Privacy Policy

1. Who we are

NextStep.ai is a public business-to-business website operated by Composable Architectures Ltd (company number 14858550), a company registered in England and Wales. Composable Architectures Ltd is the controller of the personal data described in this policy.

Our registered office is 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF. This policy explains how we handle personal data when you visit the website or submit one of its forms.

2. Personal data we collect

When you use a contact or course-enquiry form, we collect your name and email address, together with any company, role and message information you choose to provide. We also record the date and time of the submission, your IP address, browser user-agent and the referring page or URL.

Name and email are needed for us to receive and answer an enquiry. Other form fields are optional unless the form states otherwise. Please do not use a public form to send special category data, criminal-offence data, passwords, trade secrets, client information or other sensitive or confidential material.

3. Why we use your data

We use form information to respond to and qualify business enquiries, arrange discussions you request, and understand the commercial context of your enquiry. We rely on our legitimate interests in managing B2B enquiries and developing business relationships. Where you ask us to take steps with a view to entering into a contract, we may also process the information because it is necessary to take those steps at your request.

We do not add people who submit a form to a newsletter or an automated marketing list.

We use IP addresses, user-agent and referrer information to protect the website and its forms, prevent spam and abuse, investigate technical or security issues, and maintain reliable operation. We rely on our legitimate interests in securing and operating the website. We do not use this information to build advertising profiles.

4. Who receives your data

Form submissions are accessible only to authorised Composable Architectures personnel who need them for the purposes above, and to OVH Limited / OVHcloud acting as our hosting processor. The website and form data are hosted in a UK datacentre. We do not sell personal data or disclose it to advertising networks.

We may disclose information where we are legally required to do so. We do not otherwise intend to transfer the personal data covered by this policy outside the United Kingdom. If that changes, we will use a lawful transfer mechanism and update this policy where appropriate.

5. How long we keep data

We keep a form enquiry for up to 24 months from the date it is received. Any authorised working copy is subject to the same retention period. Technical and security information in operational logs is kept only for as long as reasonably necessary to operate and protect the website, diagnose incidents and address abuse, after which it is deleted or rotated. We do not operate a separate automated backup system for form submissions.

6. How we protect data

We use appropriate technical and organisational safeguards designed to protect personal data, including restricted access and secure transmission of the website over HTTPS. No internet service can be guaranteed completely secure, so please use the forms only for the intended business enquiries and avoid sending sensitive or confidential material.

7. Cookies, analytics and third-party links

NextStep.ai does not currently set cookies, use analytics or advertising pixels, or store information in your browser through local storage. Website fonts and visual assets are hosted by us and do not require your browser to contact a font provider.

The website includes a link to LinkedIn but does not embed LinkedIn content or contact LinkedIn when the page loads. If you choose to follow that link, you leave NextStep.ai and LinkedIn will handle information about your visit under its own privacy policy.

8. Automated decisions

We do not use personal data collected through this website for automated decision-making or profiling that produces legal or similarly significant effects.

9. Your data protection rights

Depending on the circumstances, UK data protection law gives you the right to ask us for access to your personal data, correction of inaccurate data, erasure, restriction of processing and a portable copy of data you provided. You may also object to processing based on legitimate interests. If we ever rely on consent, you may withdraw it at any time without affecting earlier lawful processing. These rights are not absolute and exemptions may apply.

You have an absolute right to object at any time to the use of your personal data for direct marketing. We may need to verify your identity before acting on a rights request.

10. Contact and complaints

To ask a privacy question or exercise a data protection right, use our contact form or write to Composable Architectures Ltd at the registered office shown above.

You also have the right to complain to the UK Information Commissioner's Office. Information about making a complaint is available on the ICO website. We would welcome the opportunity to address your concern first, but you do not have to contact us before approaching the ICO.

11. Changes to this policy

We may update this policy when the website or our data-handling practices change. The latest version will be published on this page with a revised “Last updated” date.