1. Introduction
TheNex Inc. ("TheNex", "we", "us", or "our") is a business transformation and technology consulting firm headquartered in San Diego, California, USA, serving clients globally. We are committed to protecting the privacy and security of your personal information in compliance with applicable global privacy laws, including:
- The General Data Protection Regulation (GDPR) — European Union & EEA
- The California Consumer Privacy Act (CCPA) / CPRA — California, USA
- The Personal Information Protection and Electronic Documents Act (PIPEDA) — Canada
- The UK GDPR — United Kingdom
- Other applicable national and regional privacy laws
This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights regarding it. By using our website at www.thenexinc.com or submitting information through our forms, you acknowledge that you have read and understood this policy.
2. Data Controller
The data controller responsible for your personal information is:
For GDPR purposes, TheNex Inc. is the data controller for personal data collected via this website. If you are located in the EU/EEA or UK and require a local representative, please contact us at the address above.
3. Information We Collect
We collect the following categories of personal information:
3.1 Contact Form
When you submit our contact form, we collect:
- Full name
- Company name (optional)
- Email address
- Phone number (optional)
- Message content and service interest
3.2 Careers / Application Form
When you apply for a position, we collect:
- Full name
- Email address
- Phone number (optional)
- LinkedIn profile URL
- Area of interest / role preference
- Resume / CV (PDF)
- Consent timestamp and IP address (for compliance record-keeping)
3.3 Automatically Collected Information
When you visit our website, we may automatically collect:
- IP address
- Browser type and version
- Pages visited and time spent
- Referring URL
- Device type and operating system
We use Cloudflare Turnstile for bot protection. Cloudflare may process technical data as part of this service. See Cloudflare's Privacy Policy.
4. Legal Basis for Processing (GDPR)
For individuals in the EU, EEA, and UK, we rely on the following legal bases:
Consent (Art. 6(1)(a) GDPR)
For processing job application data, including resumes and LinkedIn profiles, where you have explicitly checked the consent checkbox on our careers form.
Legitimate Interests (Art. 6(1)(f) GDPR)
For responding to business inquiries submitted via our contact form, where you have a reasonable expectation of receiving a response.
Pre-Contractual Steps (Art. 6(1)(b) GDPR)
Where processing is necessary at your request prior to entering into a contract, such as a consulting engagement.
5. How We Use Your Information
We use your personal information solely for the following purposes:
- Contact inquiries: To respond to your questions and schedule consultations
- Job applications: To evaluate your application and contact you regarding potential opportunities
- Security: To protect our website from spam, bots, and abuse
- Legal compliance: To comply with applicable laws and regulations, including maintaining records of consent
- Service improvement: To understand how our website is used and improve the user experience
We will never:
- Sell your personal information to third parties
- Share your data with advertisers
- Use your data for automated profiling or decision-making with legal effect
- Send unsolicited marketing without your explicit consent
6. Data Retention
We retain your personal information only for as long as necessary:
- Contact form submissions: Up to 12 months from the date of submission, or until the inquiry is resolved
- Job applications: Up to 24 months from the date of submission, to allow consideration for future openings
- Consent records: Retained for the duration required by applicable law (minimum 3 years for GDPR audit purposes)
- Uploaded resumes: Stored securely on our servers for up to 24 months, then permanently deleted
You may request deletion of your data at any time (see Section 8 — Your Rights).
7. Data Sharing and Third Parties
We do not sell, rent, or trade your personal information. We may share limited data only with the following trusted service providers who process data on our behalf under data processing agreements:
- Cloudflare — bot protection and CDN (processes IP address and browser data)
- Web hosting provider — server infrastructure for form data and file storage
- Email service — for delivering form submission notifications internally
All third-party processors are contractually required to protect your data and may not use it for their own purposes. We do not transfer data to countries outside the UK, EU, or EEA without ensuring appropriate safeguards are in place (e.g., Standard Contractual Clauses).
8. Your Rights
Depending on your location, you have the following rights regarding your personal information. To exercise any of these rights, email us at [email protected]. We will respond within 30 days.
Right of Access
Request a copy of the personal information we hold about you. (GDPR Art. 15, CCPA)
Right to Rectification
Request correction of inaccurate or incomplete information. (GDPR Art. 16)
Right to Erasure
Request deletion of your personal data ("right to be forgotten"). (GDPR Art. 17, CCPA)
Right to Withdraw Consent
Withdraw consent at any time without affecting prior processing. (GDPR Art. 7(3))
Right to Data Portability
Receive your data in a structured, machine-readable format. (GDPR Art. 20)
Right to Object
Object to processing based on legitimate interests. (GDPR Art. 21)
CCPA — Do Not Sell
California residents: we do not sell personal information. No opt-out is needed, but you may still request deletion.
Right to Lodge a Complaint
You have the right to complain to your local data protection authority (e.g., ICO in the UK, your national DPA in the EU).
9. Data Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or alteration. These measures include:
- HTTPS / TLS encryption for all data in transit
- CSRF token protection on all forms
- Bot protection via Cloudflare Turnstile
- Strict file upload validation (type, size, MIME)
- Randomised, non-guessable filenames for uploaded documents
- Access-controlled server directories for uploaded files
- Rate limiting to prevent abuse
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify affected individuals without undue delay.
10. Cookies
Our website uses minimal, essential cookies only:
- Session cookie (PHPSESSID): Required for CSRF protection and form security. Expires when you close your browser.
- Cloudflare cookies: Used for security and bot detection. See Cloudflare's Cookie Policy.
We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
11. Children's Privacy
Our website and services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a minor, please contact us at [email protected] and we will delete it promptly.
12. International Data Transfers
TheNex Inc. is based in the United States. If you are located outside the US, your information will be transferred to and processed in the US. For transfers from the EU/EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) adopted by the European Commission. You may request a copy of any applicable transfer mechanisms by emailing us.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website after changes are posted constitutes your acceptance of the updated policy.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact our privacy team:
TheNex Inc. — Privacy Team
📍 San Diego, California, USA
We aim to respond to all privacy requests within 30 calendar days.