Last updated: October 2026. This English version is provided for convenience; in case of discrepancy, the Spanish version prevails.
NERSIS SOLUTIONS, S.L. processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). This policy explains what data we process, why, and what rights you have.
1. Data controller
- Company name: NERSIS SOLUTIONS, S.L.
- Tax ID (CIF): B85705176
- Registered office: C/ Cronos 10, 1º 2ª, 28037 Madrid, Spain
- Phone: +34 910 059 049
- Email: rgpd@nersis.es
- Madrid Commercial Register: volume 26,761, book 0, folio 163, section 8, sheet M-482242, entry 1 (9 June 2009)
2. What data we process and where it comes from
We only process data provided by the data subject or generated when using the website:
- Website contact form: name, company, email address, phone number, service of interest and the message sent.
- Email or phone communications: contact details and the information included in the communication.
- Clients and suppliers: data of contact persons needed for the business relationship and the provision of services.
- Job applications: CV data sent for recruitment processes.
- Browsing: technical data logged by the server for security purposes (IP address, date and page requested) and, only if you accept analytics cookies, usage statistics collected by Google Analytics.
3. Purposes and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering enquiries received through the form, email or phone, and preparing quotes | Consent (Art. 6(1)(a)) and pre-contractual steps at the data subject’s request (Art. 6(1)(b)) |
| Managing the relationship with clients and providing the contracted services | Performance of a contract (Art. 6(1)(b)) |
| Complying with accounting, tax and legal obligations | Legal obligation (Art. 6(1)(c)) |
| Sending clients information about services similar to those contracted | Legitimate interest (Art. 6(1)(f) and Art. 21.2 LSSI-CE). You may object at any time. |
| Managing recruitment processes | Consent (Art. 6(1)(a)) |
| Managing the employment relationship with Nersis staff | Performance of a contract and legal obligation (Art. 6(1)(b) and 6(1)(c)) |
| Statistical analysis of website use with Google Analytics | Consent (Art. 6(1)(a)), given in the cookie notice and revocable at any time |
| Keeping the website secure and protecting the form against automated submissions (spam) | Legitimate interest (Art. 6(1)(f)) |
Fields marked as required in the form are needed to answer your enquiry. No automated decisions with effects on individuals are made and no profiles are created.
4. Retention periods
- Enquiries and quotes: as long as needed to handle them and, if no business relationship begins, one year from the last contact.
- Clients: for the duration of the relationship and, afterwards, for the applicable legal periods (generally six years for accounting and tax records).
- Staff: during the employment relationship and the subsequent legal periods.
- Job applications: two years from receipt of the CV, unless erasure is requested earlier.
- Google Analytics: a maximum of 14 months.
- Technical security logs: only as long as necessary to detect and resolve incidents.
5. Recipients
Data is not disclosed to third parties, except where required by law (for example, to the Spanish Tax Agency, Social Security, courts or law enforcement).
To provide our services we use suppliers that may access data on our behalf as processors, under a contract in accordance with Article 28 GDPR: website hosting, email and productivity tools (Microsoft 365), web analytics (Google Analytics, by Google Ireland Limited, only if you accept analytics cookies) and technical support.
6. International transfers
Microsoft and Google may process data outside the European Economic Area. These transfers are covered by both companies’ participation in the EU-U.S. Data Privacy Framework and by the standard contractual clauses approved by the European Commission.
7. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent given, without affecting the lawfulness of prior processing. Analytics cookies can be withdrawn in Cookie settings.
To exercise your rights, write to rgpd@nersis.es or to C/ Cronos 10, 1º 2ª, 28037 Madrid, Spain, stating the right you wish to exercise. We may ask you to verify your identity.
If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. Security
Nersis applies technical and organisational measures appropriate to the risk to protect data against loss, alteration or unauthorised access, in line with our activity as a managed IT and cybersecurity services provider.
9. Minors
The website is aimed at businesses and professionals. We do not knowingly collect data from children under 14.
10. Changes to this policy
We may update this policy to reflect legal changes or changes to our services. The current version is always the one published on this page.