Nixana

Privacy Policy

Last updated: 9 October 2026

1. Introduction

1.1 This Privacy Policy explains how Nixana collects, uses, shares and protects personal information when you visit nixana.com (the "Website"), book a consultation, or contact us.

1.2 Nixana is headquartered in Dubai, United Arab Emirates, and operates the Website from there. Our delivery centre is in Colombo, Sri Lanka. Nixana is the data controller for the personal information described in this policy.

1.3 References to "Nixana", "we", "us" or "our" mean Nixana, including its delivery team in Sri Lanka where it handles your information for the purposes in section 3.

1.4 We aim to handle personal information in line with the laws that apply to us and to the people we deal with, including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Sri Lanka’s Personal Data Protection Act No. 9 of 2022, the Australian Privacy Act 1988 and Australian Privacy Principles, and applicable US state privacy laws.

2. Information we collect

2.1 When you book a consultation, we collect your name, email address, phone number (with country code), the reason for the meeting if you choose to give one, your selected date and time, and your time zone. Consultations are held by phone, so we use your number to call you at the time you booked.

2.2 When you contact us by email or LinkedIn, we collect the information you choose to share, such as your name, company, job title and the content of your message.

2.3 When you browse the Website, our hosting provider and the Website automatically record technical information such as your IP address, browser type, device type, pages viewed and the date and time of your visit. This is used for security and to keep the Website running.

2.4 We do not ask for sensitive personal information (for example health, racial, religious or political data) through the Website. Please do not include it in the meeting notes field.

2.5 Where we process personal data contained in a client’s systems while delivering services, that processing is governed by our agreement with the client, not by this policy (see section 5).

3. How we use your information

3.1 We use the information described above to:

• schedule, confirm, reschedule and hold the consultation you booked, including sending confirmation and reminder emails;
• respond to enquiries and follow up on a conversation you started with us;
• assess whether and how we can help your organisation, and prepare proposals where you ask us to;
• keep the Website secure, prevent misuse and fix technical problems; and
• meet our legal, regulatory and accounting obligations.

3.2 We will only send you marketing updates where you have agreed to receive them or where the law otherwise allows it. You can opt out at any time using the link in any email or by contacting us.

3.3 We do not use your personal information for automated decision-making that has legal or similarly significant effects on you.

4. Legal bases for processing (UK and EU visitors)

4.1 Where UK GDPR or EU GDPR applies, we rely on: (a) taking steps at your request before entering into a contract, when you book a consultation; (b) our legitimate interests in responding to business enquiries, developing client relationships and keeping the Website secure, balanced against your rights; (c) your consent, for optional marketing and any non-essential cookies; and (d) compliance with legal obligations.

5. Client data processed in service delivery

5.1 When we rebuild or operate back-office processes for a client, we may process personal data held in the client’s systems. In those cases the client is the data controller and Nixana acts as its data processor, processing data only on the client’s documented instructions under a data processing agreement.

6. Who we share information with

6.1 We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

6.2 We share information only with service providers that help us run the Website and our business, under contracts that require them to protect it. These currently include:

• our website hosting provider, which hosts the Website and its database;
• FluentBooking, the scheduling plugin used for consultations, which stores booking data in our own Website database;
• our email and calendar provider, used to manage consultations and send booking confirmations, reminders and meeting invitations; and
• Gravatar, operated by Automattic, which displays the profile image next to the booking form. Your browser connects to Gravatar directly to load that image, which shares your IP address with it.

6.3 We may share information within Nixana, including with our delivery team in Sri Lanka, where needed to deliver the purposes in section 3, and with professional advisers, auditors and insurers under duties of confidentiality.

6.4 We may disclose information where required by law, court order or a regulator with jurisdiction over us, or to protect our rights, property or safety, or those of others.

6.5 If Nixana is involved in a merger, acquisition or sale of assets, personal information may be transferred to the new owner, who will be bound by this policy or an equivalent one.

7. International transfers

7.1 Nixana operates in the United Arab Emirates and Sri Lanka and serves clients in the United Kingdom, United States, United Arab Emirates and Australia, so your information may be transferred to and processed in countries other than your own.

7.2 Where we transfer personal data from the UK or EEA to a country without an adequacy decision, we use the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, as appropriate. For other transfers we use contractual protections consistent with the law of the exporting country.

8. How long we keep information

8.1 We keep booking and enquiry information for 24 months after our last contact with you, unless we enter into a business relationship, in which case we keep it for the duration of that relationship and for 6 years afterwards to meet legal and accounting requirements.

8.2 Technical logs are kept only for as long as needed to keep the Website secure and working, normally no more than 90 days, unless needed to investigate a security incident.

8.3 When information is no longer needed, we delete or anonymise it securely.

9. How we protect information

9.1 We use appropriate technical and organisational measures to protect personal information, including encrypted connections (HTTPS), access controls limited to staff who need the information, and reputable hosting and software providers.

9.2 If a personal data breach occurs that we are legally required to report, we will notify the relevant regulator and affected individuals within the timeframes the law requires.

10. Your rights

10.1 Depending on where you live, you may have the right to: access the personal information we hold about you; correct it; ask us to delete it; restrict or object to how we use it; receive a portable copy; and withdraw consent at any time, without affecting processing that has already taken place.

10.2 UK and EU residents may complain to the Information Commissioner’s Office (UK) or their local supervisory authority. Australian residents may complain to the Office of the Australian Information Commissioner. UAE residents may contact the UAE Data Office. Sri Lankan residents may contact the Data Protection Authority of Sri Lanka.

10.3 California and other US residents may have rights to know, delete and correct personal information, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined in US state privacy laws, and we will not discriminate against you for exercising your rights.

10.4 To exercise any of these rights, contact us using the details in section 14. We may need to verify your identity before responding, and we will reply within the time the applicable law requires.

11. Cookies

11.1 The Website currently uses only cookies and similar technologies that are strictly necessary for it to work, such as those that keep the booking form functioning and protect the Website from abuse. These do not require consent.

11.2 If we add analytics or marketing cookies in future, we will update this section and ask for your consent before those cookies are set.

12. Third-party links

12.1 The Website links to third-party sites such as LinkedIn. Those sites have their own privacy policies, and we are not responsible for how they handle your information.

13. Children

13.1 The Website and our services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal information from children.

14. Contact us

14.1 For privacy questions, requests or complaints, email info@nixana.com with "Privacy" in the subject line.

15. Changes to this policy

15.1 We may update this policy to reflect changes in the law, our practices or the services we offer. The latest version will always be available on this page with its "Last updated" date. Where changes are significant, we will take reasonable steps to let you know, for example by a notice on the Website.