June 19, 2026
Your privacy is important to us. This policy explains how NexClass Luxembourg S.à r.l. (“we”, “us”) processes personal data when you use Nexpense, in accordance with the GDPR and applicable Luxembourg law.
1. Who is responsible?
NexClass Luxembourg S.à r.l., 19 Rue de l'église, L-7421 Cruchten, Luxembourg. Email: contact@nexclass.lu.
Nexpense is an association management platform. Associations using Nexpense act as independent controllers for the member and operational data they enter. We act as processor for that association data under our Data Processing Agreement (https://nexpense.eu/dpa) and the association’s instructions, and as controller for account, billing, marketing contact, and platform operation data described below.
2. Data we collect
Depending on how you use Nexpense, we may process:
- Association registration: association name, URL slug, administrator email address, and timestamps of legal acceptance.
- Staff accounts: name, email address, role, permission settings, and legal acceptance timestamps.
- Member accounts: name, email address, membership status, profile fields, broadcast opt-out preferences, and related association data entered by your organisation.
- Operational data: accounting entries, documents, broadcast messages, calendar events, and registrations that your association stores in the platform.
- Authentication and security: verification tokens, password reset requests, session identifiers, and rate-limiting metadata.
- Technical data: IP address, browser type, timestamps, and request logs needed to operate and secure the service.
- Marketing contact form: name, email, and message content submitted on the public website.
- Public marketing website: our homepage, registration page, and legal pages may be listed in /sitemap.xml and indexed by search engines. Visits that arrive from search results are handled like other visits (technical logs and aggregate analytics).
- Search performance (operator use): Google Search Console provides aggregated reports on indexing status and search queries that led users to our public site (processed by Google on our behalf).
3. Purposes and legal bases
We process personal data to:
- Provide, maintain, and improve Nexpense (contract / legitimate interest, Art. 6(1)(b) and (f) GDPR).
- Register associations and authenticate users (contract, Art. 6(1)(b)).
- Send transactional emails such as verification and password reset messages (contract / legitimate interest).
- Deliver email broadcasts that association staff initiate to their members (contract; staff act on behalf of the association; members may unsubscribe).
- Respond to contact form inquiries (legitimate interest, Art. 6(1)(f)).
- Measure aggregate page views via privacy-friendly analytics (legitimate interest, Art. 6(1)(f)).
- Index public marketing pages in search engines and review search performance (legitimate interest, Art. 6(1)(f)).
- Ensure security, prevent abuse, and comply with legal obligations (legitimate interest / legal obligation, Art. 6(1)(f) and (c)).
4. Cookies and similar technologies
We use essential cookies and similar browser storage to run the service. See our Cookie policy for a full list. We use Vercel Analytics for cookieless, aggregate page-view statistics. We use Google Search Console as an operator tool to manage search indexing; it does not place cookies on visitors’ browsers. We do not use advertising cookies on Nexpense.
5. Recipients and processors
We do not sell personal data. We use trusted subprocessors bound by data processing agreements. Primary processing takes place in the European Economic Area. Some subprocessors may process data in the United States or other countries; where required we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs).
Current subprocessors include: Supabase (database, EU region), Vercel (application hosting and analytics), Resend (transactional and broadcast email delivery), NexClass Forms (marketing contact form submissions at forms.nexclass.lu), and Google Ireland Limited (Google Search Console for public website indexing and search performance reporting). Association customers may review our Data Processing Agreement at https://nexpense.eu/dpa.
6. Retention
We retain personal data only as long as necessary:
- Association and user account data: for the duration of the active account, plus up to 30 days after deletion to complete erasure and backups.
- Marketing contact inquiries: up to 24 months, then deleted.
- Broadcast delivery logs: metadata retained for the life of the association account; message body text is removed after 12 months.
- Email verification and password-reset tokens: 48 hours.
- Rate-limiting counters: rolling windows (minutes to hours).
- Server and application logs: approximately 90 days (hosting provider defaults).
- Google Search Console: retained per Google’s policies while the property remains linked; we may delete historical data when removing the property.
- Database backups: limited retention per hosting provider; deleted data may persist in backups for a short period after erasure.
7. Broadcast opt-out
Members may unsubscribe from association email broadcasts via the link included in each broadcast message. Unsubscribed members are excluded from future broadcasts until they re-enable email in their member profile. Associations are responsible for having a lawful basis to email their members.
8. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, or object to certain processing, and withdraw consent where processing is consent-based. Email contact@nexclass.lu from the address associated with your account. We aim to respond within 30 calendar days and may ask you to verify your identity. If your request relates to data your association entered about you as a member, we may forward the request to your association as controller. You may lodge a complaint with the Commission nationale pour la protection des données (CNPD), Luxembourg.
9. Contact
For privacy questions or requests: contact@nexclass.lu or +352 621 218 284.