Privacy Policy

Download the full Privacy Policy (PDF)

Last updated: 29 October 2026

1. Who is responsible for your data

NEXTED GROUP S.L. is the controller of personal data processed for the websites nextmba.com and next.london and the learning, business-event, ticketing and customer-support services described in this policy. NEXT MBA and NEXT are trading names used for these services.

Company details: NEXTED GROUP S.L.; NIF B56576259; VAT ID ESB56576259; Calle Gregal, 8, Betera, Valencia, 46117, Spain. For privacy questions and requests to exercise your rights, email service@nextmba.com or write to this postal address, marked “Privacy request”.

This notice explains our processing under the EU General Data Protection Regulation (GDPR) and applicable Spanish data-protection law. Where UK data-protection law applies to our activities, the corresponding rights and obligations also apply. Reading this notice or visiting a website does not constitute consent to optional processing.

Connected email, calendar, meeting and AI features have additional product-specific notices. In particular, https://nextmba.com/workplace/privacy explains the use of connected Google data and AI features and takes precedence for that processing. Connecting an account or granting an integration permission is separate from buying a course or event ticket.

2. What we collect and where it comes from

Contact and account information: your name, email address, telephone number, account identifier, sign-in information and preferences when you provide them or create an account.

Orders and attendance: products or tickets selected, quantities, ticket category, assigned row and seat where applicable, attendee details, booking identifiers, reservation and payment status, attendance or access records, and relevant service communications.

Billing and payment records: billing name and address, company and tax information when supplied, invoice details, amount, currency, payment-provider references, transaction status, refunds and dispute records. Card details are entered into the payment provider’s payment interface. Our order systems do not store full card numbers or card security codes.

Enquiries and service use: messages, support requests, course participation and content-access information, and information you choose to submit through a form, survey or other service feature. Do not send sensitive personal information unless it is needed for a specific request.

Technical and measurement information: IP address, device and browser information, pages and actions, timestamps, referring pages, campaign parameters, cookie or similar identifiers, and choices about measurement. The information collected depends on the page, enabled integrations and your settings. See section 5.

We receive information directly from you, from your browser or device, from payment and technical service providers, and from a purchaser or employer arranging access on your behalf. If someone buys a ticket for you, we may receive your name and contact details from that person. We use these details to deliver the booking and give you the relevant privacy information, normally in our first communication. Please give other attendees this policy before submitting their details.

3. Purposes and legal bases

Purchases, accounts and delivery: to take requested pre-contractual steps, process a booking, manage payment status, provide access, allocate seats, deliver tickets or courses, and send necessary service updates. Legal basis: performance of a contract or steps at your request before a contract, GDPR Article 6(1)(b). When an employer or another buyer books for you, our legitimate interest in delivering the requested service may apply to attendee administration, Article 6(1)(f).

Customer support and enquiries: to answer questions and resolve service problems. Legal basis: Article 6(1)(b) for contractual matters and Article 6(1)(f) for our legitimate interest in responding to other enquiries and maintaining accurate service records.

Accounts, invoices and legal duties: to maintain required accounting and tax records, handle legally required requests, and meet applicable reporting obligations. Legal basis: compliance with legal obligations, Article 6(1)(c).

Security, fraud prevention and disputes: to protect accounts and transactions, investigate misuse, establish facts and exercise or defend legal claims. Legal basis: Article 6(1)(f), based on our interests in preventing fraud, securing our services and protecting legal rights, and Article 6(1)(c) when a specific legal duty applies.

Optional marketing: to send promotional messages where you have consented, Article 6(1)(a). Where applicable law permits communications about our similar services to existing customers, we may rely on Article 6(1)(f), with an opt-out when details are collected and in each message. You may object to direct marketing at any time.

Optional analytics and advertising measurement: to understand use of our pages and measure campaigns. Where consent is required for cookies, similar technologies or subsequent personal-data processing, the legal basis is Article 6(1)(a). Essential operational records used for reliability, security and transaction administration rely on Article 6(1)(f) or the relevant contractual or legal basis above.

Where we rely on legitimate interests, we must consider the impact on your rights and whether less intrusive means are available. You can request information about the relevant assessment and object as explained in section 8. If you voluntarily request an accessibility or other arrangement involving health information, we will request the necessary explicit consent or identify another applicable legal basis before using that information.

4. Required and optional information

Fields marked as required are needed to respond to your request, establish the booking, deliver tickets or access, or fulfil a legal duty. If you do not provide them, we may be unable to complete that step. Telephone numbers and company invoice details may be optional depending on the form and requested service. Marketing consent is not a condition of purchase. Declining optional measurement does not affect your ticket or course entitlement.

5. Cookies, analytics and advertising

Our websites use cookies and similar browser storage for essential functions such as sessions, security, shopping or reservation state, and saving preferences. Pages may also integrate Google Analytics, Yandex Metrica, Meta advertising measurement and ChatGPT advertising measurement, depending on their configuration. These services can receive technical identifiers, page or campaign information and relevant conversion events. Yandex Metrica features can include interaction measurement or session replay where enabled.

For consent-based processing, you may give or withdraw consent using the relevant preference controls provided on the site or checkout. Use the checkout’s Privacy preferences or individual measurement options where displayed. You can also contact service@nextmba.com about your choices. Browser settings let you block or delete cookies and stored site data; deleting a consent preference can reset the saved choice. Blocking essential storage may affect sign-in or checkout.

A link to this policy, acceptance of purchase terms or continued browsing is not consent to optional cookies or advertising. Withdrawal applies to future consent-based processing and does not affect processing that was lawful before withdrawal. Separate third-party services have their own notices and controls.

6. Who receives information

Service providers supporting website hosting, databases, authentication, security, communications, customer support and service delivery. They receive the information needed for their role; where they act as processors, they must process it under appropriate contractual instructions.

Payment providers, acquiring banks and payment networks used for the transaction. The checkout identifies the provider used. Depending on the service or historical transaction, this may include Cyberpac/Redsys, MONEI or another provider. Rapyd may receive relevant merchant-verification materials and, if used for a payment, information needed to process that payment and meet its regulatory obligations. Payment providers may act as independent controllers for fraud prevention and their legal duties; their own privacy notices apply to those activities.

Event venues, admission staff, course-delivery partners and instructors where necessary for admission, access or delivery. This does not give them permission to use attendee contact details for unrelated marketing. An employer purchasing access may receive information needed to administer that purchase.

Analytics and advertising providers for the measurement described in section 5, subject to the applicable legal basis and choices.

Professional advisers, auditors, insurers, courts and public authorities where disclosure is necessary for legal duties, disputes, fraud investigations or protection of legal rights. If the business is reorganised or transferred, relevant records may be disclosed with appropriate confidentiality safeguards and notice where required.

We do not sell personal data. Ask us for more detail about the recipients relevant to your transaction or service.

7. International transfers and retention

Our providers may process information in the EEA, the United Kingdom, the United States and other countries, depending on the service. Where processing involves a transfer subject to GDPR transfer rules, the applicable mechanism must be an adequacy decision covering the recipient, or appropriate safeguards such as the European Commission’s standard contractual clauses with the required assessment and supplementary measures. Applicable UK safeguards are required for restricted UK transfers. Merely visiting a site is not consent to an international transfer. Contact service@nextmba.com for information about the destination and safeguards for your data, including how to obtain a copy of relevant safeguards.

We retain personal data only for the relevant purpose and applicable legal or claims requirements. The following criteria determine the retention period:

Active accounts and service records: for the duration of the account or service relationship and the time needed to resolve outstanding access, support or contractual matters. Closure or a valid erasure request ends ordinary account use, subject to the exceptions below.

Orders, invoices, payments and disputes: for the applicable accounting, tax and record-keeping periods, and any relevant claim or dispute limitation period. Where a legal hold applies, the relevant records are retained until it ends. Access to retained compliance records is restricted.

Uncompleted enquiries and bookings: for the time needed to answer the enquiry, administer the attempt, prevent abuse and address related issues. The expiry of a temporary seat reservation releases the seat; it does not itself erase associated order or fraud-prevention records.

Marketing records: until consent is withdrawn, you object, or the information is no longer needed for the permitted marketing purpose. We may retain a minimal suppression record so we do not contact you again against your wishes.

Security logs, analytics identifiers and backups: according to the security or measurement purpose, configured retention settings, incident requirements and backup cycle. Data awaiting removal from a backup is not used for ordinary business activity and is removed through the applicable backup cycle.

You may ask for the retention period or criteria applicable to your particular information. When data is no longer needed, it should be deleted or irreversibly anonymised.

8. Your rights and how to exercise them

Subject to the conditions in applicable law, you may request access and a copy of your personal data; correction; erasure; restriction of processing; and portability of data you provided where processing is automated and based on consent or a contract. You may object to processing based on legitimate interests, including related profiling. Your right to object to direct marketing is unconditional.

You may withdraw consent at any time without affecting the lawfulness of earlier processing. To stop promotional emails, use the unsubscribe link or email service@nextmba.com. Essential booking, payment, safety and service messages may still be sent when necessary.

Send a rights request to service@nextmba.com or to the postal address in section 1. Include enough information to locate the relevant account or order, but do not send payment-card details. We may request proportionate identity verification when necessary. We normally respond within one month of receipt; if the law permits an extension of up to two further months for a complex or numerous request, we will explain the extension within the first month. Requests are normally free of charge.

You may complain to the Spanish Data Protection Authority (Agencia Española de Protección de Datos), https://www.aepd.es, or to the competent authority where you live, work or believe an infringement occurred. Where UK law applies, you may contact the Information Commissioner’s Office, https://ico.org.uk. You do not need to contact us first before complaining to an authority.

9. Automated decisions, security and children

Our ordinary website booking and course-administration processes are not intended to make decisions based solely on automated processing that produce legal or similarly significant effects on you. Payment providers may use automated fraud or authentication checks under their own notices. If a payment is rejected or you believe an automated result is incorrect, contact us and the relevant provider to request assistance and, where applicable, human review.

We use access controls and technical and organisational measures intended to protect personal data. No system can guarantee absolute security. Keep your account credentials and ticket-access links private and report suspected misuse to service@nextmba.com.

These services are intended primarily for adults and professional audiences. Minors must meet any applicable service and event conditions and obtain parent or guardian involvement where required. We do not knowingly seek personal data from children who cannot lawfully use the relevant service. A parent or guardian can contact us about information submitted by a child.

10. Changes and contact

We may update this policy to reflect changes in our services or legal obligations. The date above identifies this version. We will provide an additional notice where required for a material change and seek fresh consent where necessary. A policy update does not automatically authorise a new use of your information.

Privacy contact: service@nextmba.com. Controller: NEXTED GROUP S.L., Calle Gregal, 8, Betera, Valencia, 46117, Spain.

Designated publication addresses: https://nextmba.com/policy and https://next.london/policy.