Privacy & Acceptable Use

NCI Portal is an internal IT/HR management tool for Nextclinics International. This notice explains what personal data it processes and the rules for using it. Last updated: 2026.

1. Data controller

The portal is operated by 420 IT s.r.o. as IT service provider, on behalf of the Nextclinics International entities. For data-protection questions contact nci@420it.cz.

2. What personal data we process

Employee directory: name, work email, phone, role, company/entity, work start/stop dates.
Portal accounts: name, email, role, assigned entities, last login (passwords are stored only as salted hashes).
Tickets (on/off-boarding, change, requests): the data entered into each request; sensitive ticket payloads are stored encrypted at rest.
Audit log: administrative actions (who did what, when) for security and accountability.

3. Purpose & legal basis

Data is processed solely to administer IT and HR operations for the group (user/account management, on/off-boarding, license management). Legal basis: performance of the employment relationship and the legitimate interest of the group in secure, well-managed IT (Art. 6(1)(b) and (f) GDPR).

4. Retention

Personal data is kept only for as long as it is needed for the purposes above and to meet applicable legal obligations, after which it is deleted or anonymised. In practice:

Portal accounts are deactivated when a person leaves or no longer needs access, and removed once they are no longer required for security accountability.
Employee directory data reflects the group’s HR records and is updated or removed as those records change.
Ticket data is retained while operationally relevant and then deleted in line with the group’s data-retention policy.
Audit-log entries are kept for a limited period to support security and accountability.

Specific retention periods follow the Nextclinics group data-retention policy and applicable local law.

5. Cookies

The portal uses a single, strictly-necessary session cookie to keep you signed in (and an optional “Remember me” cookie if you choose it). No tracking, advertising or third-party analytics cookies are used, so no consent banner is required.

6. Acceptable use

Access is restricted to authorized personnel only. You may use the portal solely for your legitimate work duties. Do not share credentials, export data without authorization, or attempt to access data outside your remit. All administrative activity is logged. Misuse may lead to access revocation and disciplinary or legal action.

7. Your rights

Subject to GDPR you may request access, rectification, erasure, restriction or objection regarding your personal data, and may lodge a complaint with the relevant supervisory authority. To exercise these rights, contact the address in section 1.