Privacy Policy

This Privacy Policy is issued by Nexa Core Digital Ltd, a company registered in England and Wales under company number 16911508, with our registered office at 61 Suffolk Road, Ilford, England, IG3 8JG.

We operate the Nexa Legal platform, including the Nexa Legal OS practice management system accessible at nexalegal.cloud and app.nexalegal.cloud, and the Nexa Legal Connect client portal service (collectively, the Platform).

We are registered with the Information Commissioner's Office (ICO). If you have questions about whether your firm needs ICO registration, visit ico.org.uk.

For all data protection enquiries, contact us at: hello@nexalegal.cloud

This policy applies to all individuals whose personal data we process, including:

• Law firm administrators, solicitors, paralegals, and support staff who use the Platform as part of their firm's subscription (Firm Users)
• Clients of law firms who submit documents or information through the Platform's client portal (End Clients)
• Visitors to our websites at nexalegal.cloud and app.nexalegal.cloud
• Individuals who contact us by email, phone, or any other channel
• Prospective customers who enquire about our products or services

If you are a law firm using our Platform, you act as a Data Controller in respect of your clients' personal data processed through the Platform. We act as your Data Processor for that data. Our Data Processing Agreement, which forms part of our Terms of Service, governs that relationship separately.

3.1 Data you provide directly

• Account registration: name, email address, job title, firm name, phone number
• Firm profile: law firm name, SRA registration number, business address, practice areas
• Matter data: case names, matter types, client names, matter references, court dates, case notes, workflow stages
• Solicitor client account: client names, matter references, transaction amounts, payer details, bank statement data uploaded by your firm
• Documents: any files uploaded to the Platform by your firm or your clients through the client portal
• Billing: billing contact name, email address, and payment card details which are processed by Stripe — we do not store card numbers directly
• Communications: emails, support messages, feedback, and enquiries you send us
• Innovation partner applications: firm details, practice area information, and contact information submitted through nexalegal.cloud/partners

3.2 Data we collect automatically

• Usage data: pages visited, features used, session duration, actions taken within the Platform
• Device data: IP address, browser type, operating system, device identifiers
• Log data: server logs, error reports, performance data, access timestamps
• Cookies and similar technologies: see Section 11 for full cookie information

3.3 Special category data

The Platform may process special category personal data about your clients — such as health information in personal injury matters, immigration status, financial details, or family circumstances — as part of the case management and document storage functions. We process this data solely on your instruction as Data Controller. We do not use this data for any purpose beyond providing the Platform to your firm.

We do not sell your personal data. We do not share it with third parties for their own marketing purposes. We share data only in the following circumstances.

5.1 Service providers

We use carefully selected third-party providers to operate the Platform. Each is bound by a Data Processing Agreement:

5.2 Legal disclosure

We may disclose personal data where required by law, court order, or regulatory authority — including the ICO, SRA, HMRC, or law enforcement agencies. We will notify you where legally permitted before making such a disclosure.

5.3 Business transfers

If we sell, merge, or transfer all or part of our business, personal data held by us may be transferred to the acquiring entity. We will notify affected users in advance and ensure the receiving entity maintains equivalent data protection standards.

5.4 Development team

Our development team is based in Bangladesh. Team members access the Platform for development and support purposes under strict access controls, confidentiality agreements, and limited-scope credentials. This access is governed by appropriate contractual safeguards and is logged for audit purposes.

We acknowledge that data processed through the Platform may be subject to legal professional privilege. We will not access, disclose, or use privileged data except:

• To provide technical support that you have specifically requested
• Where required by a binding legal obligation
• As described in our Data Processing Agreement with your firm

Our team members are required to handle privileged legal data with appropriate care. Access to client matter data is restricted to authorised personnel only and only where necessary to provide support or maintain the Platform.

We are committed to keeping your data within the UK or European Economic Area wherever possible. Where data is transferred outside the UK or EEA — for example when using the Anthropic Claude API for AI features — we ensure appropriate safeguards are in place including:

• Standard Contractual Clauses approved by the ICO
• The UK International Data Transfer Agreement where appropriate
• Binding Corporate Rules where applicable

Anthropic, our AI provider based in the USA, processes data under standard contractual clauses. We minimise the personal data sent to Anthropic's API using data minimisation and anonymisation techniques where possible.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law.

When your firm cancels its subscription we will retain your data for the periods above and then securely delete or anonymise it. You may request earlier deletion subject to our legal retention obligations — see Section 9 for your rights.

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights:

To exercise any of these rights, email us at hello@nexalegal.cloud. We will respond within one calendar month of receiving your request. We may ask you to verify your identity before processing your request.

If you are not satisfied with how we handle your request, you have the right to complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or disclosure. Our security measures include:

If you become aware of any security vulnerability or potential breach relating to the Platform, please contact us immediately at hello@nexalegal.cloud.

We use cookies and similar technologies on our websites. A cookie is a small text file placed on your device when you visit a website.

You can control cookies through your browser settings and our cookie consent banner. Disabling strictly necessary cookies will affect Platform functionality. For more information about cookies, visit allaboutcookies.org.

The Platform is intended for use by legal professionals and law firms. It is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@nexalegal.cloud and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our processing activities, the law, or our business. When we make material changes we will:

• Notify all active firm administrators by email at least 14 days before the change takes effect
• Display a prominent notice within the Platform
• Update the Last Updated date at the top of this document

Continued use of the Platform after the effective date of any change constitutes acceptance of the updated policy. If you do not agree with a material change, you may cancel your subscription before the effective date.

For any questions, concerns, or requests relating to this Privacy Policy or how we handle personal data:

We aim to respond to all data protection enquiries within five business days and all formal rights requests within one calendar month.

If you are not satisfied with our response, you may complain to the Information Commissioner's Office: