Privacy policy
Translation. This is an English translation for convenience. The Spanish version is the legally binding one: read it in Spanish.
This policy explains what personal data the website www.onexya.net (including its English pages and the /diagnostico landing page) processes, why, for how long and with whom. It complies with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Controller
| Owner | ONEXYA NEXUS, S.L. |
|---|---|
| Tax ID (NIF) | B88835459 |
| Address | Avenida Ámsterdam, 5, 11405 Jerez de la Frontera (Cádiz), Spain |
| Registry | Registro Mercantil de Cádiz, sheet CA-69503 |
| Contact | administracion@onexya.net |
The platform is not this website. When a company becomes an Onexya customer, its business data is processed on the platform (app.onexya.net). There, Onexya acts as processor, on behalf of that company and under the data processing agreement it signs with it (art. 28 GDPR). This policy does not cover that data.
2. What data we process and why
| When | Data | Why |
|---|---|---|
| “Request a demo” form on the home page | Name, email and message; company and phone if you provide them; the plan you chose, if you come from the pricing section. | To reply to you and prepare the demo or proposal you request. |
Form on the /diagnostico landing page | Name, job title, company, email, website or Instagram profile, phone (optional), the programs you use, what is hard for you to keep track of, and the question you leave us. Also where you came from: channel (for example, Instagram), campaign parameters, referring website, landing page and date. | To prepare your diagnosis and reply to you. To learn which campaigns work, without linking it to other websites. |
| Marketing communications | Email and name. | To send you Onexya news, only if you tick the optional box on the /diagnostico landing page. |
| Form security | IP address and number of submissions. | To prevent abusive submissions: we limit submissions per IP and hour. |
| Technical server logs | IP address, date, page or function called and result. | To keep the website running and to detect errors and attacks. |
| Analytics, only if you accept it | Page views, form steps (without their content), device and browser type, approximate location and campaign parameters. The IP reaches Google anonymized. | To learn how the website is used so we can improve it. |
We don’t need any data beyond this. We don’t build profiles or make automated decisions that affect you.
3. Legal basis
- Replying to your request for a demo, diagnosis or information: taking pre-contractual steps at your request (art. 6.1.b GDPR) and, for general inquiries, our legitimate interest in answering anyone who writes to us (art. 6.1.f).
- Marketing communications: your consent (art. 6.1.a GDPR and art. 21 LSSI-CE). You can withdraw it at any time.
- Security and technical logs: our legitimate interest in protecting the website and its users (art. 6.1.f GDPR).
- Analytics: your consent, which you give or refuse in the cookie notice (art. 6.1.a GDPR and art. 22.2 LSSI-CE).
4. How long we keep it
| Data | Period |
|---|---|
| Requests with no later commercial relationship | 12 months from the time we receive them. |
| Requests that end in a contract | For as long as the relationship lasts and, afterwards, the periods required by law (for example, six years for commercial documentation). |
| Marketing communications | Until you withdraw your consent. |
| Submission control by IP | Deleted automatically, within two hours at most. |
| Technical server logs | The short period set by the hosting provider, and never more than 90 days. |
| Analytics | The period configured in Google Analytics, 14 months at most. |
5. Who processes data for us
We use the following providers, which act as processors under a contract (art. 28 GDPR). We don’t share data with third parties for their own purposes, except where legally required.
| Provider | Purpose |
|---|---|
| Vercel Inc. | Hosting of the website and its functions (the functions run in Frankfurt, in the EU) and technical logs. |
| Upstash, Inc. | Control of form submissions by IP. |
| Resend | Delivery of the email with your request to our inbox. |
| Google Ireland Ltd. / Google LLC | Corporate email, where we receive and answer requests; and Google Analytics, only if you accept it. |
6. Transfers outside the European Economic Area
Some of these providers are based in the United States or may access data from there. Transfers rely on the EU-US Data Privacy Framework when the provider is certified under it and, if not, on the European Commission’s Standard Contractual Clauses (art. 46 GDPR). You can request a copy of the safeguards at administracion@onexya.net.
7. Your rights
You can request access to your data, its rectification or erasure, restriction of processing and portability, and you can object to processing based on legitimate interest. You can also withdraw your consent at any time, without affecting what was done before.
Write to administracion@onexya.net with the subject “Privacidad” (privacy) and say which right you want to exercise. If we have reasonable doubts about your identity, we’ll ask for the minimum needed to verify it. We reply within one month at most, extendable by two more months in complex cases.
If you believe we haven’t handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es).
8. Cookies and storage in your browser
The website doesn’t set its own cookies. It stores in your browser your cookie choice and whether you prefer the light or dark theme, and it only sets Google Analytics cookies if you accept them. The details are in the cookie policy, and you can change your choice with “Cookie settings” at the bottom of every page.
9. Security
- Everything travels encrypted (HTTPS), with HSTS.
- Forms carry a signed security token and a limit on submissions per IP.
- Service keys are kept in environment variables, never in the code.
- Only staff who need to can access requests.
If there were a security breach posing a risk to your rights, we would notify the AEPD within 72 hours and, if the risk were high, the people affected as well (arts. 33 and 34 GDPR).
10. Installable version of the website
The website can be installed as an app (PWA). That version only stores the website’s files (pages, styles, images) on your device so it loads faster; it doesn’t store personal data or accounts. If you uninstall it, everything is deleted.
11. Minors
The website is aimed at businesses and professionals. We don’t knowingly collect data from children under 14.
12. Changes
If we change this policy, we’ll publish the new version here with its date. If the change affects how we process data you have already given us, we’ll let you know by email before applying it.