This explains what we collect when you hold a NexPoint hub account, why, and your rights over it. We keep it plain.
NexPoint ("we", "us") is the data controller for the information you provide through nexpoint.co.uk and The NexPoint Global Portal. You can reach us at hello@nexpoint.co.uk.
When you create your account we collect:
We use your information to operate your account, match you to relevant opportunities ("briefs"), and make qualified introductions on your behalf. We may email you when a new brief matches your profile, or to follow up where there is an obvious fit. Our lawful bases are performing the service you signed up for and our legitimate interest in running the Global Portal; for optional marketing, your consent, which you can withdraw at any time. If you send an enquiry from the homepage, we use it to reply and to arrange the call you asked for; our lawful basis is our legitimate interest in answering enquiries.
We use a small number of trusted providers to run the service: Supabase (secure account storage, hosted in the UK), Pipedrive (our customer relationship system), Resend (email delivery) and Web3Forms (which receives a second copy of enquiries sent from the homepage form). They process data only on our instructions. Cloudflare serves and protects the site, and Lead Forensics identifies visiting businesses on the homepage only; both are described under Cookies and storage below.
Your identity is never shared with the party behind a brief until you explicitly agree to an introduction. We do not sell your data, and we do not share it for advertising.
We hold your information while your account is open and for a reasonable period afterwards so we can pick up the conversation again. You can ask us to delete it at any time.
Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, or restrict or object to how we use it. To exercise any of these, email hello@nexpoint.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
When you create a Global Portal account we store your name, company, contact details, location and what you told us you're after. It is seen by NexPoint only, never shared without your say-so, and deleted on request: email hello@nexpoint.co.uk.
We send one confirmation email to the address you give us. Until that address is confirmed the account cannot list, search or answer an introduction, which is how we know the address belongs to whoever is using it.
One account holds one site. If you run more than one, each site has its own account and its own listing, so what we hold about one is never mixed with another.
Introductions and monthly declarations leave records: what was asked for, who accepted it and when, the orders declared against an introduction, and the confirmations or disputes raised against those orders. Those records are shared between the two parties to the introduction and NexPoint, and with nobody else. They are never published, and contact details reach the other party only once the introduction has been accepted, never before.
Order emails copied to introductions@nexpoint.co.uk are kept as the evidence of orders that the Host Agreement asks for. We read them for the introduction reference, the order details and the values, and keep them as the record behind an invoice. They are used for nothing else and they are not shared outside NexPoint.
Signing in sets one cookie, np_session, from api.nexpoint.co.uk, for 30 days. It holds your session and nothing else, and it is not readable by scripts on the page.
The hub also uses your browser's own storage in two small ways. The location you enter on a hub form (region, country and town) is kept in session storage so that you are not asked for it twice, and it is cleared when you close the tab. The Opportunities Board may keep a signed-in session in local storage until you sign out.
The map on account creation loads its tiles from OpenStreetMap (tile.openstreetmap.org), which sees your network address like any image on a page. When you press Find on the map or click the map, the town and country you typed, or the point you clicked, is sent to OpenStreetMap's geocoding service (nominatim.openstreetmap.org) to find the place; nothing else about you goes with it, and we keep the answer so the same place is not asked again. Every pin on our maps sits at town level: your street address is never sent to a map or shown to another user.
Cloudflare, which serves the site, may set its own security cookies when it checks that a visitor is not a bot, and it rewrites email addresses on our pages to hide them from address harvesters.
The homepage at nexpoint.co.uk uses Lead Forensics, a visitor-identification service. It records details such as the pages visited, the referring site, the browser and screen size and the network address, to tell us which businesses have visited. It reports the business, not the individual visitor, and it sets no cookie and stores nothing in your browser. Our lawful basis is our legitimate interest in knowing which companies are interested in NexPoint. You can block it with a content blocker, and Lead Forensics sets out its opt-out and your right to object in its privacy policy. It does not run on the hub or on this page.
We do not use advertising cookies.