01Introduction & Controller Details
ZamNexus Limited is a company incorporated under the laws of England and Wales, with its registered address at 34 Beaconsfield, Luton, Bedfordshire, LU2 0RW, United Kingdom.
This Privacy Policy applies to personal data collected through our corporate website (zamnexus.com), client portals, communication channels, and our proprietary software suite (including ZNXERP, ZNXePOS, ZNXEdu, and ZNXCare), as well as related cloud architecture, consulting, and integration engagements.
When you engage with us directly, ZamNexus Limited acts as the Data Controller for your personal data. Where we host or process data on behalf of our enterprise clients through our multi-tenant SaaS products, we act as a Data Processor in accordance with the applicable Data Processing Agreement (DPA) executed with the client.
02Personal Data We Collect
We only collect personal information that is adequate, relevant, and strictly necessary to fulfill our legitimate operational, contractual, and legal purposes. This data falls into the following categories:
- Identity & Professional Contact Data: Full name, business email address, corporate telephone number, job title, department, employer organization name, and official correspondence records.
- Technical & Telemetry Data: IP address, browser type and version, operating system, device hardware identifiers, access timestamps, referral source, session duration, and system diagnostic telemetry.
- Commercial & Engagement Records: Inquiries submitted via contact forms, consultation requests, scope-of-work specifications, customer relationship history, and transaction metadata (excluding raw payment card numbers).
- Client-Managed Application Data: Where our enterprise software is deployed (e.g. clinic records in ZNXCare or campus files in ZNXEdu), data is stored in encrypted customer database partitions subject to strict enterprise tenant isolation.
03Lawful Bases for Processing
Under Article 6 of the UK GDPR, we process your personal data only when an explicit legal basis applies:
Processing necessary to evaluate project briefs, deliver contracted software licenses, provision cloud instances, execute service-level agreements, and issue billing invoices.
Processing necessary to maintain network security, protect systems against unauthorized intrusions, improve platform reliability, resolve operational bugs, and conduct business-to-business communications.
Processing required to comply with statutory legal mandates, financial audit reporting, corporate tax accounting (HM Revenue & Customs), and regulatory anti-fraud statutes.
Where you have provided voluntary, affirmative consent — such as subscribing to technical architecture briefings or permitting optional analytical cookies. Consent can be revoked at any time.
04How We Use Personal Data
We use the personal information collected for specific, legitimate business purposes:
- Providing, maintaining, and supporting our enterprise products and technical consulting engagements.
- Responding to inquiries, advisory requests, and technical support requests submitted via email or contact forms.
- Monitoring system health, uptime, and load balancing across multi-tenant cloud application environments.
- Preventing malicious attacks, unauthorized access, identity impersonation, and fraudulent activities.
- Fulfilling corporate record-keeping, statutory audits, and legal dispute defense obligations.
We do not sell, rent, or trade your personal data to third parties or marketing brokers for advertising purposes.
06International Data Transfers
Our primary servers and operations are located in the United Kingdom and the European Economic Area (EEA). Where personal data is transferred across international borders outside the UK or EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V of the UK GDPR.
These safeguards include transferring data to countries recognized by the UK Government as providing an adequate level of protection, or executing the UK International Data Transfer Agreement (IDTA) or the European Commission's Standard Contractual Clauses (SCCs) supplemented by mandatory technical transfer impact assessments.
07Data Retention & Disposal
We retain personal data only for as long as necessary to achieve the specific purposes for which it was collected, satisfy contractual requirements, or comply with statutory retention mandates.
- Client Account & Contract Data: Retained for the duration of the active agreement plus six (6) years following contract termination to comply with statutory limitation periods under the Limitation Act 1980.
- Financial & Invoicing Records: Retained for seven (7) years in accordance with UK Companies Act and HM Revenue & Customs (HMRC) accounting standards.
- General Inquiries: Retained for twelve (12) months following resolution unless superseded by an active business relationship.
- Security & Web Access Logs: Retained for ninety (90) days to six (6) months for threat detection and audit investigations, after which they are automatically purged.
08Security & Cryptographic Safeguards
We implement comprehensive technical and organizational security controls designed to prevent accidental loss, unauthorized access, alteration, or unlawful destruction of your data:
All external and internal microservices traffic is protected using TLS 1.3 protocol suites.
Database storage volumes, backups, and object stores are encrypted with AES-256 keys.
Least-privilege access model enforced via multi-factor authentication (MFA) and zero-trust credentials.
Cryptographically verifiable, tamper-evident audit logs monitoring all administrative actions.
09Your Rights Under UK & EU GDPR
Under the UK Data Protection Act 2018 and the UK GDPR, you possess specific legal rights regarding your personal data:
- Right of Access: You may request confirmation of whether we process your data and obtain a copy via a Subject Access Request (SAR).
- Right to Rectification: You may require us to correct inaccurate or incomplete personal records.
- Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where there is no overriding legal reason for retention.
- Right to Restriction of Processing: You may request that we suspend active processing under certain conditions (e.g. while data accuracy is verified).
- Right to Data Portability: You may request that we transmit your personal data to you or another provider in a structured, machine-readable format.
- Right to Object: You may object at any time to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting past processing lawfulness.
To exercise any of these rights, submit your request to contact@zamnexus.com. We respond to all verified statutory requests within one (1) calendar month free of charge.
11Children's Privacy
Our services, products, and website are directed exclusively to business enterprises and professionals aged 18 and older. We do not knowingly collect or solicit personal data from children. If you believe that a minor has provided us with personal information, please contact us immediately at contact@zamnexus.com so we can investigate and promptly delete the records.
13Contact & Privacy Inquiries
For any questions regarding this Privacy Policy, to exercise your GDPR rights, or to speak with our Data Protection team, contact: