Whatnxt Privacy Policy

Whatnxt (“Whatnxt”, “we”, “us”, “our”) is a brand of Qniverse Limited, a company registered in England and Wales under company number [13801688], with its registered office at 483 Green Lanes, London, N13 4BS. Qniverse Limited is the data controller for the personal data described in this policy. 

Whatnxt is part of the Qniverse family of brands, which also includes Qniversed, Qrius and Qnipay, each built around quality, innovation, and real-world impact. Whatnxt began with a question we could not stop asking: what’s next?  

This policy explains how we collect, use, share and protect personal data, and applies to: 

• Visitors to whatnxt.ai and any other Whatnxt website (“Site”); 

• Individuals who create an account, use, or enquire about Whatnxt products and services (“Services”);  

• Individuals whose data is processed within Services we provide on behalf of our business customers. 

By using our Site and Services, you acknowledge the practices described in this policy. This policy should be read together with our Terms of Service and Cookie Policy.

2.1 As Controller. When you visit our Site, create an account, request a demo or quote, subscribe to our communications, or contact our sales or support teams, we decide how and why your personal data is used, and we act as the data controller. 

2.2 As Processor. Where a business customer uses the Services to handle personal data of its own employees, customers, candidates or contacts, we process that data strictly on the customer’s documented instructions. In that context the customer is the data controller and Whatnxt is the data processor, governed by a data processing agreement. If you are an individual whose data is held in a customer’s account and you have a question about it, please contact that customer directly, as they control that data. 

We do not collect special category data through this website, and we ask you not to send it to us by email. If you need to share something sensitive, ask us for a secure upload link.

3.1 Contact and enquiry data: name, job title, company, email address, phone number, and the content of any enquiry submitted through our forms or by email. 

3.2 Account data: login credentials, profile details, and preferences, where you create an account.  

3.3 Usage and technical data: pages visited, features used, referral source, IP address, device and browser type, operating system, and approximate location, collected through cookies and analytics tools (see our Cookie Policy). 

3.4 Billing data: billing contact name, company details, invoicing history and payment status, where you purchase paid Services. Card details are handled by our payment processors and are not stored by us. 

3.5 Communications and support data: records of your correspondence with us, feedback, and support requests. 

3.6 Marketing preferences: your choices about receiving communications from us. 

We do not intentionally collect special category data (such as health, ethnicity or religious beliefs) and ask that you do not submit it to us unless it is expressly requested. 

4.1 To provide, operate and maintain the Site and Services, and to create and manage your account. 

4.2 To respond to enquiries, provide quotations, and give information about our Services. 

4.3 To manage the contractual relationship with customers, including orders, invoicing, payment collection and support. 

4.4 To send product updates or marketing communications, where you have consented or where permitted by the “soft opt-in” for existing customers under the UK Privacy and Electronic Communications Regulations (PECR). Every marketing email includes an unsubscribe link, and you can opt out at any time using the details in section 15. 

4.5 To understand how the Site and Services are used, and to improve, test and develop them. 

4.6 To keep the Site and Services secure, and to prevent fraud and misuse. 

4.7 To comply with our legal and regulatory obligations, including company and tax law.

Where we act as a processor, your organisation chooses the legal basis and we act only on its documented instructions.

We rely on the following legal bases under the UK GDPR: 

• Performance of a contract: to provide the Services, manage accounts, take orders and invoice. 

• Legitimate interests: to respond to enquiries, provide support, improve our Site and Services, and prevent fraud, balanced against your rights and interests. 

• Consent: for marketing communications and non-essential cookies, where required. You can withdraw consent at any time (see section 13). 

• Legal obligation: for statutory record-keeping and tax compliance. 

We have assessed whether appointing a Data Protection Officer is required under Article 37 UK GDPR, given the scale and nature of our processing, and have determined that a DPO is not currently required. Data protection queries are handled by our data protection lead, contactable via the details in section 15. We keep this assessment under periodic review.

We do not carry out automated decision-making that produces legal effects, or similarly significant effects, on individuals within the meaning of Article 22 UK GDPR. 

To use any of them, email hello@whatnxt.ai with “Data request” in the subject line. We will verify your identity before we act, and we will tell you if we need longer than 30 days and why.

If you are an employee of a Whatnxt customer, send your request to your employer first — they are the controller of your payroll record, and we will support them in answering it.

You can also complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113. We would much rather you came to us first so we can put it right.

We do not sell your personal data. We share it only where needed to deliver our Services, and each recipient is bound by a written agreement requiring them to protect it. Categories of recipient include: 

8.1 Other members of the Qniverse Group, for shared administration, support and infrastructure. 

8.2 Hosting and infrastructure providers (including Microsoft Azure or other cloud providers)  

8.3 Analytics, communications and customer-support tools that help us operate the Site and Services e.g. Google Analytics. 

8.4 Payment processors, who handle payments on our behalf. 

8.5 Professional advisers and authorities, such as lawyers, auditors, insurers, regulators and law enforcement, where required by law or to protect our rights. 

8.6 A buyer or prospective buyer, if we sell or transfer all or part of our business or assets. 

Where we or our suppliers transfer personal data outside the United Kingdom, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or adequacy regulations. You can contact us for further information about the safeguards used for a particular transfer. 

We keep personal data only as long as necessary for the purposes described in this policy: 

• Enquiry and marketing contact data: up to 24 months from your last interaction with us, or until you ask us to delete it sooner, unless a longer period is needed to resolve an ongoing query or dispute. 

• Account data: for as long as your account is active, and 30 days afterwards. 

• Customer, billing and invoicing records: 6 years after the end of the relevant tax year, to meet statutory tax and accounting obligations. 

• Customer Data we process as processor: for the duration of the customer’s engagement and for 30 days afterwards to allow export, unless the customer instructs otherwise or the law requires longer storage. 

We apply encryption in transit and at rest, access controls limiting data access to authorised personnel, and an audit trail of processing activity, consistent with Article 32 UK GDPR. No system can be guaranteed completely secure, and transmission of information over the internet is at your own risk. In the event of a qualifying personal data breach, we will notify affected customers and, where legally required, the Information Commissioner’s Office (ICO), without undue delay. If you have a password to access our Site or Services, you are responsible for keeping it confidential.

If we are the controller of your data, you have the right under the UK GDPR to: 

• request access to your personal data; 

• request correction of inaccurate or incomplete data; 

• request erasure of your data; 

• object to or restrict processing, including for direct marketing; 

• request data portability; and 

• withdraw consent at any time, where processing is based on consent. 

To exercise these rights, contact us using the details in section 15. We do not normally charge a fee, but may charge a reasonable fee or refuse a request that is clearly unfounded, repetitive or excessive. We aim to respond to legitimate requests within one month. 

If we are the processor (i.e. your employer or another business is the controller of the data), please direct your request to them, and we will assist them as needed to fulfil it. 

Our Site uses cookies and similar technologies. Full details, including how to accept, reject or change your preferences, are set out in our Cookie Policy. 

Questions about this policy, or requests relating to your rights, can be sent to hello@whatnxt.ai 

To unsubscribe from marketing communications, use the unsubscribe link in each marketing email, or contact us at the address above. 

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

In addition to updating the “last updated” date, we will take reasonable steps to actively notify customers of any material change to this policy that affects them directly, such as a new category of recipient or a materially different retention period, for example by email or an in-product notice. 

We may update this policy from time to time to reflect changes in our practices or legal requirements. The “last updated” date at the top of this page shows the most recent revision.