Privacy policy

1. Data controller

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and digital rights (LOPDGDD), we inform you that the controller of your data is:

2. Data we process

We process the data you provide through the website forms or by direct communication:

• Identification data: name, company.
• Contact data: email, phone.
• Content of your message or query.
• Browsing data (see Cookie policy).

3. Purpose

Your data is processed for the following purposes:

• Handle and respond to your queries or quote requests.
• Manage the commercial relationship and provide the contracted services.
• Send you communications (newsletter) only if you have given your consent.

4. Legal basis

The legal basis for processing your data is: your consent (art. 6.1.a GDPR) when submitting the form; the performance of a contract or pre-contractual measures (art. 6.1.b GDPR); and the controller’s legitimate interest in responding to your queries (art. 6.1.f GDPR).

5. Retention

We will keep your data as long as there is a commercial relationship, you do not request its deletion, and during the legally established periods to address possible liabilities. Data for sending communications will be kept until you withdraw your consent.

6. Recipients

No data will be transferred to third parties except by legal obligation. Some providers who serve us (web hosting, email, management tools) may access the data as data processors, with whom the corresponding contracts have been signed under art. 28 GDPR.

7. Your rights

You can exercise the following rights at any time by emailing [email protected], stating the right you wish to exercise and attaching a copy of your ID document:

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe the processing does not comply with the regulations.

8. Security

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, preventing loss, misuse, alteration, unauthorised access and theft of personal data.

9. International privacy

Nuberona serves clients across several jurisdictions. In addition to the GDPR and the Spanish LOPDGDD (European Union and Spain), we apply the following frameworks where relevant:

United States — CCPA/CPRA (California)

If you are a California resident, you have the right to: (i) know what personal information we collect and why; (ii) request its deletion; (iii) correct inaccurate data; and (iv) not be discriminated against for exercising these rights. Nuberona does not sell or share your personal information for consideration. You may exercise your right to opt out of sale or sharing via the "Do not sell or share my personal information" link in the footer, by managing your cookie preferences, or by emailing [email protected].

Canada — PIPEDA

We process data in line with PIPEDA's ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, individual access and compliance. You may request access to your data or raise a query with our privacy contact at [email protected].

Mexico — LFPDPPP · Privacy Notice (ARCO rights)

Data controller: Ignacio Revuelta Bracero (Nuberona), Calle de Cadarso 16, Madrid, Spain. We process your data to handle your request, provide our services and communicate with you. Under the LFPDPPP you have ARCO rights (Access, Rectification, Cancellation and Opposition) and may withdraw your consent. To exercise them, send your request to [email protected] stating your name, the rights you wish to exercise and the information needed to locate your data. We do not transfer data without your consent, except as legally required.

European Union — GDPR

Processing is governed by the GDPR and the Spanish LOPDGDD, as described in the sections above (rights of access, rectification, erasure, objection, restriction and portability, and the right to complain to the AEPD).

Last updated: May 2026