Privacy policy

At Nubico Tech we take the protection of your personal data very seriously. This policy explains clearly what information we process, for what purpose, the legal basis for each processing activity, how long we keep the data and what your rights are.

It has been drafted in accordance with Regulation (EU) 2016/679 (GDPR) and with Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).

1. Data controller

We are not required to appoint a data protection officer, so you can address any privacy matter to the email above.

2. What data we process

We process the data you give us and the strictly technical data your visit generates:

• Contact form: name, company, email, phone number and the message you write.
• Job applications: name, email, the message you write, any link you provide (portfolio, LinkedIn or similar) and the position you are applying for.
• Technical data: IP address, device type, browser and pages visited. Analytics processes them in aggregate; your IP address is sent individually to Cloudflare at the moment you submit a form, and solely to check that the submission is not automated.
• Error diagnostics: if something fails in your browser, our monitoring system records the error together with technical data about the session. It may include a recording of the interaction, with text masked and media blocked. It is only triggered when there is an error, never on normal visits, and it is hosted on our own servers.
• Heatmaps and session recording: only if you accept analytics cookies, Microsoft Clarity records your interaction with the pages — mouse movement, clicks and scrolling — to build heatmaps and playbacks of the navigation. Any text you type, along with numbers and email addresses, is masked in your own browser and is not sent.
• Cookies and local storage: the strictly necessary ones and, if you accept them, analytics cookies. The details are in our Cookie policy.

We do not process special categories of data (health, ideology, religion, trade union membership or others) and we do not carry out automated decision-making or profiling.

3. Why we process it and on what legal basis

• To handle your enquiry and reply to you. Legal basis: pre-contractual measures taken at your request (art. 6.1.b GDPR).
• To manage your application in a recruitment process. Legal basis: pre-contractual measures taken at your request (art. 6.1.b GDPR).
• To deliver contracted services, manage the commercial relationship and invoice. Legal basis: performance of a contract (art. 6.1.b GDPR) and legal obligations in accounting and tax matters (art. 6.1.c GDPR).
• To send you communications about our services, only if you have expressly consented. Legal basis: consent (art. 6.1.a GDPR), which you may withdraw at any time.
• To protect the site and its forms against automated submissions, fraud and abuse, and to diagnose errors so we can fix them. Legal basis: legitimate interest in keeping the service secure and operational (art. 6.1.f GDPR).
• To measure how the site is used through web analytics and to understand how people navigate it through heatmaps and session recording, only if you accept analytics cookies. Legal basis: consent (art. 6.1.a GDPR).

The fields marked as required in our forms are the minimum we need in order to help you: without them we cannot answer your enquiry or process your application.

4. How long we keep it

• Contact form messages: up to 12 months after the last interaction, unless a commercial relationship begins.
• Job applications: 1 year from receipt, after which they are deleted. If we want to keep yours for future openings, we will ask for your express consent, which you may withdraw at any time.
• Data from contracted services: for the duration of the contract and, afterwards, for the legally required periods (up to 6 years in commercial and tax matters).
• Data for commercial communications: until you withdraw your consent.
• Error logs and diagnostic recordings: 90 days.
• Clarity session recordings: 30 days; those marked as favourites and a random sample, for up to 9 months. These periods are set by Microsoft.

5. Who else accesses your data

We do not sell or share your data. Only the providers needed to deliver the service access it, and they act as data processors under contract pursuant to article 28 GDPR:

• Our own infrastructure, hosted in Spain: it runs the website, the internal management system that receives the forms and our error monitoring instance. This data does not leave our servers.
• Cloudflare, Inc. — anti-fraud verification of the forms and site protection.
• Google Ireland Ltd. / Google LLC — web analytics, only if you accept analytics cookies. If you reject them, nothing from Google is loaded.
• Microsoft Corporation — heatmaps and session recording (Clarity), only if you accept analytics cookies. If you reject them, nothing from Microsoft is loaded.

The site's typefaces are served from our own domain, so browsing nubico.tech does not disclose your IP address to any font provider.

We may also disclose data to public authorities and courts where there is a legal obligation, and to our tax and accounting advisers within the scope of the contractual relationship.

6. International transfers

Three of the providers listed above are established outside the European Economic Area:

• Cloudflare, Inc. (United States), which receives your IP address when you submit a form in order to verify that the submission is not automated.
• Google LLC (United States), only if you accept analytics cookies.
• Microsoft Corporation (United States), only if you accept analytics cookies.

All three are certified under the EU-US Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection in its Decision of 10 July 2023, pursuant to article 45 GDPR. Beyond these three cases we do not carry out international data transfers.

7. Your rights

You may exercise the following rights at any time:

• Access to the data we process about you.
• Rectification of inaccurate or incomplete data.
• Erasure ("right to be forgotten") when the data is no longer necessary.
• Objection to the processing on grounds relating to your particular situation.
• Restriction of processing in the cases provided for by the GDPR.
• Portability of your data to another controller where technically feasible.
• Withdrawal of consent you have given, without affecting the lawfulness of processing carried out beforehand.

Just write to hola@nubico.tech stating which right you wish to exercise. If the request comes from the same email address you have already used to contact us, we need nothing further; we will only ask you to prove your identity if there are reasonable doubts as to who is making the request. We will reply within one month, extendable to two if the request is particularly complex, in which case we will let you know.

If you believe the processing does not comply with the applicable rules, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Information security

We apply appropriate technical and organisational measures to keep your data secure: encryption in transit (HTTPS/TLS), access control, backups, network segmentation and periodic review of our processes.

Should a security breach occur that may pose a risk to your rights and freedoms, we will notify you within the time and in the manner required by law.

9. Cookies

We use cookies that are strictly necessary for the site to work, and Google and Microsoft analytics cookies which are only set if you expressly accept them. Which cookies they are, what they do and how long they last is set out in our Cookie policy, where you can also change your decision whenever you want.

10. Minors

Our services are aimed at companies and professionals of legal age. We do not knowingly collect data from children under 14. If you find that a minor has given us data without the authorisation of their legal guardians, please let us know and we will delete it.

11. Changes to this policy

We may update this policy to reflect legal, technical or business changes. The version in force will always be the one published on this page, with its last updated date shown at the top.

12. Contact

For any question about this policy or about how we process your data, write to us at hola@nubico.tech.