Privacy policy

The short version: we ask only for what we need to assess your request and do the work. We do not sell anything on, we will not put you on a list you did not ask for, and there is no advertising or analytics code on this site.

1 · Who processes your data

The controller is Nexus Bridge B.V.

Address	[straat en nummer], [postcode] [plaats], the Netherlands
Chamber of Commerce	[KvK-nummer]
Email	privacy@nexusbridge.biz
Phone	[telefoonnummer]

We have no data protection officer, and are not required to appoint one. Privacy questions arrive at the address above and are answered by one of the founders.

2 · What we process

If you complete the intake form

• Name, company name, email address, phone number and website
• Country, product category, a description of what you want made, quantities, indicative purchase budget and required delivery moment
• The modules you are interested in and any notes you add
• The time of submission and the country associated with your IP address

If you email or call us

• Your contact details and the content of your message or notes from the conversation

If you become a client

• Contact details of the people involved, invoicing and VAT details, and the correspondence and documents belonging to the engagement

If you visit the site

• Technical logging by our hosting provider: IP address, time, page requested, browser type and referrer. This logging is necessary to deliver and protect the site.

3 · Why, and on what legal basis

Purpose	Legal basis
Assessing your request and contacting you	Performance of a contract or steps taken at your request prior to entering into one (Art. 6(1)(b) GDPR)
Carrying out an engagement: sourcing, negotiation, inspection, supervision	Performance of the contract (Art. 6(1)(b) GDPR)
Invoicing and administration	Legal obligation (Art. 6(1)(c) GDPR)
Delivering and securing the site and preventing abuse of the form	Legitimate interest: a working and secure website (Art. 6(1)(f) GDPR)
Informing an existing client about an additional service	Legitimate interest, with an opt-out in every message (Art. 6(1)(f) GDPR)

We do not take decisions about you based solely on automated processing and we do not carry out profiling.

4 · How long we keep it

A request that does not lead to an engagement	24 months, so that we can place a follow-up request in context. Deleted after that.
Correspondence with clients	Up to 7 years after the last engagement is completed, in line with record-keeping duties and limitation periods.
Invoices and accounts	7 years (Dutch statutory retention period for tax records).
Technical logging	A maximum of 30 days at our hosting provider.

5 · Who we share it with

We do not sell or trade your data. We do use service providers who process on our behalf, and we have a data processing agreement with each of them.

Cloudflare	Hosting of this site and handling of the form. Servers in the EU and worldwide.
Resend	Delivery of the form as an email to us and of your confirmation email.
[e-mailprovider]	Our business email and calendar.
[boekhoudpakket]	Invoicing and administration, for clients only.
Sourcers and inspection companies	Only during a running engagement, and only the data needed to do the work.
Accountant, lawyer or debt collector	Only when necessary, and only what is necessary.

We also share data where the law obliges us to.

6 · Transfers to China

Our sourcers, inspection companies and suppliers are located in China. If you run an engagement with us, the data needed for it — usually the contact person's name and business email address, and the product specification — is shared with those parties.

China is not covered by an adequacy decision of the European Commission. We therefore base such transfers on the European Commission's standard contractual clauses or, where the transfer is necessary for performance of the contract with you, on Article 49(1)(b) GDPR.

We limit what travels. Personal data that is not needed to have a product made or checked does not go to China.

7 · Cookies and measurement

This site places no analytics, advertising or tracking cookies and loads no fonts, scripts or pixels from third parties. There is no Google Analytics, no Meta pixel and no chat widget on it.

Our hosting provider may place a strictly necessary security cookie to counter bots and abuse. No consent is required for that. More on this in the cookie policy.

8 · Security

The site is reachable over HTTPS only. The form is sent encrypted and arrives in a business mailbox protected by two-factor authentication. Access to requests and client files is limited to the two founders and, per engagement, the sourcer working on it.

Do you suspect a leak or a vulnerability? Email privacy@nexusbridge.biz. We respond within two business days and will not pursue you for a report made responsibly.

9 · Your rights

You have the right to access your data, to have it corrected and to have it erased. You can also restrict processing, object to processing based on legitimate interest, and request your data in a common file format in order to transfer it.

Send your request to privacy@nexusbridge.biz. You will receive a reply within one month. We may ask for additional details to establish your identity, so that we do not hand someone else's data to you.

Where we process something on the basis of your consent, you can withdraw that consent at any time. This does not affect processing carried out beforehand.

10 · Filing a complaint

If we cannot resolve it between us, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), PO Box 93374, 2509 AJ The Hague, autoriteitpersoonsgegevens.nl. We would rather hear it from you first, but that right stands separately from us.

11 · Changes

If our way of working or our set of service providers changes, we update this policy. The date at the top of this page shows when that last happened. For a significant change we inform existing clients by email.