Legal Notice, Privacy & Cookies

1. Legal notice: site owner

In compliance with Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), the owner of this website is:

• Owner: Matias Alvaro Quiriquino el Ashuh, sole trader, operating under the NEXVYLIA brand.
• Tax ID (NIF): 76586830G.
• Address: Calle América, Urb. Triana 42, 11204 Algeciras (Cádiz), Spain.
• Contact email: matias@nexvylia.es · phone 633 16 94 65.
• Activity: custom software development, digitalisation, process automation and applied AI for businesses.

Accessing and using this site grants you the status of user and implies acceptance of this legal notice. The site contents (texts, logos, designs and own images) are owned by NEXVYLIA or used with permission and may not be reproduced without consent. The owner is not responsible for the content of linked third-party sites. This notice is governed by Spanish law.

2. Data controller

The controller of the data collected through this site is the owner identified above: Matias Alvaro Quiriquino el Ashuh (NIF 76586830G), NEXVYLIA brand. For anything regarding your data, contact matias@nexvylia.es.

3. What data we collect

We only collect the data you voluntarily provide and the minimum needed for the site to work:

• Project request: trade or company name, contact person, email, phone and whatever information about your business and what you want to solve you choose to include. This data is stored even if you do not complete account registration, so we can handle your request.
• Appointment or call booking: name, email and phone, so we can call you on the day and time you choose and prepare a proposal. This data is stored even if you do not create an account.
• Customer account: name, email and password (always stored encrypted, never in plain text).
• Email verification: a temporary code sent to your email to confirm your identity.
• Sign-in with Google: if you choose to sign in with your Google account, we receive your Google name and email address to create or identify your account. We do not access anything else in your account.
• Free SEO check: the address of the website you want checked, the result, a pseudonymised summary of your IP address (keyed, we do not store the IP itself) and your browser, to prevent abuse of the service.
• Invitations to a business: if a client invites you to view their business in the client area, we process the email address they give us to send you the invitation. If you do not accept it, it expires after 14 days.
• WhatsApp: if you message us on WhatsApp, we process your number and what you tell us to assist you. WhatsApp is a Meta service with its own privacy policy.
• Technical data: the date of your last sign-in and the strictly technical data tied to the session and site security.
• Billing and contracting data: if you hire a project or the maintenance service, we also process your name or company name, tax ID (NIF/CIF), fiscal address, the details of the contracted service and your invoice and payment history.

4. What we use it for

We use your data only to:

• Handle your project request and prepare a proposal or quote.
• Call you and handle the appointment you book, and send the reminder the day before.
• Contact you, by phone or email, to follow up on your request or appointment. We will not send you advertising by email unless you are a customer or have asked for it, and you can object at any time.
• Create and manage your customer account and, where applicable, invoicing for contracted projects.
• Manage the collection of contracted services (including maintenance subscriptions), issue the corresponding invoices and comply with our tax and accounting obligations.
• Only if you tick the optional offers box: send you offers, discounts and news from NEXVYLIA by email or WhatsApp. Not ticking it changes nothing about what you ask us for, and every message includes an unsubscribe link.
• Keep the site secure and prevent fraudulent use.

We do not carry out advertising profiling, nor do we sell or share your data with third parties for commercial purposes.

5. Legal basis

Quote requests, appointments and accounts: steps taken at your request prior to entering into a contract and, if you hire us, performance of the contract (art. 6.1.b GDPR). Invoicing: compliance with legal tax and accounting obligations (art. 6.1.c). Analytics cookies: your consent, which you can withdraw under «Cookie settings» (art. 6.1.a). Offers and discounts: your consent when you tick the optional box (art. 6.1.a GDPR and art. 21 LSSI), which you can withdraw with the unsubscribe link in every message or by writing to us. Site security and abuse prevention, and our own cookie-free visit counter: legitimate interest (art. 6.1.f). Invitations to a business: legitimate interest of the inviting client (art. 6.1.f). WhatsApp and SEO check: handling what you ask us for (art. 6.1.b). The fields marked as mandatory in each form are needed to handle your request; if you do not provide them, we cannot process it.

6. How long we keep it

We keep quote request data that does not lead to a contract for a maximum of 24 months from our last contact with you; after that period we delete or anonymise it. If you become a customer, your data is kept for as long as the contractual relationship lasts and, afterwards, for the period needed to handle any potential liabilities. Billing data (invoices, tax ID, fiscal address and payments) is kept for the periods required by law: at least 4 years for tax purposes (Spanish General Tax Law) and 6 years for commercial purposes (Spanish Commercial Code); during those periods it cannot be deleted on request, only blocked. For all other data you can request deletion at any time as set out below. Your client account is kept until you ask us to erase it; SEO check records, 12 months; invitations not accepted expire after 14 days. Permission to send you offers is kept until you unsubscribe; once you do, we stop writing and keep only a record of the unsubscription and of the consent you gave, so that we can prove it.

7. If we contacted you first

This section is not aimed at people using this website, but at the professional firms we approach with a commercial proposal on our own initiative. If you got here from one of our emails and had never heard of us, this is what you should know.

Where we got your address: from publicly accessible sources — professional directories and the legal notice or contact page of your own website. We do not buy databases and nobody passes them on to us.

What we process: the firm name, sector, city, phone number, website and a generic mailbox such as info@ or contact@. We only write to mailboxes of that kind, never to addresses bearing a specific person's name.

Legal basis for processing your address: our legitimate interest in making a service related to your professional activity known (art. 6.1.f GDPR), weighed in writing against your rights; we can share that assessment on request. We only write once, to generic mailboxes, identifying ourselves and marking the subject as advertising (art. 20 LSSI). If you prefer not to receive anything, reply «unsubscribe» and we will not write again.

How long we keep it: twelve months from the last contact if there is no reply, after which we delete it. If you ask us not to write again, we keep only your address on an exclusion list indefinitely, as that is the only way to guarantee you receive nothing further from us.

How to stop this: reply "baja" (unsubscribe) to any of our emails. It is recorded and we will not write to you again. You may also exercise the other rights described below.

Our email carries no open-tracking pixels or tracking links. The only thing we record is whether the proposal page we sent you is visited (how many times and the date of the first visit), so we know it reached you and do not insist. We do not build profiles about you and we do not share your data with anyone.

8. Cookies

This site uses technical and preference cookies, needed for it to work and to remember your language, and — only if you accept them in the cookie notice — Google Analytics 4 analytics cookies (Google Ireland Ltd.) to measure, in aggregate, which pages are visited. If you do not accept, no Google cookie is set. We do not use advertising cookies.

In addition, to know how many people visit the site and where they come from, we use our own counter that sets no cookies and does not store your IP address: it records the page, the site you came from (for example, Google or Instagram), the type of device and whether you click a contact button. So as not to count the same person twice on the same day, an encrypted fingerprint is calculated from the IP and the browser; it changes every day and is deleted after 48 hours, never leaves our server and is not shared with anyone. Legal basis: our legitimate interest in knowing the aggregate use of the site (art. 6.1.f GDPR). Aggregated data is deleted after 25 months. If your browser sends the Global Privacy Control signal, your visit is not counted.

You can block or delete these cookies from your browser settings, but some features such as signing in or language may stop working correctly.

9. Providers, payments and transfers

To deliver the service we rely on technology providers acting as data processors (or as independent controllers, in the case of the payment gateway) that only access the data needed for their function:

• Web hosting and email: the site, its database and service emails (verifications, quotes, invoices and communications, sent from our own domain) are hosted on our hosting provider's servers (Hostinger International Ltd.) within the European Economic Area, including its backups.
• Tax advisors: billing documents (issued and received invoices) may be forwarded to our tax advisory firm for bookkeeping and tax filings.
• Payments and subscriptions: charges (including maintenance fees) are processed through Stripe Payments Europe, Ltd. (Ireland). You provide your card details directly to Stripe on its secure gateway and they are never stored on our systems; we only receive the payment confirmation and the identifying details of the transaction. Stripe may transfer data to its parent company in the United States under the EU-US Data Privacy Framework and Standard Contractual Clauses approved by the European Commission. More information at stripe.com/privacy.
• Google: Google Analytics 4 (only if you accept analytics cookies) and sign-in with Google (only if you choose it) are provided by Google Ireland Ltd. Google may transfer data to the US under the EU-US Data Privacy Framework (European Commission adequacy decision).
• AI-assisted quote drafts: to prepare the first draft of your quote we send OpenAI (OpenAI Ireland Ltd.) the description of your business and of what you need from your request, without your email or phone number. OpenAI acts as a data processor under its data processing agreement, does not use that data to train its models and may process it in the US with the safeguards of Art. 46 GDPR (European Commission Standard Contractual Clauses). The final quote is always reviewed and signed by a person.
• Tax administration: billing data may be disclosed to the Spanish Tax Agency (AEAT) where required by law, including the submission of invoicing records under the VERI*FACTU system.

Beyond the above we do not carry out international data transfers outside the European Economic Area, and where a provider involves them they will always take place with the safeguards required by law (adequacy decisions or Standard Contractual Clauses).

10. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, as well as withdraw the consent you have given. To do so, email us stating the right you wish to exercise. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if you believe we have not handled your request properly.

11. Security

We apply reasonable technical and organisational measures to protect your data: encrypted connection (HTTPS), encrypted password storage, access control to the internal panel and email verification. No system is infallible, but we work to minimise any risk.

12. Minors

This site and the client area are intended for businesses, professionals and people over 18. We do not knowingly collect data from children under 14 (art. 7 of the Spanish LOPDGDD). If we find that a minor has given us data, we will delete it; if you are a parent or guardian and think this has happened, contact us.

13. Contact

For any question about this policy or the processing of your data, you can write to us via the NEXVYLIA contact email. We will update this page whenever the way we process data or the cookies we use changes.