Privacy Notice.

Nexovia AI Limited (“Nexovia”, “we”, “our”) is the data controller for the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the UK Data Protection Act 2018 in respect of personal data processed through this corporate website.

We keep collection to what the site actually needs. The following categories apply:

• Contact data. If you email the enquiries address, we receive the content of your message, your email address, and any information you choose to include. We use this to respond and to maintain a record of the exchange.
• Technical data. When you visit the site, our hosting provider automatically records basic request information, including IP address, browser type, pages requested, and timestamps. This is used to operate and secure the site.
• Analytics data. We use Google Analytics to collect aggregate visit information (pages viewed, referrer, approximate country) for the sole purpose of understanding site usage. Google Analytics is configured to avoid processing personal identifiers wherever possible, and runs only after you accept the consent banner described in Section 04.

The site does not accept user accounts, does not process payments, and does not host user-generated content beyond the enquiry channel above.

We process personal data on the following lawful bases:

• Legitimate interests for operating, securing, and understanding use of the site, and for handling enquiries you initiate.
• Consent for any optional analytics or cookies that require consent.
• Legal obligation where we must preserve or disclose data under law.

Where we rely on legitimate interests, we balance them against your rights and reasonable expectations. You have the right to object; see Section 08.

The site uses Google Analytics with a consent banner. Non-essential cookies, including Google Analytics cookies, are only set after you provide consent through the banner. Strictly necessary cookies used for site security and delivery are always active.

You can withdraw or update consent at any time through the site's cookie preferences, and you can also manage cookies through your browser settings.

We do not sell personal data.

We share personal data only with processors that operate the site infrastructure, and only under written contract that requires them to process data on our instructions, protect it, and delete or return it when the contract ends.

The current list of processors:

• Hosting and delivery: Vercel Inc., which serves the site to your browser.
• Analytics: Google Analytics (a service of Google LLC), for aggregate site-usage measurement.
• Email: correspondence sent to enquiries@nexovia.uk, relations@nexovia.uk, or grievance@nexovia.uk is received and stored in the corporate mailbox for those addresses.

We may disclose personal data if required by law, in response to lawful requests from public authorities, or to protect the rights, property, or safety of Nexovia, its users, or others.

Nexovia is registered in the United Kingdom. Some of our processors may be located in, or process data in, the European Economic Area, the United States, or India.

Where personal data is transferred outside the United Kingdom, we rely on:

• the United Kingdom's adequacy regulations for the relevant destination country, where one applies; or
• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures required by law.

Personal data processed through Nexovia's Indian consumer product 4mo, once 4mo is publicly launched, will additionally be handled in accordance with India's Digital Personal Data Protection Act 2023 (the “DPDP Act”). This corporate website does not itself operate 4mo user accounts.

We keep personal data only as long as necessary for the purposes described in this notice.

• Enquiry correspondence: 24 months from the last message, unless a longer period is required for legal, tax, or regulatory reasons.
• Server logs: 30 days, for security and diagnostics.
• Analytics data: 30 days.

Longer retention may apply where required for the establishment, exercise, or defence of legal claims, or for tax or regulatory record-keeping.

If Nexovia processes your personal data, you have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data, subject to legal retention obligations;
• restrict or object to processing;
• request portability of data you have provided to us in a structured, commonly used, machine-readable format;
• withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.

You can exercise any of these rights by writing to grievance@nexovia.uk. We aim to respond within one calendar month. The response period may be extended by up to two further months for complex or numerous requests, as permitted under UK GDPR.

If you are a resident of India and Nexovia processes your personal data (including through the 4mo product once launched), the Digital Personal Data Protection Act 2023 gives you the following rights as a Data Principal:

• Right to access a summary of your personal data and the purposes for which it is processed (Section 11 of the DPDP Act).
• Right to correction, completion, updating, and erasure of your personal data (Section 12 of the DPDP Act), subject to legal retention obligations.
• Right to grievance redressal (Section 13 of the DPDP Act) through a designated Grievance Officer.
• Right to nominate another person to exercise your rights in the event of your death or incapacity (Section 14 of the DPDP Act).

For personal data processed at the corporate-website level, you can exercise these rights by writing to grievance@nexovia.uk. For personal data processed by the 4mo product, please refer to 4mo's own privacy notice, which sets out the operating procedures for these rights and identifies the Grievance Officer for that platform.

If you are not satisfied with our response to a data-protection request or concern, you may lodge a complaint with:

• the Information Commissioner's Office (ICO), the United Kingdom's independent supervisory authority, at ico.org.uk;
• for residents of India whose data has been processed under the DPDP Act, the Data Protection Board of India, once operational.

You do not need to complain to us first, but we appreciate the opportunity to address the issue directly before you escalate.

The Nexovia corporate website is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to us, please contact grievance@nexovia.uk and we will delete the data.

The 4mo consumer product enforces its own age controls (18+), as set out in its own terms of use and privacy notice.

We may update this Privacy Notice from time to time. The version in force is the one published on the site at the time you access it. Material changes will be noted at the top of this page.

Questions about this Privacy Notice, or about the personal data we process, should be directed to enquiries@nexovia.uk (or, for grievance and data-rights requests specifically, grievance@nexovia.uk), or in writing to: