Privacy Policy

Last updated: June 2025

1. Who We Are

Neuvex is a cloud-based ePortfolio platform designed for training providers, employers, and learners engaged in apprenticeships and work-based learning. References to "Neuvex", "we", "us", or "our" in this policy refer to the company operating the Neuvex platform. We act as a data controller in respect of personal data collected directly through our website and marketing activities, and as a data processor in respect of learner and user data processed on behalf of our clients.

2. What Data We Collect

We may collect and process the following categories of personal data:

• Account information: name, email address, job title, and organisation when you register or are invited to use the platform.
• Learning and assessment data: evidence uploads, progress records, assessor feedback, and portfolio submissions created within the platform.
• Usage data: log files, IP addresses, browser type, pages visited, and time spent on the platform, collected automatically via cookies and analytics tools.
• Communications: messages sent to us via contact forms, email, or support tickets.
• Billing information: invoicing details provided by organisational clients (we do not store full payment card data).

3. How We Use Your Data

We use personal data for the following purposes:

• To provide, maintain, and improve the Neuvex platform and its features.
• To manage your account and deliver customer support.
• To communicate service updates, security notices, and policy changes.
• To send marketing communications where you have opted in to receive them.
• To comply with legal obligations and respond to lawful requests from regulatory or government authorities.
• To analyse usage patterns and improve platform performance and user experience.

4. Legal Basis for Processing

We process personal data under the following legal bases as defined by UK GDPR:

• Contract: processing necessary to fulfil our obligations under our agreement with you or your organisation.
• Legitimate interests: to operate and improve our services, and to prevent fraud or misuse.
• Legal obligation: where we are required to process data to comply with applicable law.
• Consent: for optional communications such as marketing emails, which you may withdraw at any time.

5. Data Sharing and Third Parties

We do not sell your personal data. We may share data with trusted third parties only where necessary:

• Cloud infrastructure providers who host and store platform data on our behalf.
• Analytics and monitoring tools used to maintain platform performance and security.
• Payment processors who handle billing on our behalf.
• Support and communication tools used to manage customer enquiries.

All third-party processors are bound by appropriate data processing agreements and are required to handle data in accordance with UK GDPR.

6. Data Retention

We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting obligations. When your account or your organisation's subscription ends, we will retain data for a reasonable period to allow for any dispute resolution or data export requests, after which it will be securely deleted or anonymised.

7. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. These include encrypted data transmission (TLS/HTTPS), access controls, regular security reviews, and secure data hosting. However, no method of transmission over the internet is entirely secure, and we cannot guarantee absolute security.

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access – to request a copy of the personal data we hold about you.
• Right to rectification – to request correction of inaccurate or incomplete data.
• Right to erasure – to request deletion of your personal data in certain circumstances.
• Right to restriction – to request that we limit how we use your data.
• Right to data portability – to receive your data in a structured, machine-readable format.
• Right to object – to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at privacy@neuvex.co.uk. We will respond within one calendar month in line with our legal obligations.

9. Cookies

We use cookies and similar tracking technologies on our website to improve your experience, analyse traffic, and support marketing activities. You can control or disable cookies through your browser settings at any time. Some functionality may be affected if cookies are disabled. We use Google Analytics to help us understand how visitors use our site; this data is anonymised and aggregated.

10. International Data Transfers

Where we transfer personal data outside of the UK or European Economic Area, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, in accordance with UK GDPR requirements.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Where changes are significant, we will notify users via email or a prominent notice on the platform. The date at the top of this page indicates when the policy was last revised.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern, please contact us:

• Email: privacy@neuvex.co.uk
• Support: help.neuvex.co.uk

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.