Scope, Regulatory Framework, & Data Controller vs. Processor Roles
STATUTORY GOVERNANCE STATEMENT: NexGen Business Hub CIC enforces data protection safeguards across all digital services to ensure total compliance with the UK data privacy framework.
This Privacy Policy and Cookies Notice applies to all personal data collected, stored, or processed by NexGen Business Hub CIC via its Platform, administrative portals, and associated digital applications.
Legislative Compliance Framework
Processing operations strictly comply with:
The UK General Data Protection Regulation (UK GDPR);
The Data Protection Act 2018 (DPA 2018); and
The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).
Functional Data Protection Roles
DATA PROTECTION ROLE MATRIX
DATA CONTROLLER | Account Creation, Invoicing, Platform Telemetry, Marketing.
DATA PROCESSOR | Customer Business Content uploaded for AI & Hub processing.
NexGen Business Hub CIC as Data Controller: The Company acts as a Data Controller for personal data where it determines the purposes and means of processing. This includes user account registration data, billing and transactional metadata, administrative contacts, system usage telemetry, consent logs, and statutory reporting records.
NexGen Business Hub CIC as Data Processor: The Company acts as a Data Processor when hosting or executing operations on personal data embedded within business files, client records, and prompt inputs uploaded by the Customer to the Platform.
Public Reporting Transparency: Administrative telemetry, governance metrics, and data handling protocols align with the public disclosure requirements of the annual CIC Report filed at Companies House.
Statutory Contact & Compliance Escalations
Inquiries regarding data protection, statutory privacy rights, or Subject Access Requests (SARs) should be directed to:
Data Protection Lead: NexGen Business Hub CIC Compliance Office
Postal Address: Office of the Regulator of Community Interest Companies, Crown Way, Cardiff, CF14 3UZ (Ref: NexGen Hub Compliance)
Email Contact: compliance@nexgenbusinesshubcic.com
Lawful Bases for Processing & AWS UK Data Residency Architecture
OPERATIVE PROCESSING SPECIFICATIONS: Personal data is processed strictly under defined statutory legal bases and hosted within UK sovereign boundaries.
Mapping of Lawful Bases under UK GDPR Article 6
The following schedule defines the legal grounds supporting processing activities conducted on the Platform:
Processing Activity
Categories of Personal Data
Statutory Lawful Basis (UK GDPR)
Account Creation & Service Delivery
Full name, business email address, job title, login credentials
Contractual Necessity (Article 6(1)(b))
Billing & Invoicing Operations
Corporate address, transaction logs, payment card metadata
Contractual Necessity (Article 6(1)(b)) & Legal Obligation (Article 6(1)(c))
Platform Security & Infrastructure Health
IP addresses, browser user-agents, crash diagnostic logs
Legitimate Interests (Article 6(1)(f))
Corporate Governance & CIC Reporting
Director records, stakeholder feedback, financial disclosures
Legal Obligation (Article 6(1)(c))
Direct Marketing & Optional Cookies
Marketing preferences, cookie consent preferences
Explicit Consent (Article 6(1)(a))
Localized Sovereign Data Residency
Primary AWS UK Region: Core database storage, backup snapshots, user account tables, and cloud server compute engines are strictly localized within the Amazon Web Services (AWS) London Region (eu-west-2).
Sovereign Boundaries: Customer account data and primary application databases remain within the United Kingdom, eliminating unvetted cross-border transfers for primary hosting operations.
AI API Sub-Processing, International Transfers, & Data Integrity Warranties
TECHNICAL SAFEGUARDS FOR EXTERNAL AI PROCESSING: Operational interactions with external artificial intelligence engines are subject to strict technical controls and international transfer instruments.
Data Flow and Sub-Processor Architecture
To deliver natural language processing and business intelligence capabilities, the Platform routes prompt payloads to external APIs managed by OpenAI OpCo, LLC and Anthropic PBC.
DATA FLOW ARCHITECTURE
User Prompt -> AWS UK (eu-west-2) -> Encrypted API -> OpenAI / Anthropic (US)
Output Generation -> Ephemeral Deletion -> AWS UK -> User Interface
Binding Data Protection Warranties
Zero Model Retraining: Third-party AI sub-processors are legally prohibited under API developer agreements from using Customer prompt payloads or generated outputs to train, retrain, or improve their AI models.
Transient Processing: Payload inputs are held in volatile memory solely for the duration required to generate the output response, after which session data is ephemerally purged.
Transit Encryption: All API communications between AWS UK infrastructure and AI endpoint nodes are secured using mandatory TLS 1.3 cryptographic protocols.
Safeguards for International Data Transfers
Where processing requires data to be processed outside the UK (including transfers to vendor systems located in the United States):
Transfers are executed pursuant to the UK International Data Transfer Addendum (IDTA) to the European Commission's Standard Contractual Clauses; or
Secured under approved UK Adequacy Regulations in accordance with Article 46 of the UK GDPR.
Data Subject Rights, Self-Service Erasure, & ICO Escalation Pathways
OPERATIVE RIGHTS ENFORCEMENT: Individual data subjects possess statutory rights regarding their personal data held by the Data Controller.
Summary of Statutory Data Subject Rights
In accordance with Chapter III of the UK GDPR, data subjects have the right to request:
Access (Article 15): Confirmation of processing and copy access to personal data.
Rectification (Article 16): Correction of inaccurate or incomplete personal records.
Erasure (Article 17): Deletion of personal data where legal retention grounds cease to apply.
Restriction (Article 18): Suppression of processing under specified dispute conditions.
Data Portability (Article 20): Transmission of personal data in a structured, machine-readable format.
Objection (Article 21): Termination of processing based on legitimate interests or direct marketing.
Operational Self-Service Account Erasure
To facilitate prompt statutory compliance, the Platform provides automated data erasure functionality:
Navigate to Account Settings -> Security & Privacy -> Request Account Deletion.
Executing account deletion initiates an automated database workflow that permanently scrubs personal profile data, user credentials, and active session tokens within thirty (30) days, subject to statutory financial retention mandates (such as HMRC record-keeping laws).
SLA Timelines and Regulatory Escalation
Subject Access SLA: All formal SARs and data rights requests shall be acknowledged promptly and satisfied within thirty (30) calendar days of identity verification.
Supervisory Authority Escalation: Data subjects maintain the right to lodge a complaint regarding data handling with the official UK data protection regulator:
Supervisory Authority: Information Commissioner’s Office (ICO)
Website Portal: https://ico.org.uk
Telephone Helpline: 0303 123 1113
Cookie Governance and Classification Framework
OPERATIVE TRACKING REGIME: Web tracking technologies utilized on the Platform comply strictly with the Privacy and Electronic Communications Regulations (PECR).
Active Cookie Classifications
Cookies deployed on the Platform are categorized as follows:
Strictly Necessary Cookies (Mandatory): Essential technical tokens required for web application mechanics, user authentication, session security, load balancing, and CSRF protection. These cookies are non-optional as core platform functionality depends upon them.
Functional Cookies (Optional): Retain user interface customizations, language preferences, and dashboard display options across login sessions.
Analytical & Performance Cookies (Optional): Gather aggregated, fully anonymized performance metrics (such as page render speeds and error rates) to maintain platform stability.
THIRD-PARTY TRACKING EXCLUSION
NexGen Business Hub CIC STRICTLY EXCLUDES third-party advertising, retargeting,
and cross-site behavioral tracking cookies from the Platform.
User Preference Management
Users can configure optional cookie settings at any time:
Click the Cookie Settings link located in the Platform footer; or
Toggle Functional or Analytical cookies ON or OFF and click "Save Preferences".
Browser-level cookie blocking may be applied, though blocking necessary cookies will cause authentication and interface failures.