Privacy Notice
Draft for approval - 9 October 2026
Who we are: The controller is Wayne Shortland trading as Nexsteps. Contact hello@nexsteps.co.uk. Nexsteps provides practical independent living resources. The mailbox must be verified before launch.
What we collect: Names, email addresses, organisation if supplied, enquiry type, messages and correspondence. For resource access or pilots we may keep professional contact and administrative arrangements. Wix may process technical information such as IP address, browser data, security logs and cookie choices.
Sources: Normally directly from you through enquiries or email; a professional may introduce another contact.
Purposes and proposed lawful bases: Responding to enquiries and managing professional relationships relies on assessed legitimate interests in operating Nexsteps. Necessary processing for an individual contract or requested pre-contract steps may rely on contract; organisation staff contacts are not automatically covered by their employer contract. Specific legal record-keeping duties may rely on legal obligation. Optional marketing and optional cookies need separate lawful arrangements. Sending an enquiry is not consent to a mailing list.
Keep enquiries general: Do not send completed workbooks, medical information, safeguarding records or identifiable details about a young person through this form. Agree an appropriate route first.
Sharing: Authorised people handling enquiries, Wix as website and form provider, the business email provider, and advisers or authorities where justified or legally required. The email provider and actual access arrangements still need confirming.
International processing: Suppliers may process data outside the UK. Actual locations, applicable UK transfer mechanisms and safeguards must be confirmed and added before publication; ask us for information about the safeguards.
Retention proposed for adoption: Routine enquiries not progressing - 12 months after last substantive contact. Pilot contact and administrative correspondence - pilot duration plus 12 months unless a continuing arrangement requires it. Contract, invoice, complaint and legal records need a separately approved schedule. Cookie and log periods depend on verified settings. Document any justified legal hold.
Your rights: Depending on the circumstances, request access, correction, deletion, restriction or portability. You may object to legitimate-interest processing; we assess your circumstances. You can object to direct marketing at any time. Where consent applies you can withdraw it. Contact hello@nexsteps.co.uk; no special form is needed. We check identity proportionately and normally respond without undue delay and within one month, subject to lawful extensions or adjustments.
Young people and providers: Ask for an accessible explanation. Rights belong to the young person; we do not automatically share with parents or providers. Providers normally keep completed workbooks and their own support records under their own privacy notices. This notice does not cover a future Nexsteps case-record service.
Complaints: Contact Wayne through the email above or complain to the ICO at https://ico.org.uk/make-a-complaint. We do not propose solely automated decisions with legal or similarly significant effects for this enquiry service. Review when services or suppliers change.
Owner completion note: Confirm the active mailbox, email provider, transfer details, lawful bases and retention before publication.