Skip to content
Legal

Privacy Policy

Last updated January 2026.

Template notice. This page is a professionally-worded starting point. Before publishing, review the highlighted [bracketed] fields with your business details, and have a lawyer in your jurisdiction confirm the final text.

[Legal Business Name] ("we", "our", "us") respects your privacy. This Privacy Policy explains what personal data we collect, why, how we use it, who we share it with, and your rights.

This policy applies to visitors, prospects and clients of nextsite-agency.vercel.app and the services we deliver.

1. Who is responsible

Data Controller: [Legal Business Name]
Registered address: [registered address, country]
Privacy contact: privacy@nextsite-agency.com

2. Data we collect

You provide directly

  • Contact form data — name, company, email, phone, message.
  • Invoice request data — same as above, plus selected services, budget range and project description.
  • Consultation booking data — same, plus preferred date and topics.
  • Newsletter opt-in — email address only.
  • Client onboarding data — billing details, brand assets, credentials required to deliver Services.

Automatically

  • Technical data — IP address (truncated for analytics), device, browser, timezone.
  • Usage data — pages visited, referrer, session duration.
  • Cookies — see our Cookie Policy.

From third parties

  • Publicly available business information used to verify prospects.
  • Payment status from our payment processor (Stripe / PayPal invoice status).

3. Why we use it (lawful basis)

  • Respond to enquiries and deliver Services — contract or pre-contract.
  • Improve the site and our proposals — legitimate interests.
  • Send newsletters — consent (opt-in, one-click unsubscribe).
  • Bill and record-keep — legal obligation (tax law).
  • Prevent fraud and secure our systems — legitimate interests.

4. Sharing

We share personal data only with vendors necessary to run the business, under contract:

  • Hosting / CDN providers (e.g. Vercel, Hostinger, Cloudflare).
  • Email service providers (transactional and newsletter).
  • Payment processors (Stripe, PayPal) — for invoicing only, we never store full card numbers.
  • Form providers (e.g. Formspree) — for enquiry delivery.
  • Analytics providers (only if you consent to analytics cookies).
  • Legal, tax and professional advisors under duty of confidentiality.

We do not sell your personal data. We do not share it with advertisers.

5. International transfers

Some of our processors are located outside the EEA/UK. Where personal data leaves the EEA/UK we rely on adequacy decisions or Standard Contractual Clauses. See GDPR & Data Protection Notice.

6. Retention

  • Prospect enquiries: 24 months from last contact.
  • Client records: engagement duration + 7 years for tax and legal records.
  • Newsletter: until you unsubscribe.
  • Analytics: 14 months (aggregated, non-identifying).
  • Backups: rolling 30 days.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, obtain a portable copy, and withdraw consent. To exercise these rights email privacy@nextsite-agency.com. We respond within 30 days.

You can also lodge a complaint with your national data-protection authority. In the UK: the Information Commissioner's Office. In the EU: your national supervisory authority. In California: refer to CCPA rights below.

8. California residents (CCPA / CPRA)

  • Right to know what personal information we collect.
  • Right to delete personal information (subject to legal exceptions).
  • Right to correct inaccurate personal information.
  • Right to opt out of "sale" or "sharing" — we do not sell personal information.
  • Right to non-discrimination for exercising these rights.

9. Security

We apply reasonable technical and organizational measures — TLS in transit, encryption at rest, least-privilege access, monitoring, and regular backups — proportionate to the sensitivity of the data. See our Security page for detail.

10. Children

Our Services are not directed at children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

11. Changes

We may update this policy from time to time. Material changes will be notified via email or a prominent site notice. The date at the top of this page indicates when the policy was last revised.

12. Contact

[Legal Business Name]
[registered address]
Privacy contact: privacy@nextsite-agency.com
General contact: hello@nextsite-agency.com