Privacy policy
Last updated: 3 June 2026
Who we are
This site is operated by NextSource Industries (NextSource Industries), a small biostimulant and calci-worm grower based in UK, United Kingdom. We are the data controller for any personal information collected through this website.
For privacy questions, contact us at info@nextsource.uk.
What this policy covers
This policy explains what personal data we collect when you visit this website, create an account, place an order, or contact us — and how we use, store, and share it. It applies to nextsource.uk and any subdomains we operate.
It does not cover third-party sites we link to (for example our Instagram profile). Their own privacy policies apply when you visit them.
What we collect, and why
We try to collect as little as we can to do the job. In practice that means:
When you visit any page
- Aggregated, anonymous analytics (pageviews, country, device type, referring site) via Vercel Web Analytics. No cookies, no persistent visitor ID — visitors are identified by a salted hash of IP and User-Agent that is rotated daily.
- Anonymous performance measurements (page load times and Core Web Vitals) via Vercel Speed Insights. Also cookieless, with no persistent visitor ID.
- Standard server logs kept by our hosting provider (Vercel) including IP address and request path, used for security and debugging. Retained ~30 days.
Lawful basis: legitimate interest — we need to understand how the site is used and to keep it secure. The data is not used to target advertising and is not shared with marketers.
When you create an account
- Your email address.
- One-time passcodes used to verify that email.
- A profile record holding your role (customer or admin) and any marketing preferences you set.
- Any postal addresses you choose to save for delivery. You can edit or delete these at any time from your account page.
Lawful basis: contract — we cannot run an account without it.
When you place an order
- A snapshot of the delivery address, items, and price at the moment you checked out (kept for the order history and for our own accounting records).
- Payment details — entered on Stripe's own checkout pages. We never see or store your full card number. Stripe sends us back a token, the last four digits, and a confirmation that payment succeeded.
- An order confirmation email, sent via Resend.
Lawful basis: contract for fulfilment, and legal obligation for the accounting records (HMRC requires we keep transaction records for six years).
When you email us
Anything you put in an email to info@nextsource.uk, plus our reply, is kept in our inbox for as long as we reasonably need it to handle your enquiry — typically up to two years.
Cookies and similar technology
We do not use marketing, advertising, or cross-site tracking cookies, and we do not embed third-party trackers like Meta Pixel or Google Analytics. We therefore do not show a cookie banner — there's nothing to consent to.
The cookies that areset fall under the "strictly necessary" exemption in PECR (the UK regulation on cookies):
- Supabase auth cookies (
sb-…) — keep you signed in. Cleared when you sign out. - Stripe.js cookies (
__stripe_mid,__stripe_sid) — set by Stripe on the checkout page for fraud prevention. See Stripe's cookie policy. - A small cart cookie(or browser storage) holding the items you've added before you check out.
Who we share your data with
We use a small set of trusted suppliers ("processors") to run the site. They process data on our instructions and are not allowed to use it for their own purposes:
| Processor | What they do | Where |
|---|---|---|
| Supabase | Database + authentication | EU (Ireland) |
| Vercel | Website hosting + anonymous analytics | EU + US |
| Stripe | Payment processing | EU + US |
| Resend | Transactional email (order confirmations) | EU + US |
For transfers outside the UK / EEA we rely on the UK's data adequacy decisions (where applicable) and Standard Contractual Clauses with the relevant supplier.
We do not sell your data, and we do not share it with advertisers or data brokers.
How long we keep things
- Account data — for as long as your account is open. If you ask us to delete your account, we will remove your profile and saved addresses within 30 days.
- Order records — six years, to meet HMRC requirements. After that, deleted.
- Transactional emails — kept by Resend for ~30 days for delivery diagnostics, then deleted.
- Server logs — ~30 days at Vercel.
- Analytics— aggregated only, kept indefinitely (it isn't personal data once aggregated).
Your rights
Under UK GDPR, you have the right to:
- See a copy of the personal data we hold about you.
- Have it corrected if it's wrong.
- Have it deleted — subject to records we're legally obliged to keep, like completed orders.
- Object to or restrict how we use it.
- Receive a portable copy in a common format.
- Withdraw consent for anything you previously consented to (e.g. marketing).
To exercise any of these, email info@nextsource.uk. We'll reply within one month.
If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office — though we'd much rather you told us first so we can fix it.
Marketing
We will only send you marketing email if you specifically opt in. Order confirmations and other transactional messages are not marketing — you'll get those because you bought something. Every marketing email has an unsubscribe link.
Changes to this policy
If we make a material change — adding a new processor, collecting a new category of data, changing retention periods — we will update the "Last updated" date at the top and, where the change is significant, email registered customers to flag it.
Contact
Questions, requests, or complaints about this policy: info@nextsource.uk.