Privacy policy

• Lawfulness, fairness and transparency, so you know what happens to your data.
• Purpose limitation, so data collected for one purpose is not reused for an unrelated one.
• Minimisation, so we collect only what the purpose requires.
• Accuracy, with correction when we are told something is wrong.
• Storage limitation, with defined retention periods.
• Integrity and confidentiality, protected by technical and organisational safeguards.
• Accountability, with records that show how the principles are met.

Where the Act requires a data controller or data processor to hold a licence or registration from POTRAZ, we hold the required authorisation before processing personal data for a customer, and we keep it current.

• Contact details you submit: full name, work email address, organisation, organisation type, platforms of interest and the content of your message.
• Business contact details of customers and their staff: names, work contact details, roles and access permissions.
• Technical data: IP address, browser and device type, referring page, pages visited and timestamps, recorded in server logs.
• Correspondence: emails, call notes, support tickets and demo follow-up records.
• Platform records: where we host a customer's platform, the member, beneficiary, claim, prescription and dispensing records the customer loads, which may include health data.

We do not ask for identity numbers, payment card details or health information through this website. Please do not include them in a demo request.

• Consent: when you submit a demo request, ask to be kept informed or accept optional cookies. You can withdraw consent at any time.
• Contract: to deliver, support and bill the platforms a customer rents from us.
• Legal obligation: to keep the records required by tax, company and sector rules, and to answer lawful requests.
• Legitimate interests: to respond to business enquiries, secure our systems, prevent misuse and improve this website, balanced against your rights and freedoms.

Where we process records as a processor, the lawful basis is set by the customer as controller, and we rely on its instructions.

• Strictly necessary: keep the site working and remember your session. These cannot be switched off.
• Preference: remember choices such as a selected filter or tab.
• Analytics: aggregate page usage, set only where you accept analytics cookies.

We do not use advertising cookies or cross-site tracking, and we do not sell data derived from cookies. You can clear or block cookies in your browser settings; blocking strictly necessary cookies may stop parts of the site working.

• Demo and enquiry records: 24 months from the last contact, then deleted or anonymised.
• Customer contract, support and billing records: for the contract term plus the period required by law.
• Records processed on a customer's behalf: for the period set in the customer agreement. On termination they are exported or deleted as that agreement directs.
• Server logs: up to 90 days, unless held longer for a security investigation.
• Marketing consent records: until you unsubscribe, plus a suppression record so we do not contact you again by mistake.

• Service providers who host, secure, back up or support our systems, under written agreements that limit them to our instructions.
• Professional advisers such as auditors, accountants and lawyers, where their advice requires it.
• POTRAZ, a court, law enforcement or another regulator, where the law requires disclosure or where it is necessary to establish or defend a legal claim.
• A successor organisation in the event of a merger, acquisition or transfer of the business, on the same terms as this policy.

Where we act as a processor, we disclose records only as the customer instructs or as the law requires, and we tell the customer when a lawful request is received.

• Role-based access control, so staff reach only the records their role requires.
• Encryption of data in transit between your browser and our systems.
• Unique user accounts, password rules, multi-factor access for administrative roles and periodic access reviews.
• Activity trails on platform actions, plus monitored server logs.
• Written confidentiality obligations for staff and contractors, and privacy training for the teams handling customer records.
• A documented incident response process, tested through internal review.

If a personal data breach creates a risk to your rights and freedoms, we notify POTRAZ and the affected data subjects without undue delay as the Act requires, and we tell any customer whose records are involved.

• Confirm whether we hold personal data about you, and give you access to it.
• Correct data that is inaccurate, incomplete or out of date.
• Delete data we no longer have a lawful reason to keep.
• Restrict or object to processing, including processing based on legitimate interests.
• Provide your data in a structured, commonly used, machine-readable format where the Act gives you that right.
• Withdraw consent you have given, without affecting processing already carried out.
• Object to a decision based solely on automated processing that has legal or similarly significant effects, where that right applies.

Send a request to info@nexcoolitsystems.com. We may ask for proof of identity, and we respond without undue delay within the period the Act allows. If we cannot act on a request, we explain why and tell you how to escalate. If your data sits inside a customer's platform, we pass the request to that customer as controller and support its response.

We do not use the personal data of website visitors to train artificial intelligence models.