Skip to main content
NexITC

LEGAL

Privacy Policy

How Nex Information Technology Consultancy handles personal data collected through this website.

Last updated: 15 September 2026 · Effective from: 15 September 2026

1. Introduction

Nex Information Technology Consultancy LLC ("NexITC", "we", "our", "us") is committed to protecting the personal data of visitors to our website and prospective and current clients. This Privacy Policy explains what personal data we collect through nexit365.com, how we use it, how we protect it, and the rights you have in respect of your personal data.

This Privacy Policy is issued under the UAE Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data ("UAE PDPL") and applies to personal data processed in connection with our website and initial engagement enquiries. Personal data processed during an active client engagement is governed by the terms of the applicable statement of work and any accompanying data processing agreement.

2. Data Controller

The data controller responsible for personal data collected via this website is:

Nex Information Technology Consultancy LLC (NexITC)Commercial Licence No. CN-47599241st Floor, Dar Al Salam Building, Al Danah East, Freej Al Qbeesat Street, Abu Dhabi, United Arab EmiratesEmail: info@nexit365.comTelephone: +971 55 2017168

For privacy-specific enquiries, please write to us at info@nexit365.com with "Privacy" in the subject line.

3. Personal Data We Collect

We collect personal data through the following channels:

3.1 Contact Clinic form

When you complete our Contact Clinic form, we collect: your name, work email address, organisation name, role or title, country, the nature of your enquiry, and any additional information you provide voluntarily.

3.2 NexITC Assistant (website chatbot)

When you interact with our website chatbot, we collect: the questions and messages you submit, an ephemeral session identifier held in your browser's sessionStorage for the duration of your visit, and technical metadata (approximate timestamp, session query count) required to operate the rate-limiting mechanism. We do not link chatbot interactions to identified individuals unless you subsequently identify yourself through the Contact Clinic form or direct correspondence.

3.3 Email correspondence

When you correspond with us by email, we collect the contents of your emails and any personal data included therein.

3.4 Website analytics

Following our production launch, we use Google Analytics 4 to understand how visitors use our website. This may include: pages viewed, time on page, referral source, approximate geographic location at city level, device type, browser type, and derived engagement metrics. Google Analytics processes this data using cookies and similar technologies. Please see our Cookie Policy for details.

3.5 Technical logs

Our infrastructure providers automatically collect technical information required to operate the website securely, including: IP addresses, user agent strings, request timestamps, and security-related events (for example, suspected malicious traffic). This information is used for security, fraud prevention, and service reliability purposes.

3.6 What we do not collect

We do not knowingly collect: government identification numbers, financial account details, health information, biometric data, or special-category personal data through this website. If you send us such information voluntarily (for example, in the free-text portion of a Contact Clinic form), we will treat it in accordance with this Privacy Policy but ask that you avoid doing so.

4. How We Use Personal Data

We use personal data for the following purposes:

  • Responding to enquiries. To reply to Contact Clinic submissions, schedule clinics, prepare initial scoping conversations, and follow up on prospective engagements.
  • Providing the website assistant. To operate the NexITC Assistant chatbot, including retrieval of relevant content and generation of responses.
  • Improving the website and services. To understand how visitors use the website, identify content gaps, and improve our services.
  • Security and fraud prevention. To detect, prevent, and respond to malicious activity, fraud, and misuse.
  • Legal and regulatory compliance. To comply with applicable UAE law, including PDPL, and to respond to lawful requests from competent authorities.
  • Commercial record-keeping. For prospective and current clients, to maintain records of interactions relevant to our commercial relationship.

5. Lawful Basis for Processing

Under the UAE PDPL, we rely on the following lawful bases:

  • Consent. Where you provide personal data voluntarily (Contact Clinic form, chatbot interaction, email correspondence), you consent to our processing of that data for the purposes described in this policy. You may withdraw consent at any time as described in Section 10.
  • Contractual necessity. For prospective clients progressing to engagement scoping, processing necessary to prepare and enter into a contract.
  • Legitimate interest. For security, fraud prevention, service reliability, and commercial record-keeping — where those interests are not overridden by your rights.
  • Legal obligation. Where required to comply with applicable law.

6. Retention Periods

We retain personal data for the following periods:

  • Contact Clinic form submissions: 24 months from date of submission, unless the enquiry progresses to an active engagement (in which case commercial retention applies).
  • NexITC Assistant chatbot interactions: Server-side logs are retained for 90 days for operational and quality-monitoring purposes. Browser sessionStorage clears when you close the tab.
  • Email correspondence: 24 months from date of last interaction, unless part of an active engagement.
  • Analytics data: Retained per Google Analytics 4 configured settings (up to 14 months for user and event data).
  • Technical security logs: Up to 30 days, or longer where required to investigate a specific incident.
  • Engagement records (active or completed clients): Retained for the duration of the engagement plus 7 years, aligned with commercial and tax record-keeping requirements applicable to UAE-licensed entities.

Where personal data is no longer required for the purpose for which it was collected, we delete or anonymise it within a reasonable timeframe.

7. Sharing and Cross-Border Transfer

We do not sell personal data.

We share personal data only with:

  • Our service providers (sub-processors) listed in Section 8
  • Competent authorities, where required by applicable law
  • Professional advisers (legal, accounting), where necessary and under confidentiality obligations

Our sub-processors are located outside the UAE. Cross-border transfer of personal data to jurisdictions that may not have an adequacy determination under UAE PDPL is undertaken pursuant to appropriate safeguards, including contractual commitments requiring the recipient to protect personal data to standards materially equivalent to those under UAE PDPL. You have the right to request further information about these safeguards by contacting us as described in Section 13.

8. Sub-Processors

We use the following third-party service providers to operate this website and related services:

Scroll the table sideways to see all columns

ProviderPurposePrimary processing location
CloudflareContent delivery, security, edge infrastructureGlobal network; primary regions include the United States and European Union
AnthropicAI model provider (Claude) for the NexITC AssistantUnited States
Voyage AIText embedding for the NexITC Assistant retrieval layerUnited States
Google (Google Analytics 4)Website analyticsUnited States
ResendTransactional email delivery for Contact Clinic submissionsUnited States
LovableWebsite hosting and build infrastructureEuropean Union / global

Each sub-processor is engaged under a data processing agreement or equivalent contractual arrangement that includes commitments concerning confidentiality, security, and limitations on the use of personal data.

We may update this list from time to time. Material changes will be reflected in an updated version of this Privacy Policy.

9. Security

We implement organisational and technical measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include, without limitation: encrypted transport (HTTPS/TLS) across the website, access controls and authentication for administrative interfaces, rate limiting on the NexITC Assistant, and reliance on infrastructure providers that maintain industry-recognised security programmes.

No system is completely secure. Where we become aware of a personal data breach affecting your personal data, we will take appropriate steps in accordance with UAE PDPL.

10. Your Rights Under UAE PDPL

Subject to the conditions and exceptions set out in UAE PDPL, you have the following rights in respect of your personal data:

  • Right to be informed about the collection and use of your personal data (this Privacy Policy)
  • Right of access to the personal data we hold about you
  • Right to rectification of inaccurate or incomplete personal data
  • Right to erasure of your personal data in defined circumstances
  • Right to restrict processing in defined circumstances
  • Right to data portability for personal data you have provided to us
  • Right to object to processing based on legitimate interest
  • Right to withdraw consent where processing is based on consent
  • Right regarding automated decision-making. The NexITC Assistant uses automated processing to generate informational responses but does not produce decisions with legal or similarly significant effects. No automated commercial, credit, or eligibility decisions are made about you through this website.

To exercise any of these rights, please write to us at info@nexit365.com with "Data Subject Request" in the subject line. We will respond within the timeframes required by UAE PDPL. To protect your personal data, we may need to verify your identity before responding.

If you consider that our processing of your personal data does not comply with UAE PDPL, you have the right to lodge a complaint with the UAE Data Office.

11. Children

This website is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe we may have collected personal data from a child, please contact us and we will take appropriate steps to delete such data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. When we do, we will update the "Last updated" date at the top of this policy. Where changes are material, we will make reasonable efforts to notify affected individuals (for example, by prominent notice on the website).

13. How to Contact Us

For questions about this Privacy Policy or to exercise your rights, please contact:

Nex Information Technology Consultancy LLCAttention: Privacy1st Floor, Dar Al Salam Building, Al Danah East, Freej Al Qbeesat Street, Abu Dhabi, United Arab EmiratesEmail: info@nexit365.comTelephone: +971 55 2017168