Privacy Notice
Last updated: 9 October 2026
1. Who we are
This policy explains how Nexxaa Ltd collects, uses and protects personal data. It covers the nexxaa.com website, the OpCheck platform and its modules (Nexxaa Fleet, Nexxaa Waste, Nexxaa Driver and Nexxaa Licence), the Nexxaa Driver mobile app, and DWT Direct.
- Company: NEXXAA LIMITED, registered in England and Wales, company number 16762606
- Registered office: 10 Inglewood Court, Sothall, Sheffield, S20 2PA
- Operating address: Venture One Business Park, Unit 15 Longacre Close, Holbrook Industrial Estate, Sheffield, S20 3FR
- ICO registration number: applied for, application reference C2041462
- Contact: support@nexxaa.com or 0114 291 9248
In this policy, “we”, “us” and “our” mean Nexxaa Ltd. “Customer” means the business that holds a Nexxaa account. “You” means anyone whose personal data we handle, including customers’ staff and drivers.
2. Our role: controller or processor
We act in two different roles under UK GDPR, depending on whose data it is.
- We are the controller for data about our own customers and prospects: account holders, billing contacts, website visitors and people who contact us. We decide how that data is used.
- We are the processor for data our customers put into the platform about their drivers, staff, vehicles, sites and waste movements. The customer is the controller of that data and decides what goes in and why. We process it only on the customer’s instructions, under our Data Processing Agreement.
If you are a driver or employee of one of our customers and have a question about your data in the platform, contact your employer first. We will help them respond, and you can also contact us directly.
3. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and contact data | Name, job title, work email, phone, company name and address | You or your employer, when an account is set up |
| Login and security data | Encrypted passwords, login times, IP address, device and browser type | Generated when you use the platform |
| Driver data | Name, date of birth, driving licence number, entitlements, endorsements, CPC and tachograph card details | The customer, the driver, or DVLA licence checks the customer requests |
| Vehicle and inspection data | Registrations, walkaround and defect reports, photos, locations, timestamps | Drivers and staff using the platform |
| Waste records | Transfer notes, carrier and site details, waste descriptions and codes, signatures, load photos | Customers’ staff and drivers |
| Integration credentials | Customers’ own Defra waste tracking API credentials | The customer, entered into DWT Direct or Nexxaa Waste |
| Billing data | Billing contact, invoices, subscription history | You and Stripe. We never see or store full card numbers |
| Enquiry and support data | Messages, emails and call notes | You, when you contact us |
| Website data | Pages visited, referrer, cookie data (see section 9) | Your browser |
We do not ask for special category data such as health information. If a customer records it in free-text fields, the customer is responsible for having a lawful basis to do so.
4. How we use data and our lawful basis
Where we are the controller, we rely on these lawful bases under UK GDPR:
| Purpose | Lawful basis |
|---|---|
| Setting up and running customer accounts | Contract |
| Billing, invoicing and keeping financial records | Contract and legal obligation |
| Customer support during support hours | Contract |
| Keeping the platform secure, preventing misuse and investigating incidents | Legitimate interests |
| Improving the platform using usage patterns | Legitimate interests |
| Service messages, such as outages, security notices and legal changes | Contract and legitimate interests |
| Marketing emails to business contacts | Legitimate interests, with an unsubscribe link in every email; consent where the law requires it |
| Answering website enquiries | Legitimate interests |
| Website analytics | Consent, through our cookie banner |
Where we are the processor, we use customer data only to provide the service the customer has asked for. That includes submitting waste records to Defra and running DVLA licence checks when the customer instructs us to. The customer sets the lawful basis for that processing. Licence endorsements can count as criminal offence data, so customers must have a lawful condition for checking them.
We do not sell personal data. We do not use it for automated decisions that have legal or similarly significant effects on you.
5. Who we share data with
We share personal data only with the suppliers we need to run the service, and with public bodies when a customer instructs us or the law requires it.
| Recipient | What they do | Location |
|---|---|---|
| Supabase | Database, file storage and user logins for the platform | Ireland (EU) |
| Vercel | Hosts the platform application | USA and global edge network |
| Hostinger | Hosts the nexxaa.com marketing website | As set out in Hostinger’s privacy notice |
| Stripe | Takes subscription payments; holds card details | UK, EU and USA |
| Google Workspace | Our business email | UK, EU and USA |
| HubSpot | Customer relationship management: enquiries, prospects and customer contacts | EU and USA |
| Google Analytics | Website analytics, only with your consent | EU and USA |
| Envirologistics Consulting & Training Ltd, our associated company, which holds the DVLA Access to Driver Data agreement used for licence checks | Routes driving licence check requests to DVLA | UK |
| Defra waste tracking service | Receives waste records the customer submits through the platform | UK |
| DVLA | Returns driving licence details when a customer runs a licence check | UK |
Each supplier is bound by a contract requiring it to protect the data and use it only for the service it provides to us. We may also disclose data where the law requires it, for example to a regulator, the police or a court, or to a buyer if Nexxaa Ltd or its business is sold.
6. Where data is stored
Platform data is stored in the EU (Ireland), with Supabase.
Some suppliers, such as Vercel, Stripe, Google and HubSpot, may process data outside the UK. Where that happens, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, so your data keeps an equivalent level of protection. You can ask us for details of the safeguard used for any transfer.
7. How we protect data
We use technical and organisational measures proportionate to the data we hold:
- Encryption: data is encrypted in transit (HTTPS/TLS) and the database is encrypted at rest.
- Separation between customers: database access rules keep each customer’s data separate, so one organisation cannot see another’s records.
- Role-based access: users only see what their role allows.
- Integration credentials: customers’ Defra API codes are held in a restricted table that can only be read or written through controlled server functions.
- Admin accounts: two-factor login is enforced on the accounts used to administer the platform.
- Staff access: only named Nexxaa staff can access customer data, and only to provide support or keep the service running.
No system is completely secure. If a breach puts your data at risk, we will notify affected customers without undue delay, and the ICO within 72 hours where the law requires.
8. How long we keep data
| Data | How long |
|---|---|
| Customer platform data | While the account is active. When it ends, the customer can export their data for 30 days, after which we delete it. |
| Backups | Deleted data drops out of backups when they roll over. |
| Billing and financial records | 6 years after the end of the financial year they relate to, as HMRC requires |
| Enquiries from people who don’t become customers | 2 years from the last contact |
| Marketing contacts | Until you unsubscribe or object; we keep a suppression record so we don’t contact you again |
| Security and access logs | Up to 12 months |
Customers are responsible for keeping their own legal records for as long as the law requires. For example, waste transfer notes must be kept for 2 years and hazardous waste consignment records for 3 years. They should export these before closing an account.
9. Your rights, cookies and contact
Your rights. Under UK GDPR you can ask us to:
- give you a copy of your data
- correct inaccurate data
- delete your data
- restrict or object to how we use it, including objecting to marketing at any time
- move your data to another provider
- withdraw consent, where we rely on it
Email support@nexxaa.com. We reply within one month. If your data is held for a customer, we will pass your request to them and help them respond.
Deleting your account. Driver app users can request account deletion from within the app. Your employer may still need to keep some records, such as vehicle checks, to meet its legal duties.
Cookies. Our website and platform use essential cookies to keep you logged in and the service secure. We use analytics or marketing cookies only with your consent, which you can change at any time through the cookie banner. See our Cookie Policy.
Children. Our services are for businesses. We do not knowingly collect data about anyone under 16.
Complaints. Please contact us first so we can put things right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Contact. Nexxaa Ltd, Venture One Business Park, Unit 15 Longacre Close, Holbrook Industrial Estate, Sheffield, S20 3FR. Email support@nexxaa.com or call 0114 291 9248. Support hours are Monday to Friday, 9am to 5pm UK time, excluding bank holidays.
Changes. We will update this policy when our services or the law change and post the new version here with its date. We will email customers about significant changes.