Your personal data
Privacy Policy
This policy describes how NextStart Consulting collects, uses, and protects your personal data on the website. www.nextstart.ai, on the resource catalogue app.nextstart.ai and on their subdomains (the "Site"). It is written to be read: specific purposes, quantified durations and the actual list of tools we use.
1. Who is responsible for the processing?
The data controller is NextStartConsulting, a simplified joint-stock company registered with the Paris Trade and Companies Register under number 820 457 562, whose registered office is located at 113, rue Cardinet, 75017 Paris, France.
Contact : hello@nextstart.ai +33 (0)1 89 16 48 05. See also our Legal Notice.
Given the nature and volume of our data processing, we are not required to appoint a Data Protection Officer (DPO). For any questions regarding your data, the address above is your single point of contact.
2. What data do we collect, and for what purpose?
We only collect data necessary for each purpose, listed below. No automated profiling producing legal effects is carried out.
| finality | Data concerned | Legal basis (GDPR) | Shelf life |
|---|---|---|---|
| Responding to your requests (contact and proposal forms, emails sent to hello@nextstart.ai) | Name, surname, email address, message, phone number (if applicable), and the page from which you are writing. Requests received by email are recorded in the same tracking tool as those submitted via forms. | Pre-contractual measures (art. 6.1.b) | 12 months after the last exchange |
| We will send you a kit or a downloadable template (AI kits by profession, sponsor kits, AI charter template, grids) | Your work email address, the requested kit, the date of the request | Execution of your request (art. 6.1.b) | Personal download link valid for 30 days; request kept for 12 months |
| Study a request for customized catalog integration (form from the app.nextstart.ai/premium page) | Name, email, organization, job title, organization size, number of employees involved, AI tools used, preferred hosting, priority roles, message | Pre-contractual measures (art. 6.1.b) | 12 months after the last exchange |
| Reviewing an application for a trainer or consultant (Join us page) | Identity, email, phone number, LinkedIn profile, CV (if you attach it), administrative status, motivations, AI experience, areas and formats of intervention, languages, city or region, availability | Consent (art. 6.1.a), collected in the form | no more than 2 years after the last exchange |
| Reviewing an application to the ambassador network (Become an ambassador page) | Name, email, a presentation of your business, your network, and your motivations | Pre-contractual measures (art. 6.1.b) | no more than 2 years after the last exchange |
| Arrange a meeting (Calendly booking module) | Name, email, chosen time slot, purpose of the appointment | Pre-contractual measures (art. 6.1.b) | 12 months after the last exchange |
| Online diagnostics (AI adoption, agent maturity, Cowork) | Your answers to the questionnaire (anonymous), your email address only if you choose to provide it to receive your results | Consent (art. 6.1.a) | 12 months |
| Conversational assistants (Agent Finder, Cowork Finder and the assistant present on certain pages of the Site) | The content of the messages you enter; a technical log of each exchange (IP address, session ID, model used, processing power) | Consent (art. 6.1.a) | Messages: not stored by NextStart beyond the session (our AI provider may retain them for up to 30 days for abuse detection); technical log: 12 months |
| Measure the audience and improve the site | Page views, visit source, device, aggregate statistics | Consent (art. 6.1.a) | Cookies: maximum 13 months |
| Measuring our advertising campaigns (Google Ads, Microsoft Advertising) | Conversion events related to your visit | Consent (art. 6.1.a) | Cookies: maximum 13 months |
| Protect the site and forms (filtering malicious traffic, spam detection, rejecting non-professional addresses in kit forms) | IP address, country of origin, browser, content of submitted form fields | Legitimate interest (art. 6.1.f): site security and quality of requests received | Analysis time; security logs: 12 months maximum |
Conversational assistants (Agent Finder, Cowork Finder and Site Assistant): In accordance with Article 50 of the European regulation on artificial intelligence (AI Act), you are informed at the start of the conversation that you are interacting with an artificial intelligence system and not a human. The messages you enter are transmitted to our AI model provider to generate responses; they are not used to train its models. These responses are provided for informational purposes only and do not constitute contractual advice. Do not enter any personal or confidential data in these windows: they are designed to answer general questions about our offerings and guide you in the implementation of AI agents and... Cowork.
Downloadable kits and models: The kit will be sent to you by email as a personal link valid for 30 days; it cannot be downloaded directly from the page. The kits are reserved for professionals: general public, disposable, or educational email addresses are not accepted. Your email address is used to send you the kit: we do not subscribe you to any newsletters or send you unsolicited emails. If you reply to the initial email, the subsequent exchange is solely for the purpose of "Responding to your requests."
Catalog app.nextstart.ai: The catalogue can be consulted freely, without an account or login. The only personal data it collects is that from the custom request form and, if you agree, the audience measurement data described below.
4. Who has access to your data? Our subcontractors
Your data is never sold. It is accessible to our team and, solely for the purposes described above, to the following technical service providers:
| Recipient | Role | Localisation |
|---|---|---|
| OVH | Hosting of the website www.nextstart.ai and the database of received requests | France (EU) |
| Cloudflare | Site broadcast network, security filtering, and DNS | EU / United States |
| Google (Analytics 4, Tag Manager, Ads) | Audience measurement and advertising | EU / United States |
| ecosystem (advertising) | Advertising measure | EU / United States |
| cookie yes | Cookie consent management | United Kingdom |
| Calendly | Online appointment booking | USA |
Each service provider only has access to the data necessary for its service, within the framework of a contract compliant with Article 28 of the GDPR.
5. Transfers outside the European Union
Some of the service providers listed above (Google, Microsoft, Calendly, Cloudflare) may process data outside the European Union, primarily in the United States. These transfers are governed by safeguards recognized by European regulations: certification at EU-US Data Privacy Framework when the service provider adheres to it, or the standard contractual clauses approved by the European Commission.
6. How do we protect your data?
The Site is entirely served via HTTPS (TLS encryption); www.nextstart.ai is hosted in the European Union and protected by an application firewall. Kits are only opened via a signed personal link, sent to the email address that requested them. Access to data received through forms is limited to those who need it to respond to you. We apply security updates to our platform and limit data collection to what is strictly necessary.
7. Your rights and how to exercise them
In accordance with the GDPR and the French Data Protection Act, you have the following rights:
To find out if we process data about you and to obtain a copy of it.
To correct inaccurate or incomplete data.
Have your data deleted, under the conditions provided by law.
You have the right to object to processing based on our legitimate interest.
Temporarily freeze the use of your data.
Receive your data in a structured and machine-readable format.
Withdrawing consent at any time, without retroactive effect.
Define the fate of your data after your death.
To exercise your rights
Write to us at hello@nextstart.ai or by mail: NextStart Consulting, 113 rue Cardinet, 75017 Paris. We will respond within 1 monthsIf we have reasonable doubt about your identity, we may ask you for proof of identity, solely to protect your data.
If you believe, after contacting us, that your rights have not been respected, you can submit a complaint to the CNIL : www.cnil.fr (3, place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).
8. Update of this policy
We update this policy when our practices or regulations change. The date and version number at the top of the page are authoritative. In the event of a substantial change (new purpose, new recipient), information will be posted on the Site.