Privacy notice
How NXT Ltd uses personal data across Lite Group Media, Lite News, customer feeds, checkout, and enquiries.
Version 2.1 · Last updated 16 August 2026.
Privacy at a glance
We collect the information needed to operate and secure the sites and feeds, understand aggregate usage, process subscriptions, and answer enquiries. We do not sell personal data or use it for behavioural advertising.
NXT Ltd is the data controller. You can make a privacy request through the contact form or write to our registered office.
Jump to key sections
1. Controller and scope
NXT Ltd is a company registered in England and Wales under number 08817847 and VAT number GB 248 7977 38. Its registered office is 71–75 Shelton Street, London, England, WC2H 9JQ. NXT Ltd is the controller of personal data described in this notice. Lite Group Media is a trading name and Lite News is a product of NXT Ltd.
This notice covers litegroup.media, litenews.litegroup.media, public and licensed feeds, subscription administration, website analytics, and messages sent through our contact forms. It does not govern websites operated by customers who republish Lite News content.
2. Personal data we collect
- Contact data: name, email address, organisation, subject, message, and correspondence when you contact us.
- Customer data: purchaser and organisation details, plan, licence scope, feed credentials issued, account status, and service communications.
- Payment data: Stripe processes card and payment details. We receive transaction status, billing identity and contact details, invoice information, and limited payment metadata rather than full card numbers.
- Technical and security data: IP address, request time, URL, user agent, device or browser information, referral source, and security events generated by websites, feeds, hosting, and access controls.
- Licensed-feed data: credential or licence-key identifier, requesting IP address, request time, feed requested, response status, and request frequency.
- Website analytics data: page views, navigation, approximate location derived from IP, device information, and aggregate website performance or usage measurements. Google Analytics is not used in public or licensed feeds.
You do not have to provide contact or customer data, but we may be unable to answer an enquiry or supply a subscription without it. Please do not send sensitive personal data unless it is necessary.
3. Purposes and lawful bases
| Purpose | UK GDPR basis |
|---|---|
| Answer enquiries and take steps requested before purchase | Contract or legitimate interests in responding and developing customer relationships |
| Supply feeds, administer licences, billing, support, and cancellation | Contract |
| Maintain accounting, tax, compliance, and rights records | Legal obligation and legitimate interests in establishing or defending legal claims |
| Secure services, prevent abuse, enforce limits, and investigate incidents | Legitimate interests in protecting our service, content, and customers |
| Measure and improve use of our marketing website through Google Analytics | Consent where analytics uses non-essential cookies or similar access to a device |
| Operate and secure websites and feeds, diagnose faults, and understand service demand from routine access logs | Legitimate interests in reliable, secure service operation |
| Comply with lawful requests and exercise or defend legal rights | Legal obligation or legitimate interests |
Where we rely on legitimate interests, we consider necessity, proportionality, and the effect on individuals. You may object to this processing as explained below.
4. Cookies and analytics
The marketing website uses Google Analytics to understand aggregate use and improve the site. Google Analytics is not used in the public or licensed feeds. Routine website and feed-access logs used for operation and security are separate from Google Analytics.
CookieYes manages choices for non-essential cookies. Google Analytics must remain disabled until you consent to analytics cookies or similar device access. You can change or withdraw that choice through the cookie settings control. Browser controls can also block or delete cookies, although doing so may affect essential functions. We do not use analytics data for behavioural advertising.
5. Recipients and service providers
We disclose personal data only where needed to:
- Stripe, which processes checkout, recurring payments, invoices, and the billing portal;
- Amazon Web Services and related hosting or delivery providers, which host sites, APIs, logs, and contact-form infrastructure;
- Google, which provides Google Analytics for the marketing website under our configuration;
- CookieYes, which records and manages website cookie choices;
- professional advisers, insurers, auditors, or authorities where reasonably necessary; and
- a purchaser or successor if the relevant business or assets are reorganised or sold, subject to appropriate protections.
We do not sell personal data. Providers acting for us are required to protect it and use it only for the agreed service, subject to their independent legal obligations.
6. International transfers
Some providers may process data outside the UK. Where the destination is not covered by UK adequacy regulations, we use an approved safeguard such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism, together with supplementary measures where appropriate. Contact us if you would like information about the safeguard relevant to your data.
7. Retention
Routine technical and feed-access logs: normally 90 days.
- Analytics identifiers and event-level data: no more than 14 months; aggregate reports may be retained longer where they no longer identify an individual.
- Unsuccessful enquiries and related correspondence: normally 24 months after the enquiry is closed.
- Customer, contract, licence, payment, and invoice records: normally six years after the customer relationship ends.
- Correction, complaint, fraud, security-incident, or legal-claim records: for as long as reasonably required to investigate, comply with law, or establish, exercise, or defend claims.
We may keep data longer where law requires it, a dispute is continuing, or deletion would prejudice security or legal rights. We delete or anonymise it when the applicable period ends.
8. Security
We use proportionate technical and organisational measures designed to protect personal data, including access controls, restricted credentials, service logging, and trusted infrastructure providers. No internet service can guarantee absolute security.
9. Your rights
Depending on the circumstances, UK data protection law gives you rights to access, correct, erase, restrict, or receive your personal data, and to object to processing or withdraw consent. Rights are not absolute and depend on the lawful basis and context.
Your right to object: where we rely on legitimate interests, you may object based on your particular situation. You may always object to direct marketing; we do not currently use the data described here for direct marketing.
Submit a request through the privacy request form or write to the registered office. We may verify identity and normally respond within one month. You may complain to the Information Commissioner’s Office, although we would appreciate the opportunity to address your concern first.
10. Children and changes
The services are not directed at children and we do not knowingly collect children’s personal data. We may update this notice when services or legal requirements change. Material changes will be highlighted appropriately and the version date will be updated.