Privacy PolicyAt NEGOCIOS ALTERNATIVOS BC NEXUS, S.L. (Nexus Business Center), as data controller, we protect your privacy and personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights Guarantee (LOPDGDD). This policy explains what data we process, where it comes from, why, on what legal basis and how you can exercise your rights.
We process only the data needed for each purpose. Depending on the channel, this may include:
✓Identity and contact data: name, email, phone, company, role
✓Data submitted via website forms (enquiry, visit, partner) and free-text messages you send
✓Professional contact data obtained from public sources where applicable (see §3)
✓Client/contract data: tax ID (CIF/NIF), tax or commercial address, billing details and IBAN or other payment details when required for the contract
✓Website usage and advertising data: online identifiers and analytics/ads metrics only if you accept the relevant cookies
✓Image (CCTV) on the premises when cameras are in operation
3. Source of the data (GDPR Arts. 13 and 14)
In most cases data comes from you (forms, email, visit or contract). When we contact B2B professionals (for example accountancy firms) using data obtained indirectly, the usual source is the corporate website, a professional directory or a public profile, always with manual enrichment and a verifiable URL. The first communication states: controller identity, source, purpose, legal basis, rights and how to object. Categories: professional contact data. We do not use mass scraping or purchased lists.
4. Purposes of processing
We process personal data for the following purposes:
✓Managing and responding to information, visit or quote requests
✓Managing interest in the accountancy partner programme
✓Entering into and performing the contractual relationship (registered address, coworking, offices, meeting rooms or other services)
✓Sending commercial emails only with express consent (optional checkbox, unchecked by default)
✓Audience measurement (Google Analytics 4) and, where applicable, advertising/remarketing (Google Ads), only with the relevant cookie/ads consent
✓Maintaining suppression lists so we do not re-contact after opt-out
✓Protecting people and property on the premises through CCTV
✓Complying with legal obligations (tax, accounting, corporate or other applicable duties)
5. Legal bases
Depending on the purpose, the legal basis may be:
✓Consent (Art. 6.1.a GDPR): forms and, specifically, commercial email and non-essential cookies / Ads
✓Performance of a contract or pre-contractual steps (Art. 6.1.b GDPR): quotes, onboarding and service delivery
✓Legitimate interest (Art. 6.1.f GDPR): answering enquiries; premises security (CCTV); and, for B2B professional contact data, Art. 6.1.f GDPR with Spanish LOPDGDD Art. 19. Legitimate interest alone does not replace the consent required by the Spanish LSSI (Art. 21) to send commercial email
6. Retention periods
We apply the following indicative criteria (subject to periodic review and longer retention if a claim or law requires it):
✓Website leads/enquiries without a contract: until we handle the request and at most 12 months without relevant interaction
✓Commercial communications: until you withdraw consent or object (BAJA/STOP / unsubscribe page)
✓Opt-out / objection records: as long as needed to evidence that we respect your objection
✓Contracts, invoicing and accounting/tax duties: up to 6 years (Spanish Commercial Code Art. 30 and tax rules)
✓General civil claims where applicable: up to 5 years (Spanish Civil Code Art. 1964)
✓CCTV: as a rule 30 days, unless footage must be kept to investigate an offence
7. Recipients and processors
We do not sell your data. Processors may access it under contract solely to provide services to us:
✓Hostinger: web hosting and email
✓Supabase: consent, outreach contacts and opt-out records
✓Google Ireland / Google LLC: Google Analytics 4 and, if you accept advertising, Google Ads / related tags
✓Payment, courier or external advisory providers when needed to perform the contract or a legal duty
8. International transfers
We do not transfer data outside the EEA without appropriate safeguards. Google services may involve transfers to the United States covered by the EU-U.S. Data Privacy Framework, to which Google LLC is certified, or other GDPR-recognised safeguards.
9. CCTV
Security cameras may operate on the premises to protect people, property and facilities. The legal basis is legitimate interest (Art. 6.1.f GDPR). Visible notices will be displayed at entrances when cameras are active. Footage is kept for the period in §6 unless needed for an investigation. You may exercise rights regarding CCTV images via the channels in §12.
10. Social media
If Nexus maintains social-media profiles, it acts as controller of followers’, comments’ and interactions’ data on those profiles, to share updates and handle enquiries to the extent each platform allows. The usual basis is consent or your voluntary engagement with the network. We do not mass-extract social-media data for prospecting without express authorisation. Each network’s own policies also apply.
11. Accuracy of the data
By providing data you confirm it is true, accurate and up to date, and you agree to tell us of any changes. You are responsible for inaccuracy or falsity of the data you supply and for any harm this may cause Nexus or third parties.
12. Data subject rights
You may exercise access, rectification, erasure, objection, restriction and portability, and withdraw consent where consent is the basis, by emailing info@nexusbcenter.com or ismael.alcalde@nexusbcenter.com with the subject ‘Data Protection’. We reply within one month (extendable by two months for complex cases, with prior notice). We only request additional identity information where doubts are reasonable. To object to commercial emails: reply BAJA/STOP or use https://nexusbcenter.com/en/unsubscribe.
✓Right of access
✓Right of rectification
✓Right of erasure
✓Right of objection
✓Right of restriction
✓Right of portability
✓Right to withdraw consent without affecting prior lawful processing
13. Complaints to the supervisory authority
If you believe we have not processed your data correctly, you may complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, or at www.aepd.es.
14. Security measures
We apply appropriate technical and organisational measures to protect data against alteration, loss, unauthorised processing or access (including HTTPS/SSL on the website and restricted system access). Forms and sensitive records are handled on systems limited to authorised staff or processors.
15. Minors
Services and forms are aimed at professionals and businesses. We do not knowingly collect data from children under 14. Contracting is intended for adults (18+) or authorised representatives of legal entities. If we detected a minor’s data without authorisation, we would delete it promptly.
16. Changes to this policy
We may update this policy for legal or business changes. The latest update date appears at the top of the page; we recommend reviewing it periodically.
