Privacy Policy

Effective 11 October 2026. Covers nexgenio.com (apex site), nexgenio.com/training/ (course store), nexgenio.com/blog/index.html (NexGenio Insights), and the business contact data we use for direct outreach. This policy is scheduled for review by our legal adviser, and any amendment is published on this page.

1. Who We Are

NexGenio LTD (“we”, “us”, “our”) is the data controller for personal data processed through nexgenio.com and its subpages. Registered in Malta, company number C 88842, VAT MT25941925, registered address 36 St Dminika Street, Victoria (Gozo) VCT9030, Malta. Contact: toby@nexgenio.com.

2. What Data We Collect

• Course purchases (nexgenio.com/training/): name, email address, billing address, VAT identification number (if provided for reverse charge), and payment confirmation details from Stripe (we do not receive or store full card numbers).
• Contact/enquiry forms (if present on the apex site): name, email address, and message content.
• Blog (nexgenio.com/blog/index.html): currently no newsletter/subscription data is collected - the native signup form has been disabled pending a proper CRM-integrated implementation.
• Business contact data for direct outreach: where we contact a professional about our regulatory services, we hold their name, job title, business email address and employer. See Section 5.
• Website analytics: if you consent, analytics cookies may be used to understand how visitors interact with the site. See Section 3 (Cookies and Consent) below.

3. Cookies and Consent

This website uses a cookie consent mechanism to obtain your explicit consent before setting any non-essential cookies. You can manage your preferences at any time via the Cookie Settings link in the footer.

Cookie Categories

• Necessary (always active): These cookies are essential for the website to function. They include the consent preference cookie set by our consent manager (CookieConsent by orestbida). No personal data is collected. Retention: 182 days (consent record).
• Analytics (requires consent): We use Google Analytics 4 (operated by Google LLC) and Microsoft Clarity (operated by Microsoft Corporation) to measure site traffic, page views, scroll depth, clicks, and visitor behaviour in order to improve site content and structure. Data is anonymised where possible (IP anonymisation is enabled for GA4). Retention: up to 14 months (GA4), up to 13 months (Clarity). These tools only activate after you explicitly consent to the Analytics category.
• Marketing (requires consent): No marketing tracking tools are currently active on this website. This category is reserved for future use. If marketing tools are added, this policy will be updated accordingly.

How to Withdraw Consent

You can withdraw or change your cookie consent at any time by clicking the Cookie Settings link in the footer of any page. Previously set cookies for rejected categories will be automatically cleared.

No Tracking Without Consent

No analytics or marketing scripts are loaded until you actively consent. Rejecting all non-essential cookies means only the consent preference cookie itself is stored. The site remains fully functional without any optional cookies.

4. How We Use Your Data (Purposes and Legal Basis)

• To process and fulfil course purchases - legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To comply with tax and accounting obligations (VAT records, invoicing) - legal basis: legal obligation (Art. 6(1)(c) GDPR).
• To contact professionals at organizations that carry a regulatory obligation, about our services relevant to that obligation - legal basis: legitimate interest in direct business-to-business marketing (Art. 6(1)(f) GDPR), as recognised in Recital 47 GDPR.
• To respond to enquiries submitted via contact forms - legal basis: legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR), or contract performance where the enquiry leads to a service agreement.

5. Business Contact Data Obtained from Public Sources

This section is the information required by Article 14 GDPR, which applies where we hold personal data that we did not obtain from you directly. Where we contact you by email about our services, this information is also provided in that message.

What we hold. Your name, job title, business email address and the organization you work for. We hold no other category of personal data about you, and we hold nothing about your private life.

Where it came from. Publicly accessible sources. These include registers published by regulatory and supervisory authorities, your organization’s own website, and publicly accessible professional directories.

Why we hold it. To contact you in your professional role about regulatory services relevant to an obligation your organization carries. Our legal basis is our legitimate interest in direct business-to-business marketing under Art. 6(1)(f) GDPR. We have weighed that interest against your interests and rights, taking into account that the data concerns you only in your professional capacity, that it was already public, and that you can stop the contact at any time with one click.

Who else sees it. Our email delivery provider, Instantly.ai, processes this data on our instructions in order to send and track delivery of our messages. We do not sell, rent or share this data with anyone else.

How long we keep it. Until you object, or 36 months from our last contact with you, whichever comes first. If you object, we retain only the minimum needed to make sure we do not contact you again.

Your right to object. You have an absolute right to object to this processing, and we must stop on request. Every message we send carries a one-click link that removes you. You can also write to toby@nexgenio.com. You hold every other right listed in Section 9, including the right to see exactly what we hold about you and the right to have it erased.

6. Payment Processing

Payments are processed by Stripe, Inc., acting as our payment processor. Stripe processes payment data under its own privacy policy and data processing agreement, available at stripe.com/privacy. Card details are entered directly into Stripe’s secure checkout and are not received or stored by NexGenio.

7. Sharing Data with PECB

When you purchase a course, your name and email address are manually entered by our Director into the official PECB partner platform (myPECB) in order to provision your access to course materials and register you for the relevant certification examination. This is a manual process performed by a NexGenio staff member, not an automated data transfer. PECB acts as an independent data controller for this purpose - see PECB’s own privacy policy for how they handle your data.

8. Data Retention

• Purchase and invoice records: for the period required by Maltese tax and accounting law.
• Business contact data for direct outreach: until you object, or 36 months from our last contact with you, whichever comes first.
• Enquiry correspondence: 24 months from the last message in the exchange.
• Cookie consent record: 182 days.
• Analytics data: up to 14 months (Google Analytics 4), up to 13 months (Microsoft Clarity).

When a retention period ends, the data is deleted. Where a record must be kept for tax purposes, it is kept for that purpose alone and is not used for anything else.

9. Your Rights Under GDPR

As a data subject, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data, subject to our legal retention obligations (e.g. tax records)
• Restrict or object to certain processing
• Request data portability
• Lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC), Malta’s supervisory authority, or your own EU member state’s equivalent authority

To exercise any of these rights, contact toby@nexgenio.com.

10. International Data Transfers

Website content, the leads database and our stored credentials are held in Amazon Web Services data centres in the eu-central-1 (Frankfurt) region, inside the EU.

The following providers are established outside the EU/EEA and may process personal data there. Each relies on Standard Contractual Clauses, the EU-US Data Privacy Framework, or both.

• Stripe, Inc. (United States) - payment processing.
• Instantly.ai (United States) - email delivery for direct outreach.
• Microsoft Corporation (United States) - business email, and Microsoft Clarity analytics where you consent.
• Google LLC (United States) - Google Analytics 4, where you consent.
• PECB (Canada) - course enrolment and certification, acting as an independent controller. Canada holds a European Commission adequacy decision for commercial organizations.

11. Security

• Every NexGenio web property is served over HTTPS with TLS. Plain HTTP requests are redirected.
• The website is static content served from Amazon S3 through Amazon CloudFront. There is no public write path and no server-side code that executes visitor input.
• API keys, database credentials and access tokens are held as encrypted parameters in AWS Systems Manager Parameter Store. They are never written into source code or into this repository.
• The leads database runs on Amazon RDS within a private network in the eu-central-1 region and is not reachable from the public internet.
• Administrative access to infrastructure uses individual AWS IAM credentials. Access is limited to the people who need it to operate the service.
• Card details are entered directly into Stripe’s hosted checkout. They are never transmitted to or stored by NexGenio.

12. Children’s Data

Our services are directed at business professionals and are not intended for use by children. We do not knowingly collect personal data from anyone under the age of 16.

13. Changes to This Policy

We may update this policy from time to time. The date of the most recent update will be shown at the top of this page. Material changes will be communicated where appropriate.

14. Contact and Complaints

NexGenio LTD
36 St Dminika Street, Victoria (Gozo) VCT9030, Malta
Email: toby@nexgenio.com

You may also contact Malta’s Information and Data Protection Commissioner (IDPC): Floor 2, Airways House, High Street, Sliema, SLM 1549, Malta.