Privacy policy

The controller for the processing described here is:

Company

NEXLANE LTD

Registered in

England and Wales

Company number

17162596

Registered office

78 Clayton Way, Clayton Le Moors, Accrington, BB5 5WT, England

Email

support@nextdms.co.uk

Phone

+44 7356 181898

Send questions about data protection, requests about your rights and complaints to support@nextdms.co.uk.

This privacy policy applies to our website nextdms.co.uk and its help centre, the NextDMS platform and the dealer websites we host. It describes what we process as controller: accounts, dealerships as our customers, billing, support, security and the website. It is written under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

What a dealership records in NextDMS about other people, such as its customers, suppliers, test-drive drivers or buyers who enquire through Autotrader, we process on the dealership's behalf under the data processing agreement. The dealership is the controller for that data. It informs the people concerned and answers their requests; anything about it that reaches us, we pass to the dealership. The same applies to the websites dealerships run with NextDMS and to their visitors' data.

3.1Visiting the website

When you visit our website, we process your IP address, browser, device, the page requested and the time, to deliver the page and protect it from attacks. The lawful basis is our legitimate interest in a secure website (Article 6(1)(f) UK GDPR). We keep no access logs. Counters we use to limit the number of requests expire after an hour at most.

Statistics run only if you agree in the cookie settings. The details are in the section "Cookies and storage on your device".

3.2Contact form

When you write to us through the contact form, we process your name, email address and message and, if you give them, your dealership and phone number, to answer your enquiry (Article 6(1)(b) UK GDPR). The message reaches support@nextdms.co.uk through the email service Resend. We delete it three years after our last contact if no contract follows.

As soon as you use the form, the page loads Cloudflare Turnstile. Turnstile checks technical features of your browser and your IP address to tell whether a person is writing, which protects the form from spam. We keep your IP address and email address for one hour to limit the number of messages. The lawful basis is our legitimate interest in preventing misuse (Article 6(1)(f) UK GDPR).

4.1Account

For your account we process your first name, last name, email address, password, language and your profile photo if you upload one. We store the password only in a form from which it cannot be recovered. When you sign up, we record when you accepted which version of the terms of service.

If a dealership invites you, we receive your name and email address from that dealership. The dealership sets your role and permissions.

The lawful basis is the contract of use (Article 6(1)(b) UK GDPR). For invited team members it is the dealership's legitimate interest and ours in working as a team (Article 6(1)(f) UK GDPR). Without a name and email address we cannot create an account.

4.2Dealership

For the contract with your dealership we process the company name, address, contact details, logo, company number, VAT number, FCA number and bank details. They appear on the documents your dealership produces with NextDMS. These details are personal data where they relate to people, for example sole traders.

We store login details for platforms you connect, such as Autotrader, encrypted and use them only for your dealership's connections.

4.3Retention

We keep the account and the dealership's data for as long as the contract runs. If you close your dealership, you can reopen it for 30 days. We then delete it with all its data and every account that belongs to no other dealership. We keep the record of the closure, with the name and email address of the person who closed it and their reason, for three years, to answer questions about the end of the contract.

For billing we process the invoice recipient, billing address, billing email address, VAT number, plan, add-ons and payments. You enter your card directly with our payment provider Stripe. We see only the card brand, the last digits and the expiry date.

The lawful bases are the contract (Article 6(1)(b) UK GDPR) and our legal duty to keep accounting and tax records (Article 6(1)(c) UK GDPR). We keep invoices and accounting records for 6 years from the end of the accounting period they belong to, as UK company and tax law requires.

When you write to us or call us, we process your details and the history of your request to deal with it (Article 6(1)(b) UK GDPR). We delete the history three years after our last contact.

We send the emails the service requires to your dealership's team members: email confirmation, invitations, password resets, invoices and payments, backups and the closure of the dealership. We send marketing only with your consent.

When a dealership signs up or closes, we tell our team internally the dealership's name, the name and email address of the person acting and, on closure, their reason (Article 6(1)(f) UK GDPR).

When you use NextDMS, we log who did what and when, with the IP address and browser. This lets us detect attacks and misuse, fix faults and trace what happened. The lawful basis is our legitimate interest in a secure platform (Article 6(1)(f) UK GDPR). We delete the logs after 48 months at most.

NextDMS reads receipts and invoices so that expenses and purchases need not be typed in. The results are suggestions the dealership checks. NextDMS makes no decisions about people, automated or otherwise (Articles 22A to 22D UK GDPR).

We also use uploaded receipts to improve this reading. Before we do, we obscure the personal data in them. This happens on our own servers; the receipts are not passed to anyone outside our company. The lawful basis is our legitimate interest in reliable document reading (Article 6(1)(f) UK GDPR).

9.1Platform

The platform sets only the cookies it needs to work. It sets no cookies for statistics or advertising.

auth_session

Keeps you signed in. Kept for 30 days.

locale, sidebar, record-rail, privacy, page_size, calendar_mode, tasks_view, tasks_pj, leads_view

Remember your language, the sidebar, privacy mode, views and list page sizes. Kept for one year.

The platform keeps your recent search results in your browser's local storage. When you add a card, the platform loads Stripe's payment form; Stripe may set its own cookies to prevent fraud.

These are strictly necessary for the service you use, so they need no consent (regulation 6 and Schedule A1, paragraph 4, PECR).

9.2Website

On your first visit to our website, you decide what may run beyond what is necessary. Statistics stay off until you agree. You can change your choice at any time under "Cookie settings" at the foot of every page. If you withdraw consent, we delete the cookies and stored data of that category, except the entry that records your withdrawal.

Essential

Stores your choice, so we do not ask on every visit and can show that you consented (Article 6(1)(c) UK GDPR).

Statistics

PostHog counts visits and shows how the website is used: page views and page leaves, clicks on links and buttons, heatmaps, loading times (web vitals) and session recordings in which everything typed into form fields is masked. This processes your IP address, browser and device, the pages you visit and a random identifier. Provider: PostHog Inc., USA; stored on servers in the EU (Frankfurt).

Statistics run only with your consent (Article 6(1)(a) UK GDPR; for cookies and your browser's storage, regulation 6 and Schedule A1, paragraph 2, PECR). You can withdraw it at any time, with effect for the future, under "Cookie settings" at the foot of every page.

The website sets these cookies and entries in your browser's storage:

nextdms-cookie-consent

Essential. Your choice in the cookie settings. Kept for 180 days.

ph_<project ID>_posthog

Statistics. A random identifier for your browser and your session, as a cookie and in local storage. Kept for 365 days as a cookie; in local storage until you withdraw consent.

ph_<project ID>_window_id, ph_<project ID>_primary_window_exists

Statistics. Links page views to the browser window, in session storage. Kept until you close the window.

__ph_opt_in_out_<project ID>

Statistics. Records whether you agreed to statistics or withdrew, in local storage. Kept until you clear your browser's storage.

We run the platform and its databases on our own servers in the United Kingdom or the European Union. For the rest of the processing we use these service providers. They process data only on our instructions:

DigitalOcean, LLC, USA

Storage of files, such as profile photos and logos. Location: United Kingdom or European Union.

Amazon Web Services EMEA SARL, Luxembourg

Storage of backups. Location: United Kingdom or European Union.

Cloudflare, Inc., USA

Delivery of the website and the platform, protection from attacks, spam protection with Turnstile.

Resend, Inc., USA

Sending emails and the messages from the contact form.

Stripe Payments UK, Ltd., United Kingdom

Payments and invoices.

PostHog Inc., USA

Website statistics, only with consent. Location: European Union.

Discord Inc., USA

Internal messages about sign-ups, closures and faults.

Beyond them, data goes only to those we must or may give it to: HMRC and courts where a law requires it, and our accountants and solicitors, who are bound to confidentiality.

Transfers to the European Union rely on the United Kingdom's adequacy regulations for the European Economic Area. Several service providers are based in the USA. Where we transfer data there, we rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the International Data Transfer Addendum to the European Commission's standard contractual clauses (Articles 45A and 46 UK GDPR). You can get a copy of the safeguards from support@nextdms.co.uk.

Access

You can find out which data we process about you (Article 15 UK GDPR).

Rectification

We correct inaccurate data (Article 16 UK GDPR).

Erasure

We delete your data unless we must keep it (Article 17 UK GDPR).

Restriction

We restrict the processing where the conditions are met (Article 18 UK GDPR).

Data portability

You receive the data you gave us in a common, machine-readable format (Article 20 UK GDPR).

Objection

Where we rely on legitimate interests, you can object on grounds relating to your situation (Article 21 UK GDPR). You can object to marketing at any time without giving reasons.

Withdrawal of consent

You can withdraw consent at any time, with effect for the future (Article 7(3) UK GDPR).

To exercise a right, write to support@nextdms.co.uk. We answer within one month. If we are unsure who is asking, we may ask for proof of identity.

If you are unhappy with how we handle your personal data, you can complain to us at support@nextdms.co.uk. We acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.

You also have the right to complain to the Information Commission, the UK's data protection regulator:

Regulator

Information Commission

Address

4th Floor, No.3 Circle Square
5 Hawkshaw Street
Manchester M1 7BL

Phone

0303 123 1113

Website

ico.org.uk

We update this privacy policy when our processing or the law changes. We tell customers about material changes by email or in the platform. The date of the current version is shown at the top of this page.