for tracking campaign performance and user analytics).
SMS Data Protection Clause: No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
5. International Data Transfers
To provide international B2B services, your data may be transferred to and processed in countries outside the United Kingdom (including the United States). When such transfers occur, we implement appropriate safeguards, including UK International Data Transfer Agreements (IDTAs) and Standard Contractual Clauses (SCCs), to ensure data protection standards equivalent to UK GDPR.
6. Data Retention
We retain personal data only for as long as required to fulfill the operational purposes for which it was gathered. Financial and transaction records are retained for six (6) years following the end of the relevant financial year to comply with UK company and tax laws.
7. Your Data Rights
Under UK data protection legislation, you have the following rights regarding your personal data:
Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete information.
Right to Erasure (“Right to be Forgotten”): Request deletion of personal data where no legal ground exists for continued processing.
Right to Restrict or Object to Processing: Object to data processing based on legitimate interests or direct marketing.
Right to Data Portability: Request transfer of your data to another service provider in a structured, machine-readable format. To exercise any of these rights, email: contact@nexqaf.com. Requests are processed free of charge within 30 days.
8. Regulatory Oversight & Complaints
If you believe your personal data has been handled improperly, you have the right to lodge a formal complaint with the UK supervisory authority: Information Commissioner’s Office (ICO) Website: https://ico.org.uk | Helpline: 0303 123 1113
9. Contact Us
For questions, notices, or requests regarding this Privacy Policy, please contact us at: contact@nexqaf.com.