Skip to content
Close
SEARCH
Get a demo
Get a demo

NextTables Product / SAAS Privacy Notice

TABLE OF CONTENTS
loading...

NextTables Product / SAAS Privacy Notice

Last modified: 22.03.2026

We at NextTables GmbH ("NextTables", "we", "us") are committed to protecting personal data. This Product / SaaS Privacy Notice ("Product Notice") explains how we process personal data when providing our SaaS product ("Service").

NextTables is a web application that connects to existing data platforms and enables business users to maintain data directly in platforms, reducing reliance on separate data silos like spreadsheets.

If you do not agree with the data practices described in this Product Notice, you should not use the Service.

We may update this Product Notice from time to time. We will post the updated version on this page and update the "Last modified" date. If the changes are material, we may provide a more prominent notice (for example, via the Service or by email).

WHO WE ARE

Controller: NextTables GmbH
Kapellenstrasse 37, 65719 Hofheim am Taunus, Germany
Registered seat (Sitz): Hofheim am Taunus
Managing Director (Geschäftsführer): Sebastian Uhlig
Commercial register: Amtsgericht Frankfurt am Main, HRB 139443
VAT ID: DE 457 704 957

Privacy contact: privacy@nexttables.com
Supervisory authority (Germany): Hessischer Beauftragter für Datenschutz und Informationsfreiheit (HBDI), Postfach 3163, 65021 Wiesbaden

SCOPE

This Product Notice applies to personal data processed in connection with the Service, including when you:
  • create and administer accounts for the Service,
  • authenticate and access the Service,
  • use the Service and interact with its features,
  • contact us for support, and
  • when we operate, secure, and maintain the Service.
This Product Notice does not cover our website and marketing activities (such as cookies, web analytics, newsletters, and advertising). Those activities are described in our separate "Website & Marketing Privacy Policy".

ROLES UNDER GDPR (CONTROLLER VS PROCESSOR)

When we act as Processor

We act as a processor where we process personal data as part of "Customer Content" and related data that a customer (our business customer) uploads, inputs, or otherwise makes available in the Service and for which the customer determines the purposes and essential means of processing.

Customer Content may include, for example, ERP-related data, business data, HR data, marketing-related data, customer information, and similar data typically stored in an ERP system or business application. The customer controls what Customer Content is stored and how it is used within the Service.

Where we act as processor, we process personal data only on the customer's documented instructions and as set out in our Data Processing Agreement ("DPA").

DPA: Available on Request

When we act as Independent Controller

We act as an independent controller for certain operational data that we process for our own purposes, including to administer accounts, secure the Service, provide support, communicate with customers, and comply with legal obligations. This typically includes:
  • account and user administration data (e.g., name, business email, role),
  • authentication and identity identifiers used for sign-in and access control,
  • security and audit logs,
  • service communications (e.g., availability, security, and change notices),
  • support interactions (tickets, attachments, and—if used—screen recordings), and
  • product usage and diagnostics data (depending on configuration and tooling).

WHAT PERSONAL DATA WE PROCESS

Controller data (operational data)

Depending on your use of the Service, we may process the following categories as controller:
  • Account & profile data: name, business email address, company, role, account status, user IDs.
  • Authentication data: identifiers provided by identity providers (e.g., Microsoft Entra ID identifiers, Google identifiers), plus internal identifiers (e.g. email address) required to manage access.
  • Security & audit data: login events, access logs, timestamps, IP address, device/browser details, audit trails and administrative actions.
  • Usage and diagnostics (telemetry): feature usage, performance metrics, and error data.
  • Support data: support requests, communications, and attachments; potentially screen recordings.

Processor data (Customer Content)

As processor, we may process Customer Content and related data submitted by the customer or its authorized users. The specific data types depend on the customer's configuration and use case and may include personal data contained within business records (e.g., employee, customer, supplier, and contact data).

SPECIAL CATEGORIES OF DATA (ART. 9 GDPR)

The Service is not specifically designed for special categories of personal data (e.g., health data, biometric data, political opinions). However, customers control what data is stored and may choose to store such data within Customer Content.

If a customer stores special categories of personal data in the Service:
  • the customer remains responsible for ensuring a valid legal basis and an applicable Art. 9 GDPR condition,
  • we will process such data only as processor under the DPA and the customer's documented instructions, and
  • depending on the risk and the customer's requirements, additional safeguards and/or written agreement may be required.

PURPOSES AND LEGAL BASES (FOR CONTROLLER PROCESSING)

We process Controller data for the following purposes and legal bases (as applicable):

  • Account and access administration (Art. 6(1)(b) GDPR – performance of a contract / steps prior to entering into a contract).
  • Operating and securing the Service (Art. 6(1)(f) GDPR – legitimate interests in ensuring security, preventing abuse, and maintaining service reliability).
  • Support and customer communications (Art. 6(1)(b) and/or Art. 6(1)(f) GDPR).
  • Compliance and legal obligations (Art. 6(1)(c) GDPR).
  • Service improvement and analytics (Art. 6(1)(f) GDPR; details depend on telemetry tooling and configuration; we aim to minimize personal data and use aggregation where feasible).

AUTHENTICATION AND IDENTITY PROVIDERS

The Service supports authentication via:
  • Microsoft Entra ID (Azure AD),
  • Google sign-in, and
  • email address and password.
Identity providers typically process authentication data under their own terms and may act as independent controllers for their authentication services. You should review their privacy information for details.

WHO WE SHARE PERSONAL DATA WITH

We may share personal data (Controller data and, where applicable, processor data) with:
  • Service providers supporting hosting, support, monitoring, email delivery, and other operational needs (see "Subprocessors and Service Providers" below).
  • Professional advisors (legal, audit, tax) where necessary and permitted.
  • Authorities where required by law or to protect rights and security.

We do not sell personal data.


SUBPROCESSORS AND SERVICE PROVIDERS

We use third-party service providers ("Subprocessors") to help us operate and deliver the Service. The Subprocessors applicable to your subscription depend on your deployment (shown in your service URL, e.g., yourname.eu1.app.nexttables.com).

Your applicable Subprocessors are:

  1. All providers listed under Service-wide Subprocessors (apply to every customer), plus
  2. The providers listed under your deployment.

If you wish to receive advance notification of changes to this list, please contact us at privacy@nexttables.com.


Service-wide Subprocessors

These providers process data for all NextTables customers regardless of deployment.

Provider Legal entity Purpose Typical data Processing location
HubSpot HubSpot Germany GmbH Support tooling (tickets, customer communications) Support data; contact/admin data EU (Germany)
Brevo Sendinblue GmbH Service email notifications (system alerts, support correspondence) Name, email address, message metadata EU

Deployment-specific Subprocessors

These providers are used for hosting, infrastructure, and operations in your specific deployment.

Deployment EU1 — Microsoft Azure, West Europe

Provider Legal entity Purpose Typical data Processing location
Microsoft Azure Microsoft Ireland Operations Ltd Hosting, compute, storage, backups Service data, Customer Content, logs, backups EU (West Europe)
Microsoft Azure Microsoft Ireland Operations Ltd Reliability monitoring, alerting, diagnostics Logs, diagnostics, device/IP metadata EU (West Europe)
Microsoft Azure Microsoft Ireland Operations Ltd Product analytics and diagnostics Usage/error data EU (West Europe)

Additional deployments

We are working on additional deployment regions. This page will be updated as new deployments become available. If you have specific requirements regarding data residency or hosting regions, please contact us.


How to identify your deployment

Your deployment is shown in your service URL. For example:

  • yourname.eu1.app.nexttables.com → Deployment EU1 (Azure West Europe)

If you are unsure which deployment applies to your subscription, please contact us.


INTERNATIONAL TRANSFERS

We aim to process Service data in the region selected for the customer's deployment. If personal data is transferred outside the EEA/UK (for example, due to certain support arrangements or tooling providers), we will implement appropriate safeguards such as EU Standard Contractual Clauses and supplementary measures where required.

Transfers and safeguards: At this stage not applicable as data is only hosted in the EU.

RETENTION

Unless otherwise agreed in contract and/or the DPA, we apply the following retention approach (may vary by configuration and legal obligations):

  • Customer Content (processor): export available for up to 30 days after termination (if applicable), then deletion within 60 days total (subject to backup cycles and legal requirements).
  • Backups: rolling backups retained up to 30–90 days.
  • Security and audit logs: typically retained 90–180 days.
  • Support tickets: typically retained up to 24 months after closure (or longer if needed for disputes/compliance).

SECURITY

We maintain technical and organizational measures appropriate to the risk. The specific measures in place are subject to change and will be confirmed internally.

Measures may include:
  • encryption in transit
  • encryption at rest
  • access controls and least privilege
  • audit logging
  • tenant separation controls
  • vulnerability management and patching
  • backups and disaster recovery measures
  • incident response procedures
Security details / TOMs: Available per request.

YOUR RIGHTS AND HOW TO CONTACT US

Where we act as controller, individuals may have rights under GDPR (access, rectification, deletion, restriction, objection, portability) depending on the circumstances and applicable law.

Where we act as processor for Customer Content, requests should generally be submitted to the customer (the controller), who can instruct us as needed under the DPA.

If you have questions or want to exercise your rights (where applicable), please contact us:

Email: privacy@nexttables.com
Mail: NextTables GmbH, Kapellenstrasse 37, 65719 Hofheim am Taunus, Germany

You may also lodge a complaint with a supervisory authority, including the competent authority in Germany: Hessischer Beauftragter für Datenschutz und Informationsfreiheit (HBDI), Postfach 3163, 65021 Wiesbaden, Germany.