Privacy Notice

Who we are

The data controller for nextfusion.org and blog.nextfusion.org is Next Step Fusion S.à r.l., 33 Rue Du Puits Romain, L-8070 Bertrange, Luxembourg (registration B280734). Our affiliates Next Step Fusion Ltd (United Kingdom) and Next Step Fusion Inc. (United States) may handle your enquiry on our behalf where it concerns their region. Details of all three entities are on the corporate information page.

For anything related to your personal data, email [email protected].

What we collect and why

Contact form

When you use the contact form on the homepage we collect your name, email address, an optional subject, and your message. We use them only to read and reply to your enquiry. The legal basis is our legitimate interest in responding to people who contact us (GDPR Article 6(1)(f)), and where your enquiry leads to a contract, the steps needed to enter into it (Article 6(1)(b)).

Your submission is delivered as an email to our team and kept for as long as needed to handle the enquiry and any follow-up. We do not add contact-form senders to any mailing list.

Newsletter

When you subscribe to the Quarterly Briefing we collect your email address. We use it only to send you our newsletter and occasional company emails. The legal basis is your consent (GDPR Article 6(1)(a)), which you give by submitting the form and can withdraw at any time.

We keep your email address until you unsubscribe or ask us to delete it. Every email we send includes an unsubscribe link, and you can also email [email protected]. We never sell your email address or share it with third parties for their own purposes.

Browsing the site

We do not use cookies, analytics scripts, or tracking pixels on this website. Our hosting provider records standard server logs (IP address, requested URL, browser type, timestamp) for security and to keep the site running. These logs are kept for a short period and are not used to identify or profile visitors.

Embedded videos from YouTube on some blog posts are served by Google and are subject to Google's privacy policy once you play them.

Who processes your data

We use a small number of service providers that process data on our instructions:

• Cloudflare, Inc. hosts the website and handles form submissions at its edge network.
• Resend, Inc. delivers contact-form emails to us and stores newsletter subscribers and sends the newsletter.

Both providers are based in the United States and may process data outside the European Economic Area and the United Kingdom. Transfers are covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework and the UK extension to it.

We do not share your personal data with anyone else unless the law requires it.

Your rights

Under the GDPR and UK GDPR you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is inaccurate;
• delete your data;
• restrict or object to how we use it;
• provide your data in a portable format;
• withdraw consent to the newsletter at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email [email protected]. We will respond within one month. You can also lodge a complaint with a supervisory authority, in particular the Luxembourg Commission nationale pour la protection des données (CNPD) or, in the United Kingdom, the Information Commissioner's Office (ICO).

Changes to this notice

We will update this page if our data practices change. The date at the top shows when it was last revised.