Privacy Policy.

01Information we collect

When you visit the website. Our website sets no cookies, runs no analytics or advertising, and loads nothing from other companies — its typefaces and everything else come from our own site. Like any website, our hosting provider receives your browser's network address to deliver the pages, and may keep standard technical logs for security and troubleshooting.

When you send an enquiry. Your name, work email, phone, company and how you heard about us; your event's details — name, dates, venue, city, attendance, spaces, services, budget range and your answers and notes; any documents you attach; and the network address the enquiry was sent from, which we use to limit abuse of the form.

When you use the portal. Your name, work email, organisation and role; your password, stored only as a one-way hash that cannot be turned back into it; your two-factor setup if you turn it on; the browser and network address of each sign-in, when it happened and when it was last used; failed sign-in attempts; the messages and files you send; the proposals you approve, with the record of each approval described in Electronic Signatures; and a record of significant actions (signing in, changing security settings, approving, downloading your data) with the network address they came from.

When you work with us. For team members and specialists: name, email, role, the jobs shared with you, your sign-ins and your actions in the team application. For vendors and their crews: business contact details, quotes, and the details of the people staffing a show.

From others. A colleague may add you to a project or ask us to give you a login; vendors send us proposals naming their staff; and we may use company websites and professional directories for business research.

We do not knowingly collect sensitive personal information — health, biometric, precise location, government identifiers or financial account numbers — and ask you not to send it. The portal takes no payments.

02How we use it, and why we are allowed to

• To reply to your enquiry and decide whether we are a fit for your event — to take steps you asked for before a contract.
• To carry out your engagement: developing scope, budget and documentation, soliciting and comparing vendor proposals, preparing proposals and invoices, and recording what was agreed — to perform our contract with you or your organisation.
• To keep the website and portal secure and prevent misuse: sign-in protection, sign-in alerts, malware scanning of uploads, limits on messages and enquiries, and the activity record — our legitimate interest in running a secure service, and yours in a protected account.
• To send you the messages the service needs: invitations, sign-in and password links, security alerts, and notices that a proposal or invoice is ready. These are service messages, not marketing.
• To keep business records and meet legal, tax and accounting obligations, and to enforce our agreements and resolve disputes — legal obligation and legitimate interest.
• To send occasional updates about our services where you have agreed or the law allows; you can opt out at any time — consent, which you may withdraw.

We do not sell personal information, share it for cross-context behavioural advertising, use it for targeted advertising, profile you, or make decisions about you by automated means alone. We do not use your project data to train artificial intelligence models, and we do not use one client's data to benefit a competing client.

03Who sees it

Vendors, in confidence. Sourcing means telling vendors what your show needs. When we solicit bids we share your event scope, dates, venue, technical requirements and a point of contact with prospective vendors, only as your engagement requires, and bound by confidentiality. Tell us before we start if anything must go no further.

People on your show. Team members and specialists we assign to your event see the parts of it they work on, and nothing else.

Service providers, under contract, only to provide their service to us:

• Amazon Web Services — hosting, storage, encrypted backups and email delivery, in the United States;
• Have I Been Pwned — when you choose a password we check whether it has appeared in a known data breach, by sending the first five characters of a one-way hash of it; neither your password nor anything that identifies you is sent;
• where we use an artificial-intelligence service to help design a client's portal, it is given only that client's name and design materials, never project data.

Malware scanning of uploaded files runs on our own servers; no third party sees your files for it.

Others, where needed: venues, for load-in, credentials and site access; our professional advisers — lawyers, accountants and insurers; authorities, when the law, a court or valid legal process requires it, or to protect the rights and safety of people; and a successor business if Nexus is merged, acquired or sold, which must honour this Policy.

04Cookies, browser storage and tracking

The website sets no cookies. When you sign in to the portal, a sign-in token is kept in your browser's storage so you stay signed in; signing out removes it, and it stops working after twelve hours. It is not used for anything else.

No third party collects information about your activity on our website or portal over time or across other websites, and we do not track you across other websites. Because we do not sell or share personal information or use targeted advertising, there is nothing for a "Do Not Track" or Global Privacy Control signal to switch off; we treat either as an opt-out in any case.

05How long we keep it

Our systems delete personal information on these schedules automatically, every night:

• Enquiries we did not take on, and their attachments: 12 months after the last activity on them.
• The activity record of sign-ins and actions: 7 years.
• Invitation and password links: 30 days after they were made, once used or expired. Portal access links: 90 days after they were made, once expired or withdrawn.
• Failed sign-in attempts: 1 day. Sign-in sessions: 30 days after they end. The browsers and addresses a login has used, which let us alert you to a new one: 1 year after last use.

Client, engagement, proposal, approval, invoice, payment, document and message records are kept for the life of the engagement and afterwards for as long as our legal, tax and professional record-keeping obligations require — generally seven years after the engagement ends. These are not deleted automatically, because business records are never removed by a timer; we delete them once we no longer need to keep them, or sooner at your request where the law allows.

Backups. Deleted information stays in our encrypted backups until they expire: 14 days on our server and 90 days in off-site storage.

When your portal login is closed, your name, email, password and two-factor setup are removed from it at once; the business records it relates to are kept as above.

06How we protect it

• Everything we store is encrypted — the database, the backups and the disks they sit on — and everything sent is encrypted in transit (HTTPS).
• Our team's application sits on a private server with no public address; only the client portal and the enquiry form are reachable from the internet.
• Passwords are stored only as one-way hashes, must be at least 12 characters, and are checked against known data breaches when chosen.
• Two-factor sign-in is required for every team login and available for every client login; repeated wrong passwords lock a login; sign-in alerts tell you about a new browser or address; you can see and end your sessions.
• Everyone sees only what their role and their work require.
• Every uploaded file is scanned for malware before anyone can open it.
• Significant actions are recorded, and backups are checked every week by restoring them.

No system is perfectly secure. If a breach affects your personal information, we will notify you, and regulators, as the law requires and without unreasonable delay.

07Your rights and choices

Depending on where you live — including under the privacy laws of many US states, and the GDPR and UK GDPR — you may have the right to:

• know what personal information we hold about you and how we use and share it, and get a copy of it in a portable format;
• have inaccurate information corrected;
• have it deleted, subject to the legal and contractual exceptions above;
• restrict or object to how we use it, and withdraw any consent you gave;
• opt out of its sale, sharing for advertising, targeted advertising or profiling — which we do not do;
• not be treated differently for exercising these rights.

In the portal, you can download a copy of your organisation's records at any time and close your own login.

To make a request, email hello@nexus-insight-strategies.com with the subject "Privacy request". We will confirm who you are — usually by checking details you have already given us — and answer within 45 days, or tell you within that time if we need up to 45 more. An authorised agent may make a request with proof of authority. If we hold your information because your employer engaged us, we may refer your request to that organisation, whose project data it is.

If we decline your request, you may appeal by replying to our answer; we will respond to the appeal within 45 days. If you are still not satisfied, you may contact your state's Attorney General, or, in the EU or UK, the data protection authority where you live.

Nevada residents may ask us not to sell their covered information by emailing the same address. We do not sell it.

08Where it is processed

We operate in the United States, and our information is stored and processed there. If you contact us from outside the United States, your information is transferred to and processed in the US, where privacy law may differ from yours; where the law requires, we use appropriate safeguards such as standard contractual clauses.

09Children

Our website, portal and services are for business use by adults. We do not knowingly collect personal information from anyone under 16; if you believe a child has given us information, contact us and we will delete it.

10Other websites and vendor systems

Our website links to partner websites, and during an engagement you may use vendor or venue systems. Those are run by other companies under their own privacy policies; we are not responsible for their practices.

11Changes to this policy

Each version of this Policy is published with its version number, date and effective date, and earlier versions stay available beside the current one. For a material change we will tell portal users by email or in the portal before it takes effect.

12Contact us

Questions, requests or complaints about privacy: Nexus-Insight Strategies LLC, hello@nexus-insight-strategies.com. Portal users can also send us a message in the portal. We answer within 45 days, or sooner where the law requires.