Data controller
Quevedo Tech Group, S.L. is the controller of personal data processed through nubyron.com. You can contact us at rgpd@nubyron.com or at our registered address.
Scope and applicable principles
This policy applies to data provided or generated through nubyron.com and its associated channels: enquiries, professional communications, contracts, applications and relationships with clients, suppliers or partners. It is supplemented by specific notices in forms, proposals or contracts.
We process data under Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and other applicable rules.
- Lawfulness, fairness and transparency: each processing activity has a legal basis and is explained clearly.
- Purpose limitation: we use data for specified, explicit and legitimate purposes.
- Data minimisation and accuracy: we request only adequate information and seek to keep it up to date.
- Storage limitation: we do not retain data longer than necessary.
- Integrity, confidentiality and accountability: we apply proportionate controls and review compliance.
Data we process
We process the data you provide when contacting us, requesting information or applying for a position. The form sends your details to our server and uses Resend to deliver your enquiry to our team and send you a confirmation. We use Cloudflare Turnstile to verify requests and prevent automated submissions. Enquiries are retained in email services and each submitted enquiry is also recorded in our CRM, Odoo (Odoo SA), to manage the request and follow-up. An enquiry or job application does not subscribe you to advertising lists.
- Identity and contact details, such as your name, email and phone number.
- Professional, business or technical information included in an enquiry.
- CV, experience, professional profile and other information included in a job application.
- Minimum technical data generated when serving the site, such as server security logs.
- Financial, billing and transaction data where a contractual relationship exists.
- Communications, stated preferences and documents needed to provide or assess a service.
Source and required information
We normally obtain data directly from you or the organisation you represent. It may also come from someone referring an opportunity, public professional sources, or providers and partners where there is a legitimate basis. We will disclose the source where required by law.
Required information allows us to process or answer a request. Without it, we may be unable to reply, prepare a proposal, formalise a service or assess an application. Do not include sensitive categories that are not necessary.
Purposes and legal bases
- Answering enquiries and preparing proposals: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
- Managing contracted services: performance of a contract and compliance with legal obligations.
- Managing applications: consent and, where applicable, steps prior to a possible employment relationship.
- Protecting the website and preventing misuse: our legitimate interest in maintaining service security and availability.
- Managing supplier and partner relationships: contract performance, pre-contract steps and legitimate interest in organising the professional relationship.
- Meeting accounting, tax, employment or regulatory duties: compliance with a legal obligation.
- Sending replies to enquiries and operational communications needed to manage your request or service. We currently do not send advertising campaigns. Acceptance of the form is limited to handling the request and does not authorise advertising.
Production traffic light
You can complete the self-assessment and see the result without providing personal details. Answers and context are temporarily saved in your browser’s sessionStorage so you can continue during the same session. They are not sent to the server until you request the one-pager.
If you request the one-pager, we receive your fifteen answers, selected cloud, team size and spend range, together with your name, email, company, role and phone number if provided. We calculate the result, deliver the report on screen and by email and record the request and summary in Odoo. The team may contact you to discuss that result as described in the form’s checkbox. We do not subscribe you to advertising campaigns.
The summary uses fixed rules to order signals and priorities. It also guides internal follow-up using the result, spend, team size and email type; the team reviews context before proposing work. You can ask us to stop contacting you or withdraw your consent by writing to rgpd@nubyron.com. The retention periods and providers described in this policy also apply to these requests.
Automated decisions and profiling
The traffic light calculates results and guides internal follow-up using the rules described above. It does not automatically decide on contracts, prices or project acceptance; the team reviews those decisions with you.
Recipients and providers
We do not sell or disclose personal data for commercial purposes. Providers helping us with hosting, email, communications or support may access it under confidentiality and data protection obligations.
We may also disclose data where required by law, requested by a competent authority, or necessary to establish, exercise or defend legal claims.
- Hosting, infrastructure, email and communication providers, including Resend for email delivery, Cloudflare Turnstile for spam protection and Odoo CRM for enquiry management.
- Advisers, auditors, financial institutions and professionals bound by confidentiality.
- Public authorities, courts and law enforcement where legally required.
- Authorised technical collaborators where needed for the contracted service.
International transfers
To run the website and handle your enquiries we use providers established in the United States that may process data outside the European Economic Area: Vercel Inc. (hosting and, with your consent, analytics and performance measurement), Plus Five Five, Inc. (Resend, email delivery) and Cloudflare, Inc. (Turnstile anti-spam verification). These transfers rely on the GDPR safeguards set out in their data processing agreements, such as the Standard Contractual Clauses approved by the European Commission or, where applicable, the EU-US Data Privacy Framework, together with any necessary supplementary measures. Our CRM is provided by Odoo S.A., based in Belgium; if any of its services involved a transfer outside the EEA, we would apply the same safeguards. You can request information about these safeguards at rgpd@nubyron.com.
Retention periods
We retain data for as long as needed for its purpose and then for any period required to meet legal obligations or potential liabilities. Enquiries that do not lead to a contractual relationship are normally reviewed and deleted within 12 months. Applications are retained during the selection process and, with permission, for up to 12 months for future opportunities.
- Contracts and billing: during the relationship and applicable statutory retention and limitation periods.
- Enquiries and unaccepted proposals: normally up to 12 months after the last interaction.
- Applications: during the process and for up to 12 additional months where appropriate and authorised.
- Technical logs: the minimum period needed to prevent, investigate and document incidents.
- Where a legal duty or claim requires retention, information may be restricted and used only for that purpose.
Your rights
You may request access, rectification, erasure, objection, restriction and portability, and withdraw consent without affecting prior lawful processing. Write to rgpd@nubyron.com and state the right you wish to exercise. We will only request additional information to verify your identity where reasonable doubts exist.
- If you believe processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es).
- Exercising your rights is free. We normally respond within one month; where requests are complex or numerous, the period may be extended by two further months and we will tell you within the first month.
- You may act directly or through a representative. If we do not act on the request, we will explain why and identify the available complaint routes.
- You may also object to automated individual decisions, although we do not currently carry out this type of processing.
Security measures
We apply reasonable technical and organisational measures to preserve the confidentiality, integrity and availability of information, reviewing them as risks and services evolve.
These measures may include access control, strong authentication, encryption where appropriate, backups, activity logging, vulnerability management, confidentiality and incident response.
No internet-connected system can guarantee absolute security. If a breach poses a risk to individuals, we will assess it and notify the authority or affected people where required.
Children
Our professional services are not aimed at children under 14 and we do not knowingly request their data. Anyone below that age must not provide information without a legal guardian’s authorisation. If we identify improper collection, we will delete the data as soon as possible.
Changes to this policy
We will update this policy when our processing, providers or applicable obligations change. The current version and update date will always be available on this page.