Privacy & Data Protection

Privacy Policy

// Last updated: 2026-06-27 · Plain-English notice · GDPR-style rights for everyone

Back to home
On this page
Who we are What we collect Why & lawful basis How we use it No selling of data Who we share with How long we keep it Your rights Cookies International transfers Changes Contact

NextGen Security ("NextGen Security", "we", "us") helps growing businesses become AI-safe and audit-ready. Because we sell compliance and data-protection services, we hold ourselves to the same standard: this notice explains, in plain language, exactly what personal data we collect through this website, why we collect it, how we protect it, and the rights you have over it.

01Who we are

NextGen Security is a remote-first cybersecurity services provider operating at nextgensec.io and serving clients worldwide. We are the data controller for the personal data described below. For any privacy question or request, contact us at hello@nextgensec.io.

02What data we collect

We only collect the information you choose to give us. The website has two forms, and between them they collect:

  • Contact form — your name, company, work email, and any message you write.
  • Free readiness scan — your name, company, work email, and your answers to a 15-question security self-assessment about your business.
  • Technical data — standard server information your browser sends with any web request (for example IP address and timestamp), logged by our hosting provider for security and to keep the site running.

We do not ask for, and you should not send us, special-category data (such as health, biometric, or financial account details) through these forms. The readiness scan is a self-assessment about your organization, not about any individual.

03Why we collect it, and our lawful basis

We use your data for clearly limited purposes, each with a lawful basis under GDPR-style data-protection law:

  • To respond to you and prepare your readiness report — our legitimate interest in answering enquiries, and to take steps at your request before any contract.
  • To deliver the free scan result you asked for — performing the service you requested.
  • To keep the site secure and prevent abuse — our legitimate interest in protecting the service (this is also why the contact form uses a spam honeypot).

We do not send marketing email to people who have not asked to hear from us, and we do not build advertising profiles.

04How we store and use your data

Submitted leads and scan answers are stored on our hosting account in a location that is not publicly reachable from the website. Access is limited to the people who need it to respond to you and deliver your report. We use the data only for the purpose you gave it for — to reply, to produce your readiness indicator, and to follow up on the specific request you made.

05We do not sell your data

We never sell, rent, or trade your personal data, and we do not share it with advertisers or data brokers. Your information is used to help you — not monetized.

06Who we share it with

We keep the list of people who touch your data short. We may share limited data only with:

  • Our hosting and email providers, who process data on our behalf so the site and our mailboxes can operate.
  • An AI provider, only if it is used to help draft a reply or your readiness narrative — in which case only the information needed for that purpose is sent, under that provider's terms.
  • Authorities, only where we are legally required to do so.

We do not transfer your data to anyone for their own independent marketing.

07How long we keep it

We keep enquiry and scan data only as long as we need it to respond to you and for a reasonable follow-up period, after which we delete or anonymize it. If you become a client, related records are kept for the duration of the engagement and any period we are legally required to retain them. You can ask us to delete your data sooner at any time.

08Your rights

Wherever you are based, we extend GDPR-style rights to everyone who contacts us. You can ask us to:

  • Access the personal data we hold about you.
  • Correct data that is wrong or out of date.
  • Erase your data ("right to be forgotten").
  • Restrict or object to how we use it.
  • Port your data — receive a copy in a usable format.
  • Withdraw consent at any time, where we relied on it.

To exercise any of these, email hello@nextgensec.io. We will respond within a reasonable time and at no charge. If you believe we have not handled your data properly, you also have the right to complain to your local data-protection authority.

09Cookies

This website is intentionally lightweight. It uses only the cookies required for the site and forms to function and to keep them secure. We do not use advertising or cross-site tracking cookies.

10International transfers

We are remote-first and serve clients worldwide, so your data may be processed in a country other than your own — including by the hosting, email, or AI providers described above. Where that happens, we take reasonable steps to ensure your data continues to be protected to a comparable standard.

11Changes to this notice

If we change how we handle personal data, we will update this page and revise the "last updated" date above. Material changes will be made clear here.

12Contact

For any privacy question, or to make a data-subject request, contact us at hello@nextgensec.io.

// note  This privacy notice describes how we handle data submitted through this website. The website and its free readiness scan are a readiness indicator only — they do not constitute certification, a security audit, or legal advice. See our Terms.