Privacy

Who holds the data

Nexaflow Research Limited is the controller for personal data collected through this site and can be contacted at notifications@wwwnexaflow.com.

What is collected

• Account details — name, role, work email address, and the organisation, registration reference and address given at registration.
• Verification evidence — what the Companies House register returned at the time the organisation was checked, retained so a verification decision can be accounted for later.
• Orders — what was ordered, the lot supplied, the delivery address and any purchase order reference.
• Declarations — the terms and research use confirmations accepted, with the wording shown, the time, the IP address and the browser reported.

Why it is held

Account and order data is held to perform the contract of sale. The record of declarations, and any organisation details and verification evidence given, are held on the basis of legal obligation and legitimate interest: they are what establishes on what terms materials were supplied and to whom, and they exist to be produced if that is ever questioned.

How long

Order records, verification evidence and declarations are retained for six years after the end of the relationship, in line with the period for which records of a sale may be needed. Account details are deleted on request where no order history requires them to be kept.

Who processes it for us

Personal data is not sold or shared for marketing. These providers process it on our behalf, only to run the service:

• Vercel — hosts the website, and counts page visits (Vercel Web Analytics: no cookies, no cross-site tracking, visitors are not identified).
• Supabase — stores the database of accounts and orders, in the EU (Frankfurt).
• Resend — sends order and account emails, from the EU (Ireland).
• Google Workspace — receives email sent to our support address.
• Tide (with ClearBank) — our business bank account, which receives bank-transfer payments and shows the payer’s name and reference.

Where a provider processes data outside the UK, it does so under the UK’s adequacy regulations or standard contractual safeguards.

Cookies

• Age confirmation — records that the 18+ confirmation was given, so it is not asked on every visit. One year.
• Session — keeps you signed in. Fourteen days.
• Order — holds the contents of your order before checkout. Thirty days.

All three are necessary for the site to function and none is used for advertising or analytics.

Your rights

You can ask for a copy of the personal data held about you, for inaccurate data to be corrected, and in some circumstances for data to be deleted or its processing restricted. You can complain to the Information Commissioner’s Office.