Privacy notice

Who we are

nexaya is a cybersecurity and digital transformation consultancy with teams in Morocco, Nigeria, Ivory Coast, and Egypt, and an office in Frankfurt, Germany. This notice covers the website at nexaya.com. It does not cover the separate handling of data during a signed client engagement, which is governed by the agreement and non-disclosure terms you sign with us before that work begins.

What we collect

When you browse. We measure how visitors use this site: the pages you view, how you arrived (a search engine, an ad or a link, including any campaign tags in that link), clicks and scrolling, and your type of device and browser. We use this browsing data anonymously and in aggregate — we don't link it to your name or contact details.

When you submit a form. For example the assessment request or contact forms, we collect what you enter: your name, work email, company, website or domain, what you need, your country of operation, sector, organisation size, preferred language, and any message you add. With your answers we also record how you found us — the campaign tags in the link you arrived from, the site that referred you, the page you first landed on and, if you came from a Google or LinkedIn ad, that ad's click ID — so we know which campaigns lead to enquiries.

Technical information. Like most websites, our server also receives standard technical information your browser sends automatically, such as your IP address, browser type, and the page you requested.

Why we collect it, and our legal basis

We use what you submit to respond to your enquiry, route it to the right person on our team, and understand which services people are asking about. We use browsing data to see which pages and campaigns are useful, improve the site, and measure our advertising. Our basis for this is our legitimate interest in running and promoting our business and communicating with people who contact us, and, where relevant, your consent in submitting the form.

Analytics, advertising and third-party tools

This site uses the following tools, loaded through Google Tag Manager:

• Google Analytics and Google Ads — count visits and page views, and tell us when a visit that started from one of our ads leads to an enquiry. We use this data anonymously, for statistics.
• Contentsquare — records how visitors interact with our pages (clicks, scrolling, mouse movement) so we can find what is confusing or broken. We use this data anonymously, to improve the site.
• Apollo.io — uses your IP address to identify the organisation whose network you are browsing from, so we can understand which companies are interested in our services. This is not anonymous: it can link your visit to your organisation.
• LinkedIn Insight Tag — lets LinkedIn measure our LinkedIn ads and show our ads to people who have visited this site. LinkedIn may link this to your LinkedIn account; we only receive aggregate reports, not who you are.

These providers handle data under their own privacy policies. Their tools set cookies or use similar browser storage. Our site also keeps the campaign tags and referring page from your first visit in your browser's own storage, so they can be attached to an enquiry if you submit a form; otherwise they stay on your device. You can block or delete cookies and site data in your browser settings at any time. See our cookie notice for more detail.

Who we share it with

We do not sell personal data. We share what you submit with colleagues across our own offices who need it to respond to you, and with service providers who help us run this website (such as our hosting provider), each of them bound to keep it confidential and use it only for that purpose. Browsing data is processed by the analytics and advertising providers listed above, for the purposes described there.

International transfers

Because we operate across several countries, information you submit may be processed in a country other than the one you are in. Where that happens, we handle it consistently with the data protection law that applies to you — including Morocco's Loi 09-08 and the CNDP, Nigeria's Data Protection Act, Egypt's Law 151 of 2020, Ivory Coast's Loi 2013-450, and the GDPR where it applies.

How long we keep it

We keep enquiry information for as long as reasonably needed to respond to you and for a limited period afterward, then delete it. Where an enquiry becomes a signed engagement, data handling from that point is governed by the agreement covering that engagement, not this notice.

Your rights

Depending on where you are, you may have the right to ask us what information we hold about you, to correct it, to have it deleted, to object to how we use it, or to ask us to restrict our use of it. To exercise any of these, contact us using the details below.

Security

We apply the same security discipline to our own website's data that we bring to client engagements.

Contact us

If you have a question about this notice or want to exercise a right described above, get in touch via our contact page.

Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last revised.