Privacy notice

Who we are

nexaya is a cybersecurity and digital transformation consultancy with teams in Morocco, Nigeria, Ivory Coast, and Egypt, and an office in Frankfurt, Germany. This notice covers the website at nexaya.com. It does not cover the separate handling of data during a signed client engagement, which is governed by the agreement and non-disclosure terms you sign with us before that work begins.

What we collect

When you submit a form on this site — for example the assessment request or contact forms — we collect what you enter: your name, work email, company, website or domain, what you need, your country of operation, sector, organisation size, preferred language, and any message you add.

Like most websites, our server also receives standard technical information your browser sends automatically, such as your IP address, browser type, and the page you requested.

Why we collect it, and our legal basis

We use this information to respond to your enquiry, route it to the right person on our team, and understand which services people are asking about. Our basis for this is our legitimate interest in running our business and communicating with people who contact us, and, where relevant, your consent in submitting the form.

Fonts and third parties

This site loads typefaces from Google Fonts. Loading them causes your browser to send a request to Google's servers, which may include your IP address — see Google's own privacy policy for how they handle that. We do not currently use analytics, advertising, or tracking cookies on this website. See our cookie notice for more detail.

Who we share it with

We do not sell personal data. We share what you submit with colleagues across our own offices who need it to respond to you, and with service providers who help us run this website (such as our hosting provider), each of them bound to keep it confidential and use it only for that purpose.

International transfers

Because we operate across several countries, information you submit may be processed in a country other than the one you are in. Where that happens, we handle it consistently with the data protection law that applies to you — including Morocco's Loi 09-08 and the CNDP, Nigeria's Data Protection Act, Egypt's Law 151 of 2020, Ivory Coast's Loi 2013-450, and the GDPR where it applies.

How long we keep it

We keep enquiry information for as long as reasonably needed to respond to you and for a limited period afterward, then delete it. Where an enquiry becomes a signed engagement, data handling from that point is governed by the agreement covering that engagement, not this notice.

Your rights

Depending on where you are, you may have the right to ask us what information we hold about you, to correct it, to have it deleted, to object to how we use it, or to ask us to restrict our use of it. To exercise any of these, contact us using the details below.

Security

We apply the same security discipline to our own website's data that we bring to client engagements.

Contact us

If you have a question about this notice or want to exercise a right described above, get in touch via our contact page.

Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last revised.