NexCert

Privacy Policy

Effective 16 October 2026 · Version 1.1

1. Who we are

NexCert is a compliance-software platform for UK electrical and gas contractors, operated by NexCert Ltd, a company registered in England and Wales (company number 17520827) whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ ("NexCert").

For all privacy queries — access, correction, deletion, complaints — email [email protected].

NexCert is the data controller for the personal data described in this policy. Where NexCert's customers use the app to process their own tenants' or clients' personal data through NexCert, NexCert acts as a data processor on their behalf — that relationship is governed by our Data Processing Agreement, which applies automatically to every Subscription that involves processing third-party personal data.

2. What personal data we collect

2.1 Waitlist (today)

When you join the waitlist at nexcert.uk, we collect:

• Your name
• Your company name
• Your work email address
• Your phone number (optional)
• The product line you're interested in (Electrical / Gas / Complete / undecided)
• Any free-text notes you add
• Your IP address and the time of submission (for rate-limiting and abuse prevention)

2.2 Registered account (once signups reopen)

When you create a NexCert account (currently paused — waitlist only), we will additionally collect:

• Login credentials (email + password hash — passwords are never stored in plaintext)
• Profile details you add (name, role, scheme registration numbers, ACS qualifications, signature image)
• Your usage of the service — cert drafts, submissions, sign-offs, uploaded photos, audit history
• Billing details processed by our payment provider — see Sub-processors below

2.3 Data your customers put into NexCert

NexCert stores the property, client, tenant, engineer and cert data your team enters. For that data, you (the NexCert customer) are the data controller and NexCert is the data processor — see section 1.

3. Why we collect it and the legal basis

4. How long we keep it

• Waitlist entries: until you ask us to remove them, or 24 months after we open for general availability — whichever comes first.
• Active account data: for the lifetime of your account plus any period required by law (accounting records: 6 years; gas-cert records: 2 years per GSIUR 1998; electrical-cert records: until superseded by the next inspection).
• Cancelled accounts: we retain the minimum data needed to satisfy statutory record-keeping obligations, and delete everything else within 90 days of cancellation unless you ask for it sooner.
• Server access logs: up to 90 days.

5. Who else has access to your data (sub-processors)

We use a small number of trusted third-party services to run NexCert. Each has its own privacy programme and appropriate data-protection contract with us.

We do not sell your personal data. We do not share it with advertisers. We do not use it to train third-party AI models.

6. International transfers

Some of the sub-processors above operate outside the UK. Where personal data leaves the UK, it is transferred under the UK Information Commissioner's International Data Transfer Agreement or the EU Standard Contractual Clauses with a UK addendum — the safeguards required by UK GDPR Art. 46.

7. Cookies and similar technologies

The marketing site (nexcert.uk) serves its fonts from our own servers, so loading a page makes no request to a font provider. It uses Cloudflare Web Analytics to count page views and referrers, and page-load performance. Cloudflare Web Analytics is cookieless: it sets no cookies, stores no device identifier and does not track you between sites or sessions, so no consent banner is required for it under UK PECR. We run no advertising or cross-site tracking of any kind. The app (app.nexcert.uk) uses first-party cookies strictly necessary to keep you signed in and to remember your workspace — again, no consent required under PECR.

If we later add analytics or tracking that does set cookies or otherwise store information on your device, we will publish a Cookie Notice and (where required) a consent banner before turning it on.

8. Automated decision-making

We do not make automated decisions that produce legal or similarly significant effects about you. NexCert's AI features (draft generation, extraction, validation) assist humans — they never sign a certificate or make a legal or financial decision on their own.

9. Security

Personal data is transmitted over HTTPS. Passwords are stored using the Argon2 / bcrypt family of one-way hashes; refresh tokens are stored as one-way SHA-256 hashes. Access is role-based and audit-logged. Database and disk backups are held in the UK. Where we discover a personal-data breach that is likely to result in a risk to individuals, we will notify the ICO within 72 hours as required by UK GDPR, and affected individuals without undue delay.

10. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate or incomplete data corrected
• Have your data deleted where there is no continuing lawful basis to keep it
• Restrict or object to certain processing
• Receive a copy of your data in a portable format
• Withdraw consent at any time (where processing is based on consent)
• Complain to the UK Information Commissioner's Office

To exercise any of these rights, email [email protected]. We aim to respond within 30 days.

11. How to complain

If you're not satisfied with how we've handled a privacy matter, you can complain to the UK Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

12. Changes to this policy

We'll publish updates to this page and change the "Effective from" date at the top. Material changes — anything that expands what data we collect or how we use it — will also be notified by email to registered account holders and to waitlist subscribers.