Contents
1. Who we are
NexGen Cloud Limited (trading as “Hyperstack”) (“Hyperstack”, “we”, “us”, “our”) is the controller of your personal data when you use our websites and services. You can contact us at support@hyperstack.cloud or support@nexgencloud.com.
2. Scope
This policy explains how we collect, use, disclose and protect personal data when you visit hyperstack.cloud, nexgencloud.com and related sub‑domains, create an account, use our services, or interact with us. It does not apply to third‑party sites and services that have their own privacy policies. Additional details on marketing attribution data are set out in Schedule I (UTM Data Collection and Marketing Attribution).
3. Personal data we collect
- You provide: identification and contact details (name, email, phone, company, job title), account credentials, correspondence and support requests, preferences, and marketing choices.
- Collected automatically: device identifiers, IP address, browser and OS information, approximate location (derived from IP), pages viewed, links clicked, and similar usage data (via cookies and similar technologies).
- From third parties: payment processors (limited payment details and status), analytics and advertising partners, affiliates, public sources, and (where relevant) public blockchain data such as wallet address and transaction metadata.
We do not intentionally collect special category data. If you choose to provide such data, we will handle it in accordance with applicable law.
4. Purposes and legal bases (UK/EU)
We process personal data for:
- Providing and improving the services; account creation, authentication, provisioning, customer support (GDPR Art. 6(1)(b) – contract; Art. 6(1)(f) – legitimate interests in operating our services)).
- Security, fraud prevention, and abuse detection (Art. 6(1)(f)).
- Service communications (e.g., updates, incidents) (Art. 6(1)(b) or (f)).
- Marketing communications (Art. 6(1)(a) – consent; and, for existing customers, “soft opt‑in” under PECR where lawful). You can opt out at any time.
- Compliance with legal obligations (Art. 6(1)(c)).
5. Cookies and similar technologies
We use strictly necessary cookies and (with your consent) analytics, functional and advertising cookies. Non‑essential cookies are off by default and will only run if you select “Accept” (you can “Reject non‑essential” with equal prominence). You can change your choices at any time via “Cookie Settings”. Where required by law, we honour Global Privacy Control (GPC) and other recognized universal opt‑out signals for sale/sharing or targeted advertising. See our Cookie Policy for details.
6. Advertising, analytics and profiling
Where permitted, we use analytics to understand how our services are used and may show relevant content or ads based on your interactions. You may withdraw consent (EU/UK) or opt out (US) at any time. We do not engage in solely automated decisions that produce legal or similarly significant effects without appropriate safeguards.
7. Disclosures of personal data
We disclose personal data to: group companies; vendors and service providers (e.g., hosting, support, analytics, payment processing); professional advisers; authorities where required by law; and to a successor entity in connection with a merger, acquisition or restructuring. Disclosures specific to marketing attribution and UTM Data are described in Schedule II. We require recipients to protect personal data and use it only for our documented purposes.
8. International data transfers
If we transfer personal data outside the UK/EEA we use lawful mechanisms, including the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum (IDTA) or UK Extension to the EU‑U.S. Data Privacy Framework (the “UK‑U.S. Data Bridge”), as applicable. For key U.S. service providers used for analytics/marketing—Google, HubSpot, and Salesforce—see their DPF listings linked in Schedule II §6.1. Where DPF does not apply, we rely on SCCs/IDTA and conduct transfer risk assessments. UK guidance on the Data Bridge: https://www.gov.uk/government/publications/uk-us-data-bridge-data-privacy-framework-principles-and-list.
9. Data retention
We retain personal data only as long as necessary for the purposes described above, including to meet legal, accounting or reporting requirements. Typical retention periods include: account and billing data – duration of the contract plus up to seven years; support records – up to three years; marketing preferences – until you withdraw consent or opt out. We will anonymise or delete data when no longer needed.
10. Security
We implement technical and organisational measures appropriate to the risk, including access controls, encryption in transit, secure development practices, vulnerability management and staff training. Despite our efforts, no system is perfectly secure.
11. Your rights (UK/EU)
You have rights to access, rectify, erase, restrict or object to processing, and data portability. Where processing is based on consent, you may withdraw it at any time. You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk).
12. U.S. state privacy rights
Residents of certain U.S. states (e.g., California, Colorado, Connecticut, Virginia and others) may have rights to: know/access, correct, delete, data portability, opt out of sale or sharing of personal information and of targeted advertising, and limit the use and disclosure of sensitive personal information. We do not sell personal information for money, but we may “share” identifiers and internet/usage data with advertising partners; you can opt out via the “Do Not Sell or Share My Personal Information” link and by enabling Global Privacy Control (GPC). We will not discriminate against you for exercising these rights.
California notice at collection: we collect the categories described above for the purposes in Sections 4–7, retain them as described in Section 9, and disclose them to the categories of recipients described in Section 7. We collect personal information directly from you, automatically via your device, from affiliates, service providers and public sources. See “How to exercise your rights” below.
Appeals: If we decline your request, you may appeal our decision by replying to our response. If you remain unsatisfied, you may contact your state Attorney General (where applicable).
13. How to exercise your rights
UK/EU: email support@hyperstack.cloud. US: use the regional links in our footer or email the same address. We will verify your identity and respond within the statutory period. If we decline a request, you may appeal by replying to our decision; Colorado, Connecticut and Virginia residents may lodge an appeal with us and, if still unsatisfied, contact their Attorney General.
14. Children
Our services are not intended for children under 18 (or the minimum age required by law in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us and we will take appropriate steps.
15. Changes
We may update this policy from time to time. If changes are material, we will notify you through the services or by other reasonable means. The “Last Updated” date will always tell you when this policy was last revised.
16. Contact
Questions, requests or complaints: support@hyperstack.cloud or support@nexgencloud.com.
Schedule I - UTM Data Collection and Marketing Attribution
1. Scope
1.1 This Schedule applies to our use of UTM parameters and related marketing attribution data collected when you visit our websites, landing pages or otherwise access our services.
1.2 “UTM Data” means campaign parameters appended to URLs (including utm_source, utm_medium, utm_campaign, utm_content, utm_term) and any associated analytics derived from such parameters.
2. Categories of UTM Data
2.1 We collect the following information when you access our websites via links containing UTM parameters:
(a) the campaign source, medium, and other tags contained in the URL;
(b) the page you visited and the time of visit; and
(c) any associated device information, IP address, or cookie identifiers (where applicable).
2.2 UTM Data does not, by itself, identify you. However, when combined with other identifiers (such as cookies, account details, or IP addresses), it may constitute personal data under the UK GDPR and EU GDPR.
3. Purposes of Processing
3.1 We use UTM Data for the following purposes:
(a) to measure the effectiveness of marketing campaigns and communications;
(b) to understand user engagement and improve our services;
(c) to generate aggregated, anonymised insights.
4. Lawful Basis
4.1 Where UTM Data is processed in isolation, we rely on our legitimate interests (Article 6(1)(f) UK GDPR/EU GDPR) in understanding and improving our marketing performance.
4.2 Where UTM Data is combined with cookies, pixels, or tracking technologies that require consent under the Privacy and Electronic Communications Regulations 2003 (PECR) or the ePrivacy Directive, we rely on your consent (Article 6(1)(a)).
5. Retention
5.1 We retain UTM Data for no longer than is necessary for the purposes described above.
5.2 Unless otherwise specified in our Privacy Policy, UTM Data linked to cookies or analytics tools will be retained for 12 months before deletion or anonymisation.
6. Sharing and Transfers
6.1 We may share UTM Data with our group companies and third-party service providers that supply analytics and marketing tools, including:
- Google Analytics (Privacy Policy: https://policies.google.com/privacy ; DPF: https://www.dataprivacyframework.gov/participant/5780)
- HubSpot (Privacy Policy: https://legal.hubspot.com/privacy-policy ; DPF: https://www.dataprivacyframework.gov/participant/5812)
- Salesforce Marketing Cloud (Privacy Policy: https://www.salesforce.com/company/legal/privacy/ ; DPF: https://www.dataprivacyframework.gov/participant/5959)
6.2 All transfers are subject to appropriate contractual safeguards, including the UK International Data Transfer Addendum or EU Standard Contractual Clauses, as applicable. Where the provider is certified under the EU‑U.S. Data Privacy Framework and, if relevant, the UK‑U.S. Data Bridge, we may rely on those mechanisms. See UK guidance: https://www.gov.uk/government/publications/uk-us-data-bridge-data-privacy-framework-principles-and-list.
7. Your Rights
7.1 You have the right to:
(a) request access, rectification, or erasure of UTM Data;
(b) object to processing based on our legitimate interests;
(c) withdraw consent where processing is based on consent; and
(d) lodge a complaint with the UK ICO or your local supervisory authority.
