Legal

Privacy Policy

We are committed to protecting your personal data, maintaining transparency, and honoring your right to privacy.

Contents

1. Who We Are

This Privacy Policy explains how NexaFlow AI Ltd (“NexaFlow”, “we”, “us” or “our”) collects, uses, stores and protects your personal data when you visit our website, contact us, or use our products and services.

  • Company name: NexaFlow AI Ltd
  • Registered address: 10 Griffin Drive East, Ard Griffin, Cork, Ireland, P25 Y6C8
  • Email: sales@nexaflow.ie
  • Regulatory body: We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

NexaFlow AI Ltd is the data controller responsible for the personal data described in this policy.

2. Information We Collect

We collect information that you provide to us directly, information collected automatically when you use our website, and information we receive from business partners. This may include:

Information you provide directly

  • Your name and job title;
  • Your business name and business address;
  • Your email address and telephone number;
  • Details of your enquiry, project requirements, and any files you share with us;
  • Communications you send to us by email, phone, WhatsApp or through our contact forms;
  • Billing and invoicing details where you engage us as a client.

Information we collect automatically

  • Technical data such as your IP address, browser type, device type and operating system;
  • Pages you visit, time spent on the site and referring URLs;
  • Cookie data as described in Section 5.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • To respond to enquiries and provide you with information about our services;
  • To deliver, manage and support the services you engage us for;
  • To prepare proposals, quotations and contracts;
  • To invoice and process payments;
  • To communicate with you about your project or account;
  • To send marketing communications where you have consented to receive them;
  • To improve our website, services and customer experience;
  • To comply with our legal and regulatory obligations;
  • To prevent fraud and ensure the security of our systems.

We do not sell your personal data to third parties.

Under the GDPR, we rely on the following legal bases for processing your personal data:

  • Consent — where you have given us clear permission to process your data for a specific purpose, such as receiving marketing emails. You may withdraw your consent at any time;
  • Performance of a contract — where processing is necessary to provide services you have contracted us to deliver, or to take steps at your request before entering a contract;
  • Legitimate interests — where we have a genuine and legitimate business interest in processing your data (for example, to improve our website and respond to enquiries), provided your rights do not override those interests;
  • Legal obligation — where we are required to process your data to comply with the law, such as tax and accounting obligations.

5. Cookies & Tracking

Our website uses cookies and similar technologies to improve functionality and understand how visitors use the site. Cookies are small text files stored on your device.

We use:

  • Strictly necessary cookies — required for the website to function correctly;
  • Analytics cookies — to understand how visitors interact with our site so we can improve it;
  • Functional cookies — to remember preferences you have selected.

You can control or delete cookies through your browser settings at any time. Please note that disabling certain cookies may affect how our website functions.

6. Sharing Your Information

We do not sell your personal data. We may share your information with trusted third-party processors who help us operate our business, including:

  • Hosting and infrastructure providers;
  • Email and communication platforms;
  • Customer relationship management (CRM) tools;
  • Accounting, invoicing and payment processors;
  • Analytics providers;
  • AI and large language model (LLM) providers used to deliver our services (see Section 7).

Where we share data with processors, we do so under contract and only for the purposes described in this policy. We may also disclose your information where required by law or to protect the rights, property or safety of NexaFlow, our clients, or others.

7. AI & Automation Services

As part of delivering our AI and automation services, client-provided data may be processed by third-party AI providers such as OpenAI, Anthropic and similar platforms. In these cases:

  • We only process data necessary to deliver the specific service;
  • We select providers that are compliant with applicable data protection law and EU data processing requirements;
  • We require that providers do not use your data to train their models unless you have given specific consent;
  • You will be informed in advance if your project requires the processing of special categories of data.

Where you provide access to your own business systems (such as CRMs, calendars or accounting software), we process only the data required to perform the agreed automation.

8. International Transfers

Some of our service providers may store or process data outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as:

  • European Commission adequacy decisions, or
  • Standard Contractual Clauses (SCCs) approved by the European Commission.

If you would like more information about the safeguards applied to international transfers of your data, please contact us.

9. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, including to meet legal, accounting and reporting requirements.

  • Enquiry and correspondence data: retained for up to 24 months following the last contact;
  • Client project and contract data: retained for the duration of the contract plus 6 years to meet tax and accounting obligations;
  • Marketing data: retained until you withdraw consent or opt out;
  • Website analytics data: retained in aggregated form for up to 26 months.

When data is no longer required, it is securely deleted or anonymised.

10. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:

  • Encryption of data in transit and at rest where appropriate;
  • Access controls restricting data to personnel who need it;
  • Regular security reviews of our systems and processes;
  • Data processing agreements with third-party providers.

While no method of transmission or storage is completely secure, we work hard to protect your information and to comply with our legal obligations.

11. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

  • Right of access — to receive a copy of the personal data we hold about you;
  • Right to rectification — to have inaccurate data corrected;
  • Right to erasure — to have your data deleted, subject to legal obligations;
  • Right to restrict processing — in certain circumstances;
  • Right to data portability — to receive your data in a structured, machine-readable format;
  • Right to object — to processing based on legitimate interests or for direct marketing;
  • Right to withdraw consent — at any time, where processing is based on consent;
  • Right to complain — to the Irish Data Protection Commission.

To exercise any of these rights, contact us at sales@nexaflow.ie. We will respond within one month of receiving your request. If you are not satisfied with our response, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC) at www.dataprotection.ie.

12. Children’s Privacy

Our website and services are intended for businesses and are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to remove that information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If we make significant changes, we will take reasonable steps to notify you, such as updating this page or contacting you directly.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

NexaFlow AI Ltd
10 Griffin Drive East, Ard Griffin, Cork, Ireland, P25 Y6C8
Email: sales@nexaflow.ie
Website: nexaflow.ie