Privacy Policy
This is a courtesy translation. In the event of any discrepancy, the Spanish version prevails.
At Nexo we are committed to protecting your privacy. This policy explains how we collect and process your personal data in accordance with the General Data Protection Regulation (GDPR) and the Spanish Organic Law on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).
1. Identity of the Data Controller
For Providers' data (users with an account), the Data Controller is Nexo (see contact details in the Legal Notice).
Important note: For the data of end Clients who book through the platform, the Provider receiving the booking acts as the Data Controller. In those cases Nexo acts solely as Data Processor, supplying the technical infrastructure.
2. Data Collected, Purpose and Lawful Basis
A. Providers' data (users with a Nexo account)
| Purpose | Lawful basis (GDPR) | Data processed |
|---|---|---|
| Account creation and authentication | Performance of a contract | Email, password, name. |
| Provision of the booking management service | Performance of a contract | Title, biography, availability, profile images, Bizum phone number, iCal token. |
| Storage of client records | Legitimate interest / Performance of a contract | Client data (Nexo acting as Processor). |
| Billing and plan management | Performance of a contract | Plan status, email. |
B. End Clients' data (users of the public booking page)
| Purpose | Lawful basis (GDPR) | Data processed |
|---|---|---|
| Creating and managing the booking | Legitimate interest of the Provider | Name, phone number, (email optional). |
| Tracking payment and pass status | Legitimate interest of the Provider | Wallet balance, payment status. |
3. Data Retention
- Providers' data: retained for as long as the account remains active. If deletion is requested (via the admin panel), the data is permanently erased from our systems.
- Clients' data: retained for as long as the Provider's account is active, or until the Provider (as Controller) decides to delete it.
- Transactional data: retained, duly blocked, for a minimum of 6 years in order to comply with legal and accounting obligations (Spanish Commercial Code).
4. Usage Analytics
We measure how the application is used with our own system, hosted in our own database. We do not use Google Analytics or any third-party analytics service, and this data is not shared with anyone.
- No cookies and no persistent identifiers. No cookie is stored, no data is kept in the browser, and no fingerprinting is performed. For this reason no consent banner is required for this purpose.
- Your IP address is not retained. It is held in memory for a few seconds to limit the number of requests per minute, and is never stored. The only thing derived from it is the two-letter country code supplied by our hosting provider (for example
ES), which is stored. - To group the actions of a single visit, a random identifier is generated that lives only in the browser's memory and disappears when the tab is closed. It is not derived from your IP address, your browser or any other data of yours, so it cannot be linked to any individual. Each later visit generates a new one.
- What is recorded: the page visited (without identifiers: for example
/admin/clients/:id, never the real client identifier), the domain you arrived from (the domain only, never the full address), the device type (mobile, tablet or desktop), the country, the language, whether the visitor is a guest, a client or a provider, whose provider page was being viewed, the application version, and aggregated actions such as "booking started" or "registration completed". - Retention: these records are deleted automatically after 90 days.
- Lawful basis: legitimate interest (art. 6(1)(f) GDPR) in improving and maintaining the service, given that the data is aggregated and non-identifying.
5. Third Parties and International Transfers
To provide the service, Nexo relies on technology providers acting as sub-processors:
- Supabase: Database, storage and authentication (servers in the EU – Frankfurt).
- Cloudflare: Bot prevention (Turnstile). Global network.
- Netlify: Web hosting and functions (USA – covered by the Data Privacy Framework or Standard Contractual Clauses).
Typefaces are served from our own domain. No request is made to Google Fonts, or to any other external font service, when these pages load.
6. Exercising Your Rights
You have the right to obtain confirmation as to whether Nexo is processing your personal data. You may exercise your rights of access, rectification, erasure, restriction, portability and objection by contacting [legal email address].
End clients must contact the Provider with whom they made the booking directly in order to exercise their rights. You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe the processing does not comply with applicable law.