compliance
Compliance & trust
Intelligence work is only useful when it can withstand scrutiny. Next Sight designs its work to meet the GDPR and keeps a documented chain of custody: engagements are scoped to a defined legal basis, and our procedures record provenance, time, source and handler for the material we collect. This page describes how we approach regulation and how next-sight.com handles personal data; the Nexus platform has its own privacy policy and terms.
Last reviewed:
Operating principles
Principles for every engagement.
- Lawful use
- Engagements are scoped against the lawful authority and policies of the requesting organisation before collection begins, and authority, purpose and limits are documented. The client remains responsible for the lawfulness of its request and for how it uses our findings.
- GDPR-aware
- Data minimisation, purpose limitation and retention limits are built into our workflows and tooling. We process personal data only where a lawful basis applies and the purpose is documented.
- Chain of custody
- Our procedures record provenance, time, source and handler for collected material across collection, analysis and reporting, so findings can be reviewed by internal teams, regulators and courts. Whether evidence is admitted is for the court to decide.
- Secure by design
- We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including encryption in transit and at rest, least-privilege access and audit logging.
Regulatory posture
Frameworks we operate under.
We do not claim certifications we do not hold. The statements below describe how Next Sight approaches the regulations and standards that matter to our clients. They are general information, not a contractual commitment: the terms agreed for each engagement or subscription govern.
GDPR — Regulation (EU) 2016/679
Next Sight d.o.o. is established in Slovenia and subject to the GDPR and Slovenia's Personal Data Protection Act (ZVOP-2). It is the controller for personal data processed through next-sight.com. We document the lawful basis for our processing, answer data-subject requests, and rely on the safeguards of Chapter V GDPR, such as Standard Contractual Clauses, when personal data leaves the EEA.
EU AI Act — Regulation (EU) 2024/1689
We assess our AI features against the Act's risk categories and do not use AI for practices the Act prohibits. In Nexus, AI output is presented as such, stays linked to its sources and is reviewed by the investigator, who decides what the evidence supports.
NIS2 — Directive (EU) 2022/2555
We use NIS2's risk-management measures (risk analysis, supply-chain security, incident handling) as a reference for our own security practice, and can support clients in regulated sectors with information for their supplier assessments.
ePrivacy & Slovenian ZEKom-2
Cookies and similar technologies are governed by the EU ePrivacy Directive and Slovenia's Electronic Communications Act (ZEKom-2). next-sight.com asks every visitor for consent before any non-essential cookie or analytics tag is used, and the choice can be changed at any time under Cookie settings.
Convention 108+ & cross-border work
For cross-border engagements we apply the principles of the Council of Europe's modernised Convention 108+ alongside the GDPR, so the same standard applies where local law is less demanding.
Professional & operational standards
Our investigative work follows the code of conduct of the Council of International Investigators and the academic and ethical standards of the Institute for Security and Strategic Research (IVSR), a related party: our CEO is its director and our CMO chairs its Professional Council.
Website privacy
How next-sight.com handles your data.
This notice covers next-sight.com only; the controller is Next Sight d.o.o. (details below). The Nexus platform is covered by its own privacy policy. We do not sell personal data, use it for advertising, or use it for automated decisions that affect you.
Visiting the site
When you visit next-sight.com, our hosting and content-delivery provider processes technical data such as your IP address, browser type and the referring page to deliver the site and protect it against abuse. Lawful basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). This data is kept only as long as needed for that purpose. The site is intended for professional audiences, not children.
Google Analytics 4 — only with your consent
If you accept analytics, we load Google Analytics 4 to measure how the site is used, such as the pages you view, the links and buttons you click, and device, browser and approximate location information, with advertising features and Google signals off. Nothing is sent to Google before you accept. Lawful basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time under Cookie settings, which switches the tag off and deletes its cookies; withdrawal does not affect processing before it. Google acts as our processor, and user-level analytics data is kept for no longer than 14 months.
Contact form (HubSpot and Google reCAPTCHA)
The contact page loads a form provided by HubSpot, our customer-relationship provider, which processes the details you submit (such as name, email, organisation and message) on our behalf. The form is protected by Google reCAPTCHA, which HubSpot loads together with the form; both load as soon as the contact page opens, before any cookie choice, and HubSpot and Google act as our processors for the form. We use your details only to answer your enquiry and manage any resulting business relationship. Lawful basis: steps you ask us to take before a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering business enquiries (Art. 6(1)(f)). We keep enquiries as long as needed for that purpose and afterwards only where the law requires. HubSpot and Google reCAPTCHA may set their own cookies inside the form to deliver and protect it, as described in their cookie policies; next-sight.com does not add HubSpot's marketing tracking code.
Recipients and transfers
We share personal data only with the providers named on this page (hosting and content delivery, Google and HubSpot) and with authorities where the law requires it. Some providers process data outside the EEA, including in the United States; those transfers rely on the safeguards of Chapter V GDPR, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
Products we no longer offer
Where Next Sight still holds personal data collected through a product or service it no longer offers, that data is kept only as long as the terms under which it was collected, or the law, require; it is not used for new purposes and remains subject to the rights set out below.
Changes to this notice
We update this notice when our practices change. The “Last reviewed” date at the top of the page shows the current version.
| Cookie | Purpose | Type | Retention |
|---|---|---|---|
| ns_consent_v1 | Remembers your analytics choice so the banner does not ask again and your choice is applied. | Strictly necessary (first-party browser storage) | Until you change your choice or clear your browser storage |
| _ga, _ga_* | Google Analytics 4: tells visits and sessions apart to measure site usage. Set only after you accept analytics and deleted if you withdraw consent. | Analytics (first-party; Google as processor) | 13 months |
| HubSpot form and Google reCAPTCHA cookies | May be set by HubSpot, and by the Google reCAPTCHA it loads, inside the contact form to deliver the form and protect it against abuse. | Third-party (HubSpot, Google) | As set out in HubSpot's and Google's cookie policies |
Product policies
Nexus has its own policies.
Nexus documents how it handles account data, subscription data, investigation and workflow content, audit logs and sub-processors. Those policies, not this page, govern use of the platform.
Nexus
Agentic OSINT platform for investigators.
Your rights
Data-subject rights under GDPR.
Access
Confirm whether we process your personal data and receive a copy.
Rectification
Have inaccurate or incomplete personal data corrected.
Erasure
Ask us to delete your personal data where the GDPR allows it.
Restriction
Limit how we process your data in the cases the GDPR sets out.
Portability
Receive data you gave us in a machine-readable format, where processing relies on consent or a contract.
Objection
Object to processing based on our legitimate interests.
Withdraw consent
Withdraw analytics consent at any time under Cookie settings, without affecting earlier processing.
Complaint
Complain to the Information Commissioner of the Republic of Slovenia (ip-rs.si) or your own EU supervisory authority.
To exercise these rights, email info@next-sight.com or use our contact form, and tell us it is a data protection request. We may need to confirm your identity. We answer within one month; for complex requests we may extend this by up to two further months and will tell you why (Art. 12(3) GDPR).
Engagement discipline
How we run a job.
Authority and scope are agreed in writing before collection starts, and the client remains responsible for the lawful basis of its request and for how it uses our findings. Our procedures record sources, methods and handlers for collected material, with timestamps and provenance, so findings can be reviewed and reproduced. AI-assisted analysis is reviewed by a qualified analyst before delivery, and access to case data is limited to the people working on it and logged. Findings are assessments based on the sources available at the time: they are not guarantees, and a search that finds nothing does not prove that information does not exist. Material is kept only as long as the agreed purpose and the law require, then securely deleted or returned as agreed.
Procurement
What procurement and legal reviewers usually ask.
- Who are we contracting with?
- Next Sight d.o.o., Brnčičeva ulica 13, 1231 Ljubljana–Črnuče, Slovenia (EU). Company registration 9680390000, VAT ID SI42908159. Contracts are governed by Slovenian law unless agreed otherwise.
- Will you sign our DPA or NDA?
- Yes. We sign a data processing agreement where we process personal data on your behalf, and we are used to NDA-first conversations. Send your template with the briefing request, or ask for ours.
- Who else touches our data?
- Website enquiries are processed by HubSpot under a DPA and Standard Contractual Clauses. For engagements, the sub-processors and partners involved are disclosed to you under NDA before work starts. Partner enquiries abroad are run through a vetted network, and we do not pass your identity to a partner without your agreement.
- Can we speak to a reference?
- We do not publish client names. Where an existing client has agreed to it, we arrange a direct conversation; ask in your briefing request.
- What do you not claim?
- We name no certification we do not hold. We do not promise exhaustive discovery, and we do not decide identity, ownership or guilt: our deliverables show what the evidence supports and what it does not.
- How do you invoice?
- In euros, by bank transfer, against a written scope. Public bodies can be invoiced on their purchase-order terms.
Data controller
Who is responsible.
Next Sight d.o.o.
Brnčičeva ulica 13, 1231 Ljubljana–Črnuče, Slovenia
Registration number: 9680390000
VAT ID: SI42908159
Data protection requests: info@next-sight.com or the contact form.
Frequently asked
Compliance, briefly.
- Is Next Sight GDPR compliant?
- GDPR-aware by design: Next Sight d.o.o. is established in Slovenia and subject to the GDPR, and it designs its processing to meet it rather than claiming a certification. It is the controller for personal data processed through next-sight.com, applies data minimisation, purpose limitation and retention limits, answers data-subject requests, and relies on appropriate safeguards, such as Standard Contractual Clauses, for transfers outside the EEA. Nexus has its own privacy policy.
- How does Next Sight approach the EU AI Act?
- We assess our AI features against the EU AI Act's risk categories and do not use AI for practices the Act prohibits. In Nexus, AI output is presented as such, stays linked to its sources and is reviewed by the investigator, who decides what the evidence supports.
- Do you use Google Analytics on next-sight.com?
- Only if you accept it. Google Analytics 4 is loaded after you give consent in the banner, with advertising features and Google signals off; before that, nothing is sent to Google. You can withdraw consent at any time under Cookie settings at the bottom of every page, which switches the tag off and deletes its cookies.
- What happens when I submit the contact form?
- The form is provided by HubSpot, which processes your details on our behalf, and is protected by Google reCAPTCHA, which loads with the form before any cookie choice. We use your details only to answer your enquiry and manage any resulting business relationship, and we keep them only as long as needed for that purpose or as the law requires.
- Where is data stored?
- Some of our providers, including Google and HubSpot, may process website data outside the EEA, notably in the United States. Those transfers rely on the safeguards of Chapter V GDPR, such as the EU–US Data Privacy Framework or Standard Contractual Clauses. For Nexus, hosting and data location are set out in its privacy policy.
- How do I exercise my rights or file a complaint?
- Email info@next-sight.com or use the contact form at next-sight.com/contact, and tell us it is a data protection request; we answer within one month. You can also lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec, ip-rs.si) or with the supervisory authority in your EU member state.
- How do intelligence teams maintain chain of custody in digital investigations?
- Chain of custody means recording provenance, time, source and handler for each item of collected material across collection, analysis and reporting. Next Sight builds this into its procedures and platforms so findings can be reviewed by internal teams, regulators and courts; whether evidence is admitted is for the court to decide.
Need a deeper compliance conversation?
We're happy to walk procurement, legal and security reviewers through how we work and the documentation you'll need.
We usually reply the same day, and always within 24 hours.