Privacy Policy

1. Introduction

Nexsy Ltd is committed to protecting your privacy and personal data whilst delivering our innovative AI-powered Learning Management System. This Privacy Policy explains how we collect, use, process, and protect your information when you use our platform and related services, including our AI-driven features that utilise third-party AI model APIs enhanced by our proprietary business rule engines.

Our platform serves educational institutions across higher education, vocational training, and corporate sectors, providing personalised learning experiences through advanced AI technologies. We understand the sensitive nature of educational data and have implemented comprehensive measures to ensure your information remains secure and is used only for legitimate educational purposes.

Contact Information:

Email: hi@nexsy.io
Address: 128 City Road, London, EC1V 2NX, United Kingdom

2. Data Controller

Nexsy Ltd acts as the data controller for personal data processed through our platform, except where we act as a data processor on behalf of educational institutions. When educational institutions use our services, they typically remain the data controller for their students' and staff's personal data, whilst we process this data according to their instructions and our data processing agreements.

3. Information We Collect

3.1 Personal Information

We collect personal information necessary to provide our educational services and personalised learning experiences. This includes your account information, such as name, email address, username, and password, as well as comprehensive profile information, including educational background, employment history, and contact preferences.

Our Individual Learning Plans (ILP) system captures detailed educational data, including course enrolments, grades, assignments, learning progress, assessment responses, rubric evaluations, learning goals, SEND accommodations, and VAK learning style assessments. This comprehensive data collection enables our AI systems to provide personalised recommendations and support.

3.2 Automatically Collected Information

Our platform automatically collects usage data to improve your experience and our services. This includes your interactions with the platform, session duration, feature usage patterns, and learning analytics such as progress tracking, engagement metrics, and completion rates. We also collect technical data, including IP addresses, browser types, device information, and operating system details.

3.3 AI-Generated and Enhanced Data

Our AI systems, which utilise third-party AI model APIs enhanced by our proprietary business rule engines, generate various types of data to support your learning journey. This includes AI-generated lesson plans created through our dynamic lesson planning system, assessment feedback and grading suggestions produced by our AI-based grading engine with prompt-switching capabilities, personalised learning recommendations from our adaptive content recommendation system, and real-time responses from our AI tutoring features.

Our business rule engines analyse your learning patterns and educational context to engineer appropriate prompts for the underlying AI models, ensuring responses are pedagogically sound and contextually relevant to your specific learning needs.

3.4 Third-Party Integration Data

We integrate with various third-party services to enhance your learning experience, including Microsoft Teams and Zoom for virtual meetings and conferences, PayPal and Stripe for payment processing, SCORM Cloud for interactive content delivery, and various authentication and analytics services. When you use these integrations, we may receive information from these services in accordance with their privacy policies and your consent.

4. How We Use Your Information

4.1 Educational Purposes

We process your personal data primarily to deliver comprehensive educational services tailored to your needs. Our AI systems analyse your learning patterns, preferences, and progress to generate personalised lesson plans, provide intelligent tutoring support available 24/7, deliver contextual learning assistance, and create adaptive assessment experiences. The Individual Learning Plans (ILP) system uses your data to track academic progress, manage SEND accommodations, set and monitor learning goals, and coordinate with educators and support services.

4.2 Platform Operations and AI Enhancement

Your data enables us to maintain and improve our platform operations, including creating and managing user accounts, facilitating course enrolment and management, enabling communication between users, and providing technical support. Our AI systems continually learn from aggregated usage patterns to enhance the accuracy and relevance of our prompt engineering and business rule engines, ultimately leading to improved educational outcomes over time.

4.3 Analytics and Improvement

We analyse platform usage patterns to enhance our services, develop and refine our AI algorithms and business rule engines, conduct educational research using anonymised data, and ensure quality assurance and regulatory compliance. This analysis helps us understand how students learn most effectively and how our AI-driven features can be optimised to support diverse learning needs.

5. Legal Basis for Processing

We process personal data based on several legal grounds depending on the context and purpose. For the provision of our educational services, we rely on the performance of our contract with you or your institution. Where we have legitimate interests in improving our platform, conducting educational research, or ensuring security, we balance these interests against your rights and freedoms. In some cases, we seek your explicit consent, particularly for optional features or marketing communications. We also process data where necessary to comply with legal obligations, including educational regulations and data protection requirements.

6. Data Sharing and Disclosure

6.1 Educational Institutions and Stakeholders

We share data with your educational institution as necessary for academic record keeping, progress monitoring, compliance reporting, and quality assurance processes. This may include sharing information with instructors, administrators, internal verifiers, external verifiers, and awarding body representatives, where applicable to your studies or training programme.

6.2 Third-Party Service Providers and AI Partners

We work with carefully selected service providers and technology partners to deliver our services. This includes cloud hosting providers (currently Render, with planned migration to AWS), AI model API providers (such as Anthropic's Claude API and other AI services), third-party integration partners including Microsoft, Zoom, PayPal, Stripe, and SCORM Cloud, technical support and maintenance providers, and analytics and performance monitoring services.

All third-party relationships are governed by strict data processing agreements that ensure your data is protected to the same standards we maintain. Our AI model providers process data solely to provide AI responses and do not retain your data for their own training purposes, except as instructed by us.

6.3 Legal and Regulatory Requirements

We may disclose information when required by law or to comply with legal processes, protect our rights and property, ensure platform security and integrity, protect user safety, or respond to valid requests from regulatory authorities, including Ofsted, awarding bodies, or other educational oversight organisations.

7. Data Security and Infrastructure

We implement comprehensive security measures to protect your personal data throughout its lifecycle. Our platform employs encryption for data both in transit and at rest, with role-based access controls and authentication systems ensuring only authorised personnel can access specific data. We conduct regular security audits and vulnerability testing, provide ongoing data protection training for all personnel, and maintain robust incident response procedures to detect and respond to potential data breaches.

Our hosting infrastructure is currently provided by Render, with a planned migration to Amazon Web Services (AWS) to enhance scalability and security. Both platforms offer enterprise-grade security measures, and we ensure that all data transfers and migrations adhere to the highest security standards. Our AI processing activities are conducted through secure APIs with encrypted communications and no unauthorised data retention by AI service providers.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, and resolve disputes. Student academic records are typically retained for seven years after course completion in accordance with educational regulations. Assessment data and Individual Learning Plan information are retained for a period of three years to support quality assurance and continuity of educational support. System logs and usage analytics are retained for a period of two years for security and platform improvement purposes. Account information is retained until the account is deleted, subject to any overriding legal requirements.

9. Your Rights Under UK Data Protection Law

You have comprehensive rights regarding your personal data under the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. You have the right to access copies of your personal data and receive information about how it is processed. You can request correction of inaccurate or incomplete data, and in certain circumstances, you may request deletion of your data, though this may be subject to educational record-keeping requirements.

You can restrict how we process your data in specific circumstances, request your data in a portable format for transfer to another service, and object to processing based on legitimate interests. Where we rely on your consent, you can withdraw this at any time. To exercise these rights, please contact us at hi@nexsy.io with specific details of your request.

10. Children's Privacy and Educational Context

Our platform is used by educational institutions serving learners of various ages, including those under 18 years old. We recognise the additional protections required for children's data and work closely with institutions to ensure appropriate consent mechanisms are in place. Educational institutions are responsible for obtaining the necessary consents from parents or guardians, as required by law. We implement enhanced security measures for minors' data, limit data collection to educational necessities, and provide additional safeguards in our AI systems to ensure age-appropriate responses and interactions.

11. International Data Transfers

Some of our service providers and AI model APIs may process data outside the UK and European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, including adequacy decisions for countries with equivalent data protection standards, Standard Contractual Clauses approved by the European Commission, or other legally recognised transfer mechanisms. Our primary AI services and core platform infrastructure are designed to minimise international transfers whilst ensuring optimal performance and functionality.

12. AI Processing and Automated Decision Making

Our platform incorporates AI systems that may make automated recommendations regarding learning paths, content personalisation, assessment feedback, and progress tracking. These AI systems utilise third-party APIs enhanced by our proprietary business rule engines to ensure educationally appropriate and contextually relevant responses.

You have the right to understand the logic behind AI recommendations, request human review of automated decisions, challenge AI-generated assessments through appropriate academic channels, and opt out of certain automated processing where possible. Our AI systems are designed to augment human judgment rather than replace it, and human oversight remains integral to all significant educational decisions.

13. Cookies and Tracking Technologies

We use cookies and similar technologies to ensure platform functionality, enhance user experience, and analyse usage patterns. Essential cookies are necessary for platform operation and security, whilst analytics cookies help us understand user behaviour and improve our services. Personalisation cookies enable us to customise your learning experience and remember your preferences. You can manage your cookie preferences through your browser settings; however, disabling essential cookies may affect platform functionality.

14. Changes to This Policy

We reserve the right to update this Privacy Policy to reflect changes in our services, legal requirements, or enhanced security measures. Significant changes will be communicated via email notification or prominent platform announcements. We encourage you to review this policy periodically to stay informed about how we protect your information. Continued use of our platform after changes indicates acceptance of the updated policy.

15. Contact Information and Complaints

For privacy-related questions, concerns, or to exercise your data protection rights, please get in touch with us at hi@nexsy.io. Please include "Privacy Inquiry" in the subject line and provide specific details about your request or concern. We aim to respond to all privacy inquiries within 30 days.

Suppose you believe we have not adequately addressed your privacy concerns. In that case, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. The ICO can be contacted at ico.org.uk or by calling 0303 123 1113.

16. Supervisory Authority

The Information Commissioner's Office (ICO) is the UK's independent authority established to uphold information rights in the public interest, promoting openness by public bodies and protecting data privacy for individuals. You have the right to lodge a complaint with the ICO regarding our processing of your personal data.