Privacy Notice

1. Who we are

NextStep Modern Solutions Ltd, registered in England and Wales, company number 16130752. Registered office: 105 Howard Road, Dartford, Kent, DA1 1XS.

Dan Kemp, a director, is responsible for data protection. Write to enquiries@nextstepmod.com or to the registered office.

2. If we emailed you about our services

We email named decision-makers at UK limited companies and limited liability partnerships to offer a free AI Strategy Call. If you received one of those emails, this is what you should know.

• Where we got your details: from Apollo.io, a business contact database, and from information your business publishes, such as its website. We use work email addresses that Apollo has verified.
• What we hold: your name, job title and work email address; your business's name, website, size, sector and location; facts your business publishes about itself; and whether you replied.
• Why, and our lawful basis: to tell businesses about a service that may help them. We rely on legitimate interests (UK GDPR Article 6(1)(f)). We have assessed that this does not override your interests, and you can object at any time.
• Who we email: people at limited companies and LLPs only, at work addresses. Never personal or freemail addresses, never sole traders, never our current clients.
• No tracking: our emails carry no tracking pixels and no tracked links. We do not know whether you opened an email.
• How to stop it: reply "no thanks", or anything like it, and we will not email you again. We keep your email address on a "do not contact" list so it never happens again. You can ask us to do the same for your whole business.
• How long we keep it: if you do not reply, we delete your details 12 months after our last email. If you replied but did not go further, 24 months after we last spoke.

3. Other information we collect, and why

• When you contact us or book a call: your name, email, phone number, business and what you tell us, including your answers when you book through Calendly. We use it to reply, prepare for and hold the call. Lawful basis: legitimate interests in answering you, or steps you ask for before a contract.
• On our calls: what is said, and a recording and transcript if we record (see section 4). We use it to remember accurately what we discussed and to follow up. Lawful basis: legitimate interests.
• When your business works with us: names, roles, work contact details, what you tell us during the work, and signatures on agreements. We use it to deliver our services, invoice and keep records. Lawful basis: contract with your business, legitimate interests, and legal obligation for accounting records.
• When you reply to us or email us: your message and contact details, so we can answer you. Lawful basis: legitimate interests.
• We do not set out to collect special category information, such as health information. Please do not share it with us.

4. Call recording

We record some calls with Fathom, a recording and note-taking tool, so we can give you our full attention and keep an accurate summary. We tell you before we record. If you would rather not be recorded, say so and we will not record, with no effect on the call. Recordings and transcripts are deleted 12 months after the call. The summary and actions stay with our record of the conversation.

5. AI

We use AI tools, including our own AI assistants built on Anthropic's Claude, to research businesses, draft emails and summaries, and prepare for calls. A person at NextStep approves who we contact and what we say, and nothing is launched without that person. We only use AI services whose business terms say they do not train their models on what we send them. We do not make decisions about you by automated means that have legal or similarly significant effects.

6. Who we share it with

We do not sell personal information. We share it only with service providers who help us run the business, under contracts that require them to protect it and use it only for us:

• Hosting and our own systems: Railway, Supabase
• Email and documents: Google Workspace
• Business email outreach: Instantly
• Business contact data: Apollo.io
• Booking and calls: Calendly, Fathom
• AI: Anthropic
• Workflow automation: n8n
• Agreements and e-signature: Documenso
• Accounts and payments: Xero, GoCardless, PayPal
• Internal messaging: Slack

7. International transfers

Some of these providers are based in, or store data in, the United States or elsewhere outside the UK. We use them only where the transfer is protected: by UK adequacy regulations, the UK-US data bridge for certified companies, or the UK International Data Transfer Agreement or Addendum built into the provider's data processing terms.

8. How long we keep it

• People we emailed who did not reply: 12 months from our last email.
• People who replied but did not go further: 24 months from when we last spoke.
• The "do not contact" list: for as long as we send marketing emails, so we never contact you again. It holds only the email address or business domain and the date.
• Call recordings and transcripts: 12 months from the call.
• Client records and signed agreements: 6 years after the work ends.
• Accounting records: 6 years from the end of the financial year they relate to.

9. Your rights

You have the right to:

• Object to direct marketing at any time. We will always stop.
• Object to other use of your information that relies on legitimate interests.
• Access the personal information we hold about you.
• Have it corrected if it is wrong or incomplete.
• Have it deleted where we have no good reason to keep it. If you ask us to stop marketing to you, we keep your email address on the "do not contact" list, and only for that.
• Restrict how we use it while a concern is looked into.
• Receive it in a portable format, where the law allows.
• Withdraw your consent at any time, where we rely on it.

10. How to use your rights, or complain

Email enquiries@nextstepmod.com. We reply within one month. If you are unhappy with how we have handled your information, please tell us first and we will look into it.

You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.

11. Cookies

This website uses only cookies it needs to work, such as remembering whether a menu is open. We do not use advertising or analytics cookies.

When you open our booking calendar, Calendly loads and may set its own cookies, under Calendly's cookie policy. If we ever add analytics or advertising that uses cookies, we will ask for your consent first and update this notice.

12. Security

We use technical and organisational measures to protect personal information, including access controls, encryption in transit and audit logs of who changed what. No system is perfectly secure, and we will tell you and the ICO about a serious breach when the law requires.

13. SMS messaging and your mobile information

If you opt in to SMS messages from us, we collect your mobile phone number and your consent to be contacted by SMS. We use this only to send the messages described in our SMS Terms of Service, such as enquiry responses, appointment confirmations, service updates, and occasional marketing. Message frequency varies and you may receive up to 10 messages per month. Message and data rates may apply.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. SMS opt-in data and consent will never be sold or shared with any third parties for any purpose. This is a firm commitment and applies to every category of information described in this notice.

You can opt out of SMS messages at any time by replying STOP to any message. For help, reply HELP or email support@nextstepmod.com.

14. Changes to this notice

We update this notice when how we use personal information changes, and show the date at the top of the page.

Questions about this page? Email us at enquiries@nextstepmod.com or head back to the homepage.