Privacy Policy
Last updated: 2 September 2026
This policy explains how NXT Horizon Sp. z o.o. collects, uses and protects personal data in connection with the website nxthorizon.eu. We process data in accordance with the General Data Protection Regulation (GDPR).
1. Who we are
The controller of your personal data is NXT Horizon Sp. z o.o., ul. Zamknięta 10 lok. 1.5, 30-554 Kraków, Poland, VAT No. PL6793322404, registered under KRS 0001155133. In matters concerning personal data, write to hello@nxthorizon.eu. We have not appointed a Data Protection Officer; enquiries go to that address.
2. What data we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, e-mail address, company name, message content (contact form) | Answering your enquiry and, where it leads there, taking steps before entering into a contract | Art. 6(1)(b) and 6(1)(f) GDPR — steps prior to a contract and our legitimate interest in replying to enquiries |
| IP address, browser type, pages requested (server logs) | Keeping the site running, diagnosing faults, limiting form abuse | Art. 6(1)(f) GDPR — legitimate interest in the security of the service |
| Analytics cookies and identifiers | Understanding how visitors use the site | Art. 6(1)(a) GDPR — your consent, given in the cookie banner |
| Contact and billing details of clients | Performing a contract for automation services and issuing invoices | Art. 6(1)(b) and 6(1)(c) GDPR — contract and statutory accounting duties |
We collect nothing beyond what these purposes require. The contact form has no hidden fields other than a spam trap, which stores nothing.
3. Who we share data with
We share data only with processors we need in order to run the site and the service:
- Cyber_Folks S.A. — hosting of the site and of the mailbox that receives form submissions
- Google Ireland Limited — Google Analytics 4, only if you accept analytics cookies
- Anthropic, Inc. — the AI models we use to operate client automations, and only within the scope each client's agreement defines
- our accounting office — invoices and accounting documents, under statutory duties
We do not sell personal data and we do not share it for third-party marketing. Where a client entrusts us with personal data inside an automation, we act as a processor under a separate data-processing agreement.
4. Transfers outside the European Economic Area
Some processors (Google, Anthropic) are established in the United States. Such transfers are covered by Standard Contractual Clauses approved by the European Commission and, where applicable, by the EU–US Data Privacy Framework. The infrastructure on which we run client automations is located in the European Union.
5. How long we keep data
- Contact form enquiries: 24 months from the last message, unless they lead to a contract
- Client data: for the term of the contract and then for the period required by accounting and tax law (5 years from the end of the relevant tax year)
- Server logs: up to 12 months
- Analytics data: 14 months (Google Analytics default retention)
6. Your rights
Under the GDPR you have the right to:
- access — obtain a copy of the data we hold about you
- rectification — have inaccurate data corrected
- erasure — ask us to delete your data
- restriction — limit how we process your data
- portability — receive your data in a machine-readable format
- object — object to processing based on our legitimate interest
- withdraw consent — for analytics cookies, at any time, with no effect on processing carried out before withdrawal
To exercise any of these rights, write to hello@nxthorizon.eu. We answer within 30 days.
You also have the right to lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa (uodo.gov.pl).
7. Cookies
The site itself sets no cookies for tracking. We use:
- local browser storage — to remember your cookie decision, so the banner does not return on every visit
- Google Analytics 4 — only after you accept analytics cookies in the banner
Analytics runs under Google Consent Mode v2 with IP anonymisation. Until you accept, the Google Analytics script is not loaded at all — nothing leaves your browser, not even a cookieless ping. We do not enable advertising features, remarketing or ad data sharing. To change or withdraw your decision, clear this site's data in your browser; the banner will appear again on your next visit.
8. Security
The site is served over HTTPS. Form submissions are rate-limited and validated on the server. Access to enquiry mail and to client data is limited to people who need it to do the work.
9. Changes to this policy
We may update this policy. The current version is always the one published at nxthorizon.eu/privacy/, with the date of the last change at the top. If a change materially affects clients, we notify them by e-mail.