Privacy notice

The controller of the personal data described in this notice is NEXT ATHENS INSTITUTE SINGLE MEMBER S.A., VAT number 802791221, registered in the Greek General Commercial Registry under number 182829701000.

Its registered office is at 42 Nik. Karella St, 15233 Chalandri, Athens, Greece.

You can reach us through the contact form on this site with any question about your data. No data protection officer has been appointed; if that changes, their contact details will be published here.

The enquiry form asks for your name, work email address and organisation. It also offers optional fields: your role, the size of your team, your timeframe, the capability you are prioritising, and anything else you want to tell us.

We use this to respond to you and to understand what organisations are asking for. No account is created and you are not added to a mailing list. We do not send marketing email from this site.

Two messages are sent when you submit the form: an acknowledgement to you, and a notification to the NAI team so that someone can pick it up.

Accounts are created by NAI rather than by self sign up. We hold your email address, whatever profile details you choose to add, the roles you have been granted, and your progress through a programme.

Sign in uses a link sent to your email address. We do not store a password.

Work you create in the capstone workspace is private to you by default. It is not shared with your employer, a sponsor or other participants unless you explicitly choose to share it.

This is enforced by access rules in the database itself, not only by what the interface chooses to show. A request for someone else’s capstone work returns nothing, whoever makes it.

Athena, the assistant on this site, sends your message to OpenAI in order to generate a reply. Do not put confidential information into it.

To stop the assistant being abused we count requests per visitor. We do this by storing a one way hash of your IP address combined with a secret value, which lets us count requests without keeping the address itself.

Before you make a choice, this site sets no cookies at all and stores nothing in your browser.

If you accept analytics, Google Analytics sets two cookies, _ga and _ga_TNWPLZZ2FH, which expire after about 400 days and are used to count visits and see which pages are read.

If you decline, no analytics cookie is ever set. Either way we record your answer in your browser’s local storage under nai-analytics-consent, so that we do not ask again. That single entry is the only thing we store when you decline.

When you are signed in, your browser holds a session cookie so that you stay signed in. This is necessary for the platform to work and is not subject to consent.

You can change your answer at any time using the Cookie choices link in the footer.

Supabase hosts the database, the authentication service and file storage, in Ireland.

Vercel hosts and serves the website.

Resend delivers the transactional email described above, in Ireland.

OpenAI processes assistant conversations.

Google Analytics receives page view data, and only if you have accepted analytics cookies.

Payment processing and video hosting are described in some of our material as part of the platform. Neither is switched on at present, so no payment or video data is being processed. This notice will be updated before either is enabled.

Enquiries: up to 24 months after our last exchange with you, so that a conversation can be picked up again without asking you to repeat yourself.

Accounts, learning progress and capstone work: for as long as your account is open, and deleted within 12 months of it being closed.

Records of the emails we sent you: 12 months.

The assistant: the hashed value used to count requests is deleted automatically after one day, and the daily cost records it keeps contain no personal data.

Analytics data, only if you accepted analytics cookies, is retained by Google according to the setting on our property, and the cookies themselves expire after about 400 days.

You can ask us to delete your data sooner than any of the periods above.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to how we are using it. You can also ask us to send it to you in a portable form.

Ask through the contact form and we will respond. If you are not satisfied with our answer, you have the right to complain to the Hellenic Data Protection Authority.