NextWave Hub UK ("NextWave Hub", "we", "us") is committed to protecting your personal data. This notice explains how we collect, use, store and share your information when you use this platform, our courses, business tools and related services, in compliance with the UK General Data Protection Regulation (UK GDPR), the EU GDPR (Regulation (EU) 2016/679) and the Data Protection Act 2018.
1. Data Controller
The data controller responsible for your personal data is NextWave Hub UK, United Kingdom.
Email: nextwavehubuk@gmail.com
2. Personal data we collect
- Account data: name, email address, password (hashed), language preference.
- Billing data: billing name, address, country, VAT/tax ID (where applicable), subscription tier, invoice history. Card details are handled directly by Stripe — we never see or store your full card number.
- Learning data: course progress, completed modules, certificates issued.
- Communications: messages you send via the contact form or email.
- Technical data: IP address, browser type, device information, pages visited, timestamps, basic analytics events.
- Cookies: strictly necessary cookies for authentication and session; functional cookies for language preference.
3. How we use your data (purposes & lawful bases)
- Provide the service (account, course access, certificates) — performance of a contract.
- Take and process payments, manage subscriptions, prevent fraud — contract and legitimate interests.
- Transactional emails (welcome, receipts, password reset, certificate ready, billing failures) — contract.
- Customer support and replying to enquiries — legitimate interests.
- Legal and accounting obligations (HMRC, VAT records) — legal obligation.
- Service improvement and analytics — legitimate interests, minimised data.
- Marketing emails — only with your consent; you can withdraw at any time.
4. Sharing and processors
We do not sell your data. We share it only with the processors we need to run the service:
- Stripe Payments Europe, Ltd. — payment processing and subscription billing.
- Supabase (Lovable Cloud) — database, authentication and file storage hosting.
- Cloudflare — content delivery, DDoS protection and edge hosting.
- Email delivery provider — sending transactional emails.
All processors are bound by data processing agreements and appropriate safeguards (Standard Contractual Clauses where relevant).
5. International transfers
Some processors may transfer data outside the UK / EEA. Where this happens, we rely on UK / EU adequacy decisions or Standard Contractual Clauses with additional safeguards to ensure your data receives an equivalent level of protection.
6. Retention
- Account and learning data: while your account is active, plus 12 months after deletion request, except where law requires longer.
- Billing and invoice records: 6 years (UK HMRC requirement).
- Support emails: up to 24 months.
- Server logs and security data: up to 90 days.
7. Your rights under UK / EU GDPR
You have the right to:
- Access your personal data and receive a copy.
- Have inaccurate data corrected.
- Have your data erased ("right to be forgotten"), subject to legal retention.
- Restrict or object to processing.
- Data portability — receive your data in a machine-readable format.
- Withdraw consent at any time (where processing is based on consent).
- Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any right, email nextwavehubuk@gmail.com. We respond within 30 days.
8. Security
We use TLS encryption in transit, encryption at rest for the database, hashed passwords, role-based access control, and audit logging. Payment data is handled by Stripe in a PCI-DSS Level 1 certified environment.
9. Cookies
- Strictly necessary: authentication session, CSRF protection (cannot be disabled).
- Functional: language preference (EN / PT).
- We do not use third-party advertising cookies.
10. Children
The service is intended for adults aged 18+. We do not knowingly collect data from children.
11. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects on you.
12. Changes to this notice
We will publish material changes on this page and, where appropriate, notify you by email.
13. Contact
Questions, requests or complaints: nextwavehubuk@gmail.com.