Privacy Policy

Nexus Innovation Labs (“Nexus Labs”, “we”, “us”, or “our”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard information you provide when using our website at nexusinnovationlabs.dev (the “Site”) or when engaging our services.

This policy is written in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch data protection legislation.

1. Who We Are

Nexus Innovation Labs
Amsterdam, The Netherlands
Email: jp@nexusinnovationlabs.nl
Phone: +31 62 522 9678

Nexus Labs acts as the data controller for personal data collected through this Site.

2. What Data We Collect

We only collect personal data that you voluntarily provide to us:

• Contact form: name, email address, subject, and message.
• Booking form: name, email address, company name, and any details you include in your message when scheduling a strategy call.
• Server logs: IP address, browser type, referring URL, and timestamps — collected automatically by our hosting provider (Vercel) for security and performance purposes.

We do not collect sensitive personal data (health, financial, biometric, etc.).

3. How We Use Your Data

We use your personal data only for the following purposes:

• To respond to your enquiry or booking request.
• To communicate with you during the course of a project engagement.
• To fulfil our legal and contractual obligations.
• To maintain the security and operation of our Site.

We do not sell, rent, or share your personal data with third parties for marketing purposes — ever.

4. Legal Basis for Processing

We process your data under the following legal bases (GDPR Article 6):

• Consent — when you submit a contact or booking form, you consent to us using that data to respond.
• Legitimate interests — server log data is processed to ensure site security and prevent abuse.
• Contractual necessity — data shared during an active engagement is processed to fulfil our contract with you.

5. Data Retention

Contact and booking form submissions are retained for a maximum of 12 months from receipt, after which they are permanently deleted. If a commercial relationship is established, project-related communications may be retained for up to 7 years to comply with Dutch accounting and tax law.

6. Cookies

This Site does not use tracking cookies, analytics cookies, or advertising cookies. We may set a strictly necessary session cookie for theme preference (dark/light mode). This cookie contains no personally identifiable information and expires at the end of your browser session.

7. Third-Party Services

We use the following third-party services that may process your data:

• Vercel Inc. — hosting and content delivery. Vercel may process server log data (IP, user agent) as a data processor on our behalf. Vercel is GDPR-compliant and operates under appropriate data processing agreements.
• Resend — email delivery. Contact form submissions are transmitted via Resend to our inbox. Resend processes your email address and message content solely for delivery purposes and does not retain this data beyond the transmission.

We have data processing agreements in place with all processors, as required by GDPR Article 28.

8. International Transfers

Our hosting provider (Vercel) may store data on servers located outside the European Economic Area. Where this occurs, Vercel relies on Standard Contractual Clauses approved by the European Commission to ensure an adequate level of protection.

9. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may request correction of inaccurate or incomplete data.
• Right to erasure — you may request that we delete your personal data, subject to our legal retention obligations.
• Right to restriction — you may request that we restrict processing of your data in certain circumstances.
• Right to data portability — you may receive your data in a structured, machine-readable format.
• Right to object — you may object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at jp@nexusinnovationlabs.nl. We will respond within 30 days.

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. All data in transit is encrypted via TLS. Access to contact form data is restricted to authorised personnel only.

11. Children's Privacy

Our Site and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us immediately and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will reflect any changes. Continued use of the Site after a revision constitutes acceptance of the updated policy. For material changes, we will endeavour to notify you directly if we hold your contact information.

13. Governing Law

This Privacy Policy is governed by the laws of the Netherlands. Any disputes relating to this policy shall be submitted to the exclusive jurisdiction of the courts of Amsterdam, the Netherlands.

14. Contact

For any questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact us:

Nexus Innovation Labs
Amsterdam, The Netherlands
jp@nexusinnovationlabs.nl