Privacy Policy

1. DATA CONTROLLER

In compliance with Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), and Organic Law 3/2018, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), users are informed that the website https://nubyron.com/ (hereinafter, the "Website") is owned by Quevedo Tech Group, S.L. (hereinafter, "QTG"), with the following identification data:

  • Corporate Name: Quevedo Tech Group, S.L.
  • CIF (Tax ID): B-22969661
  • Registered Office: Calle Guimar, 12 – Piso 2, 35110 Santa Lucía de Tirajana (Las Palmas), Spain
  • Contact Email: rgpd@nubyron.com
  • Phone: +34 603 479 347

2. SCOPE OF THE POLICY

This Privacy Policy regulates the processing of personal data that users provide or that may be collected through the Website and the different channels associated with it, including contact forms, information requests, newsletter subscriptions, content downloads, event participation, or any other interaction with QTG.

Access and use of the Website imply knowledge and acceptance of this Policy, as well as the provisions in the Legal Notice and the Cookies Policy.

Any additional information beyond this website regarding the collection and processing of personal data is provided clearly and accessibly in each case, and is regulated in the corresponding forms, contracts, assignments, or specific conditions that may apply.

3. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA

QTG will process personal data in accordance with the principles set out in Art. 5 GDPR and applicable national regulations:

  • Lawfulness, fairness, and transparency: Each processing is covered by a valid legal basis, and you are informed about its purposes, recipients, and rights before data collection.
  • Purpose limitation: Data is collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. If the purpose changes, the data subject will be informed, and new consent will be obtained when appropriate.
  • Data minimization: Adequate, relevant, and limited data will be processed strictly necessary in relation to each purpose.
  • Accuracy: Reasonable steps will be taken to ensure data is accurate and up-to-date; channels are enabled for its rectification or update.
  • Storage limitation: Data will be kept for strictly necessary periods and, once the purposes or legal obligations are fulfilled, it will be blocked, anonymized, and/or deleted.
  • Integrity and confidentiality: QTG applies appropriate technical and organizational measures to ensure data security and prevent its alteration, loss, unauthorized processing, or access.

These principles also govern the relationship with data processors, who are subject to equivalent obligations through the corresponding data processing agreement.

4. PURPOSES OF THE PROCESSING AND BASES OF LEGITIMATION

QTG processes personal data for the purposes indicated below, with their legal basis (Art. 6 GDPR). First, we detail what data we collect and, secondly, what we use it for and with what legitimating basis according to the GDPR.

4.1. Data we collect

  • Identification and contact: name, email, phone.
  • Professional: company, job title, area/sector (when applicable).
  • Interactions and project data: location/country, available budget, project timeline, service of interest, message content, and communication preferences.
  • Web usage: Cookies, IP, and technical logs linked to the operation of the Website. You can obtain more information through our Cookies Policy.
  • Applications (HR): CV, cover letter, and professional links.

Personal data is provided directly by the interested party; technical data (IP and minimum logs) is generated by the server when using the web in accordance with the provisions of our Cookies Policy.

QTG does not process special categories of data through the Website.

The user guarantees that the data provided is true, accurate, and up-to-date, and agrees to communicate any modification.

If the User provides personal data of third parties, they declare having their authorization and agree to inform them of this Privacy Policy before communicating their data to us.

4.2. Purposes of the processing

  • I. Attention to queries and requests: We use identification, professional, and project data (incl. location, budget, timeline, and service of interest) to respond, evaluate your need, and, where appropriate, coordinate a meeting or proposal. Legal basis: pre-contractual measures/contract (Art. 6.1.b GDPR) and Consent (Art. 6.1.a GDPR) for contact. If a commercial relationship is established, the basis will be the execution of the contract and legitimate interest.
  • II. Newsletters and commercial communications: We use your contact details to send you content and news. Basis: consent (Art. 6.1.a GDPR). If you are already a customer, we may inform you about similar products or services of our own in legitimate interest, with the possibility of opting out in each shipment (Art. 6.1.f GDPR and Art. 21.2 LSSI).
  • III. Download resources: We process your data to send you the resource and conduct a limited follow-up related to that download. Basis: consent (Art. 6.1.a).
  • IV. Selection processes: We use your application data to assess your profile and contact you. Basis: pre-contractual measures (Art. 6.1.b). To keep your CV for future vacancies, we will request consent (Art. 6.1.a).
  • V. Basic segmentation in CRM: We organize declared information (contact, company/role, service of interest, and signals derived from the relationship) to keep communications updated and non-intrusive. Basis: legitimate interest with the option to object at any time (Art. 6.1.f). We do not use browsing data to segment unless there is cookie consent, in which case it is governed by the Cookies Policy.
  • VI. Security and technical operation of the Website: We process IP and minimum logs to monitor availability, prevent abuse, and protect the platform. Basis: legitimate interest (Art. 6.1.f).
  • VII. Compliance with legal obligations and defense against claims: We process what is necessary to comply with legal obligations (e.g., responding to requests from judicial authorities) and defend our rights. Basis: legal obligation (Art. 6.1.c) and legitimate interest (Art. 6.1.f).

When the basis is legitimate interest, QTG has performed the corresponding weighting to ensure that the rights and freedoms of individuals do not prevail, and you can object at any time. QTG does not execute automated decisions or profiling.

5. DATA COMMUNICATION TO THIRD PARTIES

QTG does not sell personal data. Data may be communicated only when necessary to:

  • a. Providers offering services on behalf of QTG (acting as data processors): web/CDN hosting and site platform, maintenance and security, form management and corporate email, collaboration tools and file storage, and, where appropriate, HR/candidate screening services. QTG obtains standard contractual guarantees in accordance with the GDPR with all of them and demands adequate security guarantees.
  • b. Administrations and authorities when there is a legal obligation or it is necessary to formulate, exercise, or defend claims.
  • c. Third parties of cookies and similar technologies, only if the user accepts them, according to the Cookies Policy (these third parties act as independent data controllers of those processing operations).

Apart from the above cases, QTG will not make any data communication to third parties. In the event that such communication is necessary to provide a specific service or activate a web functionality, the user will be informed about the recipients and purpose, requesting their consent when appropriate or indicating that the communication is necessary for the execution of the requested service/functionality.

6. INTERNATIONAL TRANSFERS

Generally, QTG does not perform international data transfers. However, if providing certain services requires using tools whose infrastructure is located outside the European Economic Area (for example, email or cloud storage providers), QTG will adopt the guarantees required by the GDPR, such as signing standard contractual clauses or verifying adequacy decisions by the European Commission.

7. DATA RETENTION

We keep data only for the time necessary to fulfill the purpose for which it was collected. Once fulfilled, data is blocked and kept only to address legal responsibilities during the applicable prescription periods; after that, it is deleted or anonymized.

Indicative periods by purpose:

  • Queries, support, and proposals (4.2-I): while the request is managed and, at most, 12 months since the last interaction.
  • Newsletters and commercial communications (4.2-II): while subscribed or until the user objects. Consent/objection records will be kept blocked during the periods necessary to prove compliance.
  • Download resources (4.2-III): until the delivery is completed and a related follow-up for a maximum of 12 months, unless objected to. If the user is transferred to the communication list, the periods of the previous point apply.
  • Applications – HR (4.2-IV): during the selection process; if not selected, 12 months from the close of the process or until consent is withdrawn.
  • Basic segmentation in CRM (4.2-V): while an active relationship or demonstrated interest exists; in the absence of activity, up to 12 months since the last interaction, or earlier if the user objects.
  • Security and technical operation (4.2-VI): IP and minimum logs up to 12 months. In case of security incidents, they will be kept blocked for the time essential to investigate and fulfill obligations.
  • Legal compliance and defense (4.2-VII): during the applicable prescription periods. Indicatively: 4 years tax obligations (LGT), 6 years commercial documentation (Art. 30 C. of Commerce), up to 5 years for personal actions (Art. 1964 CC), and up to 10 years in the cases provided by the AML regulations; the longest corresponding period will apply.
  • Cookies and analytics: according to the duration indicated in the Cookies Policy; your preferences/consents are kept as long as you do not modify them and the time necessary to prove their management. In any case, we will keep Cookies for a period of 1 year from the last entry to the website. After that period, QTG will request the user's consent again.

8. USERS' RIGHTS

As an interested party, you can exercise the following rights at any time:

  • Right of access: to know what personal data is being processed and for what purpose.
  • Right of rectification: to request the correction of inaccurate or incomplete data.
  • Right of erasure: to request the deletion of your data when it is no longer necessary or when you withdraw your consent.
  • Right to object: to object to the processing of your data for reasons related to your particular situation.
  • Right to restriction of processing: to request the suspension of processing in certain cases.
  • Right to data portability: to receive your data in a structured format and transmit it to another controller, when applicable.

You can exercise these rights by sending a written request, along with a copy of your ID or identification document, to:

  • Email: rgpd@nubyron.com
  • Postal Address: Calle Guimar, 12 – Piso 2, 35110 Santa Lucía de Tirajana (Las Palmas), Spain.

You can also file a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that your rights regarding data protection have been violated.

9. SECURITY MEASURES

QTG has implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, aimed at preserving the confidentiality, integrity, availability, and resilience of personal information and data, as well as preventing unauthorized access, loss, alteration, or destruction.

By way of example and not limitation, QTG applies technical and organizational controls appropriate to the risk regarding secure communications, identity and access management, information protection and encryption, continuity and backups, and logging and traceability of activities.

QTG periodically reviews and updates its policies and controls to keep them aligned with identified risks and technological and regulatory evolution, and requires its providers to apply equivalent measures through the corresponding data processing agreements.

10. MINORS

This website is not directed to minors. In the event that QTG becomes aware that personal data of a minor has been collected without authorization, it will proceed to its immediate deletion.

11. CHANGES TO THE PRIVACY POLICY

QTG may modify this Privacy Policy to adapt it to legal requirements, changes in processing, service improvements, or internal criteria. When there are relevant changes, we will communicate them through the Website and, where appropriate, through direct channels, indicating the effective date.

The new version will be applicable from its publication. If changes imply new purposes or legal bases requiring User consent, QTG will request it before applying such changes.

LAST UPDATED OCTOBER 1, 2025