This policy provides the information required by Articles 12, 13 and 14 of Regulation (EU) 2016/679, Spanish Organic Law 3/2018 and other applicable Spanish rules. It covers bcnnexo.com and NEXO services involving residence, relocation, document coordination and property transactions.
1. Data controller
NEXO GLOBAL ADVISORY, S.L.
NIF: B88983820
Address: Calle Vilamarí 60, local 2, 08015 Barcelona, Spain
Telephone and WhatsApp: +34 613 625 197
Privacy contact: victoriabarcelona1989@hotmail.com
Unless stated otherwise before a specific processing activity, NEXO is the controller. A lawyer, graduado social, tax adviser, notary, property agent or other professional may act as an independent controller where that professional determines the purposes and means of their work. Where required, we will identify that professional and their role before disclosing data.
2. Data we may process and its sources
- Identity and contact details, including name, telephone, email, language and address.
- Residence, nationality, family, employment, education, housing, assets, income and tax information needed for the requested service.
- Identity documents, authorities, certificates, contracts, supporting evidence, administrative files and property documents once their review has been agreed.
- Payment, accounting and fraud-prevention information.
- Data relating to children or family members supplied by their representative.
- Special-category data and criminal-offence data only where necessary, supported by an appropriate legal basis and restricted to an authorised professional.
- Technical security data, such as IP address, date, device, browser and server logs.
Data may come from you, your representative, a family member with proven authority, a professional selected for the service, a public authority or register, or a publicly available source where consultation is lawful.
3. Purposes and legal bases
| Purpose | Legal basis | Typical data |
|---|---|---|
| Replying to an enquiry and preparing a proposal | Pre-contractual steps requested by you, Article 6(1)(b) GDPR. | Contact details and description of your situation. |
| Residence, relocation, document or property support | Performance of a contract; legal obligations; legitimate interest in establishing or defending rights. | Necessary client and family information. |
| Billing, accounting and tax compliance | Legal obligation, Article 6(1)(c). | Identity, invoices, payments and tax data. |
| Coordinating selected professionals | Performance of the service; consent for optional disclosure; legal obligation where applicable. | Only the information needed for the requested work. |
| Health and other special-category data | An applicable condition under Article 9(2), particularly the establishment, exercise or defence of legal claims, or explicit consent where valid and necessary. | The minimum necessary for the matter. |
| Criminal convictions and offences | Article 10 GDPR and Article 10 LOPDGDD; where applicable, processing by lawyers in the performance of their duties. | Only necessary certificates or decisions. |
| Security, fraud prevention and defence of claims | Legitimate interest, Article 6(1)(f). | Communications, evidence and technical logs. |
| Recruitment | Pre-contractual steps for a current vacancy; consent for future opportunities. | CV, experience and contact details. |
| Marketing information | Separate consent or an existing relationship where the law permits. | Contact details and preferences. |
NEXO does not sell personal data. Consent is not used as a general basis where processing is needed for a contract or legal obligation. Withdrawal does not affect processing carried out lawfully before withdrawal.
4. Forms, questionnaires and WhatsApp
Website questionnaires run in your browser and do not send answers automatically. Selecting WhatsApp prepares a message on your device. You may edit it and decide whether to send it. Once sent, WhatsApp processes the message under its own privacy terms and NEXO receives it in its account.
Do not send passwords, verification codes or sensitive documents through public forms. Documents will be requested after the service and a suitable channel have been agreed.
5. Children and other people's data
The services are not directed to children. Where a matter concerns children or relatives, the person providing the data must have authority to represent them or disclose the information. NEXO may take reasonable steps to verify that authority and will provide further information where Article 14 GDPR applies.
6. Recipients
Where necessary, data may be accessed by authorised NEXO personnel; lawyers, graduados sociales, tax advisers, translators and technical specialists; public authorities, consulates, police, registers, notaries, courts and financial institutions; property and service professionals chosen by the client; and providers of web hosting, email, storage, backups and technical support.
Providers acting for NEXO are bound by an Article 28 processing agreement. Independent professionals and platforms chosen by the user may be separate controllers. Data will not be disclosed to an optional partner without prior information about the purpose and applicable legal basis.
7. International transfers
Some technology providers or communication platforms may process data outside the European Economic Area. Where an international transfer occurs, NEXO will rely on an adequacy decision, standard contractual clauses, binding corporate rules or another safeguard allowed by Chapter V GDPR. You may request information about the relevant safeguard.
8. Retention periods
- Enquiries without engagement: up to 12 months after the last contact, unless evidence is required for a potential claim.
- Clients and files: for the relationship and then in blocked form for applicable limitation and liability periods.
- Accounting and tax documents: for applicable commercial and tax periods, normally 6 and 4 years respectively, without prejudice to longer mandatory periods.
- Anti-money laundering: where the specific activity is subject to Law 10/2010, required records are retained for 10 years.
- CVs: for the open process and up to 12 months for future opportunities only with consent.
- Marketing: until consent is withdrawn or an objection is made, with necessary evidence blocked for the liability period.
- Technical logs: for the provider's period and as needed for security and incident investigation.
At the end of the period, data will be erased or anonymised. Where the law requires blocking, it will only remain available to authorities, courts or for legal liability.
9. Your rights
You may request access, rectification, erasure, restriction, objection and portability, and may withdraw consent. Send your request to the email or postal address above and identify the right concerned. Additional proof of identity will only be requested where there are reasonable doubts. We will respond within one month, subject to the extensions allowed by GDPR.
You may also complain to the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid.
10. Security and confidentiality
NEXO applies measures proportionate to risk, including access controls, confidentiality duties, minimisation, backups, system updates and incident procedures. No system is entirely infallible. Where a breach creates the risk described in Articles 33 and 34 GDPR, NEXO will notify the authority and, where required, affected individuals.
11. Browsing, local storage and cookies
The site currently uses no advertising analytics or commercial profiling. It may store your language preference and progress in some tools on your device. The hosting provider may create technical logs to deliver and protect the site. See the Cookie policy.
12. Automated decisions
NEXO does not make decisions producing legal effects solely by automated means. Questionnaire results provide general orientation and do not replace professional assessment.
13. Changes and governing version
The policy will be reviewed when services, providers or applicable rules change. Material changes will be published before they apply where required. The Spanish version is the interpretative reference, without limiting any mandatory rights available to the individual.