Privacy Policy
Last updated: May 2026
Who we are
NextApex Ltd ("NextApex", "we", "us") operates nextapex.co.uk, a UK track day discovery service that aggregates event listings from track day operators across the country.
We are the data controller for the personal information described in this policy. If you have any questions or want to exercise your rights, contact us at privacy@nextapex.co.uk.
What information we collect and why
Email address (launch notification list)
If you sign up to be notified when the site launches, we collect your email address and record the time and your consent to receiving that notification. We use this solely to send you a single launch announcement email. We do not use it for ongoing marketing without separate consent.
Lawful basis: Consent (UK GDPR Article 6(1)(a)). You give explicit consent via a tick-box at sign-up. You can withdraw consent at any time by emailing us — we will remove your address from the list.
IP address (hashed) and user agent — outbound click logging
When you click a "Book" link on NextApex, we record an anonymised log entry that includes a one-way hash of your IP address (we cannot reverse it to recover your IP), your browser's user agent string, the referring page, and the booking URL you clicked. We do this to understand which events attract the most interest and to detect abuse of the redirect service.
Lawful basis: Legitimate interest (UK GDPR Article 6(1)(f)). We have a legitimate interest in understanding how our aggregation service is used and in maintaining its integrity. We use hashed rather than raw IP addresses to minimise the privacy impact. We have considered whether your interests override this and concluded they do not, given the anonymisation applied.
Technical log data
Like all web servers, our infrastructure records access logs containing IP addresses, request paths, timestamps, and response codes. These are retained for up to 90 days for security and operational purposes, then deleted.
Lawful basis: Legitimate interest.
How long we keep your information
| Data | Retention period |
|---|---|
| Email address (launch list) | Until unsubscribe, or 24 months after last interaction |
| Outbound click logs (hashed IP, UA, referrer) | 24 months, then aggregated and individual rows deleted |
| Server access logs | 90 days |
| Preview access cookie (nextapex_preview) | 30 days from when it is set |
Sharing your information
We do not sell, rent, or share your personal information with third parties for marketing purposes.
We may disclose information if required by law, or to protect the rights and safety of NextApex or others. We do not currently use any third-party analytics services, advertising networks, or data processors that receive your personal data.
Event listing data (dates, prices, booking links) is sourced from track day operators' own websites. Clicking a booking link takes you to the operator's site, which has its own privacy policy. We are not responsible for how operators handle your data once you leave NextApex.
International transfers
NextApex is hosted on a single server in the United Kingdom. We do not transfer personal data outside the UK. If this changes, we will update this policy and, where required, put appropriate safeguards in place.
Your rights
Under UK GDPR you have the right to:
- Access — ask for a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data (subject to legal retention obligations)
- Restriction — ask us to pause processing while a complaint is resolved
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — for any processing based on consent, withdraw it at any time without penalty
To exercise any of these rights, email privacy@nextapex.co.uk. We will respond within one calendar month.
You also have the right to complain to the Information Commissioner's Office (ICO) if you believe we are handling your data unlawfully: ico.org.uk — 0303 123 1113.
Cookies and local storage
Cookies are small text files stored on your device. We use only the cookies described below. We do not currently use any third-party analytics, advertising, or tracking cookies. If we introduce any in future, we will deploy a consent banner before doing so.
| Name | Type | Purpose | Duration | Category |
|---|---|---|---|---|
| nextapex_preview | Cookie | Controls access to the pre-launch preview of the site. Set only for authorised staff. | 30 days | Strictly necessary |
| nextapex_cookie_consent | Cookie | Records your Accept or Reject choice when the cookie consent banner is shown. Not currently set — will be introduced when optional cookies are added. | 365 days | Strictly necessary |
| na-theme | localStorage | Remembers your light/dark theme preference. Stored on your device only; not transmitted to our servers. | Indefinite (until cleared) | Functional |
Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top of the page will always reflect the most recent version. Material changes will be announced on the site.
Contact
NextApex Ltd
Email: [privacy@nextapex.co.uk](mailto:privacy@nextapex.co.uk