Privacy notice

What this notice covers

This notice covers the public registration form for Nexuss — the page that links here, where a company tells us who they are and asks to be set up. It explains exactly what that form collects, why, who sees it and how long we keep it.

It does not cover what happens inside Nexuss once your company is a customer. Information your organisation puts into its own Nexuss belongs to your organisation: they decide what is held and why, and their own privacy notice governs it.

Who is responsible for your information

FIFTEEN NETWORK LTD is the data controller for the information described in this notice. That means we decide what is collected and what it is used for, and we are the people you hold responsible for it.

• Registered office: 12 Hatherley Road, Sidcup, Kent, England, DA14 4DT
• Data protection contact: antony@15.group
• ICO data protection register entry: ZC148205

What we collect

What you type into the form

• Your company's name.
• Roughly how many people work there — chosen from a band (1–10, 11–50, 51–200, 201–500, 501–1000, or more than 1000). Never an exact headcount.
• The full name of the person who will administer the account.
• That person's work email address.
• That person's job title. Optional — leave it blank and nothing is stored.
• That person's phone number. Optional — leave it blank and nothing is stored.
• Which sign-in method you would prefer: your existing Microsoft work accounts, or accounts created on Nexuss itself.

That is the entire form. There are no other questions, and nothing about you is gathered in the background beyond the two items in the next section.

What we record alongside it

• The domain part of the email address you gave us — the part after the @. We store it separately so we can cap how many registrations arrive from one organisation in a day, and so that whoever reviews yours can see if your company has already registered.
• The date and time you submitted the form.

What we use but do not keep

Three things exist only to stop the form being abused by automated scripts:

• Your IP address — held in the server's memory only, for the length of a short rate-limiting window, so that one machine cannot flood the form. It is never written alongside your registration and it is not retained.
• A signed timestamp carried in a hidden field of the form, recording when the page was sent to you. It lets us refuse a submission that arrives impossibly fast or hours late. It holds nothing about you and is not stored with your registration.
• A decoy field, positioned off the edge of the screen and labelled "Company website". You will never see it or fill it in; anything in it came from a script. Whatever it contains is discarded.

What we add ourselves afterwards

When someone here reviews your registration we record what was decided: whether we took it forward, when, which of our people decided it, and — if we did not take it forward — a short internal note of the reason. If we did take it forward, we record which account was created from it.

What we do not collect at all

No tracking. No analytics. No advertising cookies and no third-party cookies of any kind. No profiling, and no automated decision-making — a person reads every registration and a person decides what happens to it. We do not buy, enrich or look up additional information about you from anywhere else, and we never sell, rent or trade your details.

Cookies

One cookie, and it is strictly necessary. It carries a form-security token so we can confirm the form you submit is the one we sent you, which is what stops a registration being submitted in your name from somewhere else. It holds no information about you, it is not readable by other sites, it disappears when you close your browser, and it is never used to track you. Because it is essential to a service you asked for, it does not need your consent — and there is nothing else to consent to, because there are no other cookies.

Why we use it, and our lawful basis

We have weighed those interests against your rights and consider them fair: this is ordinary business-contact information about someone acting in a work capacity, you supplied it deliberately in order to be contacted, we ask for nothing sensitive, we use it for nothing else, and you can object at any time at the address above and we will stop.

We do not process special category data — nothing about health, beliefs, ethnicity or anything comparable. There is no field on the form that calls for it, so please do not type any in.

Who else sees it

Our own people who handle registrations, and nobody else. We do not pass it to any other organisation for their own purposes, and it is never used for advertising.

It is held on infrastructure run for us by a third-party data-centre provider inside the European Economic Area. That provider acts only on our written instructions and is the only other party with any technical access. The UK recognises the European Economic Area as offering an adequate level of protection, so no further transfer safeguards are needed. Your information is not sent outside the UK or the EEA.

How long we keep it

180 days, if your registration does not become an account.

If your company has not been set up on Nexuss within 180 days of you sending the form — whether we declined, or simply because nothing came of it — an automated purge erases the personal details from the record: the administrator's name, email address, job title and phone number, the email domain, the company name and any internal note written about it.

What is left is a stub containing no personal information at all — the date the registration arrived, the size band, the sign-in preference, whether it was declined, and the date the purge ran. We keep that stub so we can demonstrate the purge actually happened and count how many registrations we have handled. It cannot be turned back into your details.

The purge runs automatically on a schedule and records the outcome of every run, including the runs that find nothing to erase — so a purge that silently stops working cannot look the same as one that had no work to do.

If your company does become a Nexuss customer, the registration stops being an enquiry and becomes part of your account record. From that point it is kept for as long as your company's agreement with us is in place, and afterwards for as long as we are required to keep business records.

Your rights

Under UK data protection law you can ask us to:

• Give you a copy of what we hold about you — a subject access request.
• Correct it if it is wrong or incomplete.
• Erase it. If you ask us to erase a registration that has not become an account, we will — you do not have to wait for the 180 days.
• Restrict what we do with it while a question about it is being sorted out.
• Object to our using it. We rely on legitimate interests, so this right applies squarely: tell us to stop contacting you and we will stop and erase the registration.
• Port it to another provider. This one applies to information held under consent or under a contract, so for most registrations it will not — but ask and we will tell you either way rather than leaving you to guess.

There is no charge, and we will reply within one month. Write to antony@15.group.

Complaints

If you are unhappy with how we have handled your information, please tell us first — we would rather put it right. You can also complain to the Information Commissioner's Office, the UK's independent supervisory authority for data protection. You do not have to come to us first.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · Helpline 0303 123 1113 · ico.org.uk/make-a-complaint

Changes to this notice

If we change what we collect or what we do with it, we will change this page and update the date at the top. The version in force on the day you registered is the one that applies to your registration.