Privacy Policy

InoNexa is generally the data controller for personal data we process in connection with our website, business administration, communications and professional activities.

Controller: InoNexa Location: The Netherlands Privacy contact: info@inonexa.com

Depending on the nature of a particular consulting engagement, InoNexa may also process personal data on behalf of a client as a data processor. Where this applies, the client's instructions and the applicable data processing agreement govern that processing.

We primarily collect and process personal data in a professional and business-to-business (B2B) context. Depending on how you interact with us, the personal data we may process includes:

Contact information: Such as your name, professional email address, telephone number and job title, when you contact us, use a contact form, communicate with us by email, or interact with us in the course of a professional engagement.

Professional and organisational information: Such as your organisation, role, sector and information about professional needs, challenges or interests relevant to our discussions, project scoping and advisory services.

Engagement and project information: Information provided or generated in connection with a consulting engagement, such as project requirements, professional communications, deliverables and other information necessary to provide our services.

Technical and website information: Information that may be collected when you visit our website, such as IP address, browser and device information, pages visited and other technical information necessary to operate, secure and improve the website. The extent of this information depends on the technologies and services enabled on the website.

We seek to collect and process only personal data that is relevant and necessary for the purposes described in this Privacy Policy.

We may process personal data for the following purposes:

Providing our services: To deliver consulting, strategic intelligence, reports, advisory services and other services you or your organisation have requested.

Communicating with you: To respond to inquiries, arrange meetings, manage project communications and provide relevant professional information.

Managing professional engagements: To scope, administer and deliver consulting projects and maintain appropriate project and business records.

Business administration: To manage contracts, invoicing, accounting, tax and other administrative and legal obligations.

Website operation and improvement: To operate, maintain, secure and, where applicable, analyse and improve our website and its functionality.

We do not use personal data for purposes that are incompatible with the purposes described in this Privacy Policy unless permitted or required by applicable law.

We process personal data only where we have a lawful basis under the GDPR. Depending on the circumstances, this may include:

Performance of a contract: Where processing is necessary to enter into or perform a consulting agreement or other contract with you or your organisation.

Steps prior to entering into a contract: Where processing is necessary to respond to an inquiry or take requested steps before entering into a contract.

Legal obligation: Where processing is necessary to comply with applicable legal, accounting or tax obligations.

Legitimate interests: Where processing is necessary for legitimate business interests, such as communicating with professional contacts, managing our business and maintaining appropriate business records, provided that these interests are not overridden by your rights and interests.

Consent: Where we ask for your consent for a specific processing activity, such as certain optional cookies or communications, and consent is the applicable legal basis.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Retention depends on the type of personal data and the purpose for which it is processed. In particular:

Contact and inquiry information: We retain this for as long as necessary to respond to your request, manage the resulting relationship or engagement, and maintain appropriate business records.

Professional and organisational information: We retain this for as long as reasonably necessary for the relevant professional relationship, engagement or legitimate business purpose.

Engagement and project information: We generally retain this for the duration of the relevant engagement and afterwards only for as long as necessary for legitimate business purposes or to meet applicable legal, accounting, tax or contractual obligations.

Financial, accounting and tax records: Where applicable, relevant records are retained for the period required by Dutch law. For certain business and tax records, this may be seven years.

Technical and website information: Retention depends on the particular technology and purpose for which the information is collected and is limited to the period reasonably necessary for that purpose or as otherwise required by law.

When personal data is no longer required, we will delete it or otherwise securely dispose of it, subject to applicable legal obligations and legitimate business requirements.

Depending on the circumstances and applicable legal requirements, you have rights under the GDPR including:

Right of access: You can request access to the personal data we hold about you. Right to rectification: You can request that inaccurate or incomplete personal data be corrected. Right to erasure: You can request that your personal data be deleted in certain circumstances. Right to restriction of processing: You can ask us to restrict the processing of your personal data in certain circumstances. Right to object: You can object to certain processing, including processing based on legitimate interests and, where applicable, direct marketing. Right to data portability: In certain circumstances, you can request to receive personal data you have provided to us in a structured, commonly used and machine-readable format. Right to withdraw consent: Where processing is based on your consent, you can withdraw that consent at any time.

These rights are subject to the conditions and exceptions provided by applicable data protection law.

To exercise your rights, please contact us at info@inonexa.com. We may need to verify your identity before processing your request.

We will respond without undue delay and, in any event, within one month of receiving your request, subject to the conditions and possible extensions provided by applicable data protection law.

We do not sell your personal data.

We may share personal data with service providers and other third parties where this is necessary to operate our business, provide our services, operate our website, comply with legal obligations or otherwise fulfil the purposes described in this Privacy Policy.

Such service providers may include providers of email, cloud infrastructure, website hosting or website-building services and other technology or professional services providers. Where appropriate, we require service providers that process personal data on our behalf to provide appropriate confidentiality and data protection safeguards.

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, misuse, alteration, disclosure or other unlawful processing.

However, no method of transmitting or storing information can be guaranteed to be completely secure.

Some of the service providers we use may process personal data outside the European Economic Area (EEA).

For example, we use Google Workspace for business email, document management and related infrastructure services. Depending on the service and applicable configuration, personal data may be processed outside the EEA.

Where personal data is transferred outside the EEA, we rely on an appropriate transfer mechanism permitted under applicable data protection law. Depending on the circumstances, this may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses approved by the European Commission, or another legally recognised transfer mechanism, together with any additional safeguards required by applicable law.

We do not transfer personal data to a third country without an appropriate legal basis and safeguards where these are required under the GDPR.

Our website may use cookies and similar technologies that are necessary for the website to function, as well as, where applicable, technologies used to understand website usage and improve website performance.

The specific cookies and technologies used may depend on the services and features enabled on the website.

Where consent is required for optional cookies or similar technologies, we will request consent before using them and provide an appropriate way to manage or withdraw your preferences.

You can also manage certain cookie settings through your browser. Please note that disabling necessary cookies may affect the functionality of the website.

If you have concerns about how we process your personal data, we encourage you to contact us first at info@inonexa.com so that we can try to address your concern.

You also have the right to lodge a complaint with the supervisory authority responsible for data protection in the Netherlands:

Autoriteit Persoonsgegevens (Dutch Data Protection Authority)

You can find information about submitting a complaint through the Autoriteit Persoonsgegevens website.

We may update this Privacy Policy from time to time to reflect changes in our activities, services, technology or applicable legal requirements.

The latest version will be published on this website and will indicate the date on which it was last updated.

Last updated: 27 August 2026