Solution
Industry Spotlight
.avif)
Watch our latest video case study!
Check out how Colibri's partnership with Nomo Fintech has transformed their approach to data
Learn more
At the Nasstar Group we are committed to protecting and respecting your privacy at all times
Last updated: August 2026
This notice provides an outline of when and why we collect personal information, how we use it and the conditions under which we may disclose it to third parties. It is important that you read this notice together with our Website Terms and Conditions. If you have any questions regarding this notice or our privacy practices in general, please email us at dpo@nasstar.com.
This notice is issued on behalf of the Nasstar group of companies so when we mention ”Nasstar”, “we”, “us” or “our” in this privacy notice, we are referring to the relevant company in the Nasstar Group responsible for processing your data. Details of the Nasstar group of companies can be found here.
GCI Network Solutions Limited is the controller, and responsible for Nasstar’s and Colibri’s websites. This means we decide how your personal data is processed and for what purposes. In some circumstances, we also act as a processor in respect of our customers’ personal data, with the customer acting as a controller.
Our registered business address is Melbourne House, Brandy Carr Road, Wakefield, West Yorkshire, WF2 0UG and our company house registered number is 04082862.
Personal data relates to an individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into its possession.
The processing of personal data in the UK is governed the General Data Protection Regulation 2016/679 (the “GDPR”) as incorporated into UK law pursuant to s.3 of the European Union (Withdrawal Act) 2018 (as amended) ("UK GDPR"), the Data Protection Act 2018 (“DPA”) and also by the Privacy and Electronic Communications (EC Directive) Regulations 2003.
If you have any queries or questions about this notice, then please contact our DPO by emailing dpo@nasstar.com
One of the purposes of this Privacy Notice is to explain how we collect and process personal data. The primary ways we collect information are as follows:
We encourage you to read this Privacy Notice. It has been written to ensure you understand how we collect information, how it is safeguarded, what is collected, how it is processed, where it is processed, with whom we may share it, and your rights under the law.
We collect and process a range of information about you. Depending on your interaction with us, this may include:
We may also collect, use and share aggregated data, such as statistical or demographic information, for business and analytical purposes. Aggregated data does not directly or indirectly reveal your identity and is therefore not considered personal data under applicable data protection legislation. For example, we may aggregate website usage information to understand how visitors interact with our websites and services in order to improve user experience, website performance and service offerings.
To enable the provision of products and services to you, we may also collect and process other personal data to enable the performance of the contract between you and us. This will be communicated and agreed through specific contract documentation and / or specific privacy notices.
In some cases, we collect personal data about you from third parties, such as analytics providers, lead generation companies, partners and event organisers.
We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences from your use of our website.
Where personal data is required for the provision of services, responding to enquiries, entering into contracts, administering employment arrangements, or complying with legal obligations, failure to provide the requested information may prevent Nasstar from fulfilling those requirements or delivering the relevant service.
We comply with our obligations under the DPA and GDPR by keeping personal data up to date (subject to your notification of any required updates to your personal data); by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
We will only process your personal data where we have a valid lawful basis to do so. Depending on the circumstances, this may include:
We set out in the table below a description of the ways we may use your personal data and which of the legal bases we rely on to do so, including our legitimate interests where appropriate.
Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us at dpo@nasstar.com if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
If you are a customer, supplier, employee, contractor or users of our services, then we may use your personal data for other purposes that are described in other privacy notices available on the Nasstar websites or through specific contract documentation.
The processing is necessary for the purposes described above and we take steps to minimise the impact on your privacy rights by endeavouring to contact only those individuals who have expressed an interest in our services or those in IT-based job roles, with information around IT-based services, solutions, events and information.
We may send marketing communications were permitted by law and where we have an appropriate lawful basis to do so. You may opt out of receiving marketing communications at any time by using the unsubscribe link included in marketing emails or by contacting us at enquiries@nasstar.com
Please note that opting out of marketing communications will not prevent us from sending service-related communications that are necessary to administer your account, fulfil our contractual obligations, provide support services, notify you of important service updates, or comply with legal and regulatory requirements.
No automated decision making is undertaken by us or the third parties with whom data is shared. Profiling is undertaken through the use of analytics in pursuance of our legitimate interests and as outlined in the section Purposes for which we will use your personal data above.
Our website uses cookies to make our site work and to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve it. Please see our Cookie Notice for details: https://www.nasstar.com/cookies
Your personal data will be treated as strictly confidential and will only be shared with the recipients detailed below for the purpose stated.
Your data may be transferred to countries outside the European Economic Area (EEA) or the United Kingdom in instances where we are required to transfer your data to another member of the Group for any of the purposes listed at How do we process your personal data? above, where our or our recipients’ servers used for storing personal data are based outside of the EEA or the United Kingdom.
If you use our services whilst you are outside of the EEA or the United Kingdom, your data may be transferred outside the EEA or the United Kingdom (as appropriate) in order for us to provide you with those services.
Data will only be transferred outside of the EEA or the United Kingdom (as appropriate) where a declaration of adequacy and Data Protection Agreement or equivalent agreement is in place. If the country in which the data is to be transferred has no declaration of adequacy in place, then we will request the third party to enter into a legal agreement that reflects those standards through the use of Standard Contractual Clauses. "Standard Contractual Clauses" for these purposes means: (i) where the GDPR applies, the standard contractual clauses for the transfer of personal data to controllers or processors (as appropriate) established in third countries approved by the European Commission from time to time (as amended or replaced by the European Commission from time to time) and (ii) where the UK GDPR applies, the "International Data Transfer Addendum to the EU Commission Standard Contractual Clauses" or the "International Data Transfer Agreement" issued (in each case) by the Information Commissioner under s.119A(1) of the Data Protection Act 2018 (as amended or replaced by the Information Commissioner's Office from time to time).
We keep your personal data for no longer than is reasonably necessary for the purposes set out in this Privacy Notice. This is determined through assessment by the DPO.
We delete personal data relating to sales and marketing upon receipt of an opt-out request, or two years after the last communication we receive from you.
We may de-identify your personal data so that it can no longer be associated with you and use it for testing or research purposes, in which case we may use such de-identified data indefinitely without further notice to you.
Under the GDPR, you have the ability to exercise via the DPO the following rights with respect to your personal data:
Where we rely on your consent as the lawful basis for processing your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing undertaken before consent was withdrawn. Where processing is based on another lawful basis, such as contractual necessity, legal obligation or legitimate interests, the right to withdraw consent will not apply.
If we wish to use your personal data for a new purpose that is not covered by this privacy notice and which is incompatible with the purposes described in this notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where necessary, we will seek your prior consent to the new processing.
Individuals wishing to raise a concern or complaint relating to the processing of their personal data should contact Nasstar in the first instance by emailing dpo@nasstar.com. Complaints will be reviewed and investigated in accordance with Nasstar's data protection processes.
Where an individual remains dissatisfied following our response, they retain the right to lodge a complaint with the Information Commissioner's Office (ICO).
Their address and contact details are as follows:
Information Commissioners Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.
Alternatively, you can email them via the following link: https://ico.org.uk/global/contact-us/email/
Contact details for data protection authorities in the European Economic Area, are available at https://edpb.europa.eu/about-edpb/board/members_en For other countries please contact our DPO at dpo@nasstar.com.
We may update this notice from time to time in response to changing legal, technical or business developments.
When we update our notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.
You can see when this privacy notice was last updated by checking the “last updated” date displayed at the top of this privacy notice.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
