Last updated: December 2025
1. GENERAL INFORMATION AND DATA CONTROLLER
In compliance with Regulation (EU) 2016/679 (GDPR) and applicable data protection laws, the user is informed that the Data Controller of their personal data is:
Nexa Digital Solutions LLC (hereinafter, "The Publisher" or "The Controller")
Address: 30 N Gould St Ste R STE 4000, Sheridan, WY 82801, USA.
Contact Email: info@nexadigitalsolutions.com
Data Protection Officer (DPO): dpo@nexadigitalsolutions.com
2. CONSENT FOR COMMUNICATIONS
In accordance with applicable telecommunications regulations (including Art. 66.1 of Law 11/2022 where applicable), the user expressly authorizes the use and transfer of their data to the Publisher and the Partners detailed in section 4.
Submitting the form implies express authorization to receive information and promotional communications via:
- Phone calls (human intervention or automated systems/bots).
- Instant messaging systems (WhatsApp, Telegram).
- Mobile messaging (SMS, MMS, RCS).
- Email.
3. DETAILS OF ACTIVITIES, PURPOSES AND LEGAL BASIS
Below, we detail the legal bases that legitimize each of our data processing activities, as well as specific retention periods:
3.1. Lead Generation and Commercial Transfer (Main Service)
- Purpose: To capture data of users interested in a service, qualify them, and transfer them to third-party advertisers (Partners) to send personalized offers.
- Legal Basis: Consent of the data subject (Art. 6.1.a GDPR) granted by checking the corresponding boxes on the form.
- Retention: Active lead data will be kept for 2 years from the last interaction for reactivation or retargeting purposes, unless consent is revoked earlier.
3.2. Technical Management and Proof of Consent
- Purpose: To record and store forensic proof that the user accepted the policy (Timestamp, IP, User Agent, Checked Box) to comply with the principle of Proactive Responsibility.
- Legal Basis: Legal Obligation (Art. 6.1.c GDPR) to demonstrate consent and defense against claims.
- Retention: 5 years (limitation period for data protection infringements).
3.3. Segmentation and Commercial Profiling (Scoring)
- Purpose: To analyze declared data (postcode, age, current provider) to filter which offers are suitable for the user and avoid irrelevant advertising.
- Legal Basis: Legitimate Interest (Art. 6.1.f GDPR) of the Controller to improve campaign efficiency and not saturate the user with unsuitable offers.
- Retention: 1 year from the last interaction.
3.4. Capture via Conversational Bots and Click-to-Call
- Purpose: To manage interaction through virtual assistants or inbound calls for data collection and pre-qualification.
- Legal Basis: Consent (by voluntarily interacting) and Legitimate Interest.
- Retention: Recordings (if any) or chat logs will be kept for the minimum time necessary to verify quality and contracting, not exceeding 2 years.
4. RECIPIENTS AND DATA TRANSFER (PARTNERS)
To fulfill the described purposes, your data will be communicated to collaborating companies ("Partners" or "Sponsors") who will act as independent data controllers once the data is received.
A. Main Partner / Sponsor:
B. Partner Activity Sectors:
By virtue of the consent granted, your data may be transferred to companies in the following sectors for advertising purposes:
- Energy (Electricity, Gas, Solar, Water) and Energy Efficiency.
- Telecommunications, Fiber Optics, and Technology.
- Insurance (Health, Life, Home, Auto, Burial).
- Financial, Credits, Banking, and Debt Recovery.
- Real Estate, Renovations, and Alarms.
- Education, Employment, and Publishing.
- NGOs and Humanitarian Aid.
- Automotive, Transport, and FMCG.
- Health, Wellness, and Legal Services.
C. Data Processors:
Your data may be accessible by technology providers (Hosting, SMS/Email sending platforms, Call Centers) acting under our instructions and strict confidentiality agreements.
5. DATA SOURCE
The processed data originates from:
- The data subject: Through web forms, chatbots, or phone calls.
- Tracking technologies: Cookies, Pixels, and device fingerprinting (for fraud prevention and consent validation).
- Inferred sources: Data derived from navigation or responses (e.g., inferring interest level in solar energy based on housing type).
6. INTERNATIONAL TRANSFERS
As the Controller is located in the USA, an international transfer of data is necessary to provide the service.
Guarantees: This transfer is carried out under Standard Contractual Clauses (SCC) approved by the European Commission (Decision 2021/914), ensuring a level of protection equivalent to the European standard.
7. SECURITY MEASURES
We have implemented robust technical and organizational measures to ensure data security, including:
- Encryption: TLS/SSL protocols for data in transit.
- Hashing: Secure storage of passwords and critical data.
- Traceability: Database access logs recording.
- Backups: Daily backups to ensure availability.
- Access Control: Restricted access to authorized personnel via authentication.
8. RIGHTS OF THE DATA SUBJECT
You have the right to obtain confirmation as to whether we are processing your data and to exercise your rights of:
- Access, Rectification, and Erasure.
- Restriction of processing.
- Data Portability.
- Opposition: Especially to stop receiving commercial calls or emails.
- Not being subject to automated decisions with legal effects.
Channels to exercise rights:
If you consider that your rights have not been respected, you have the right to lodge a complaint with the competent Data Protection Authority.
9. MINORS
This service is directed exclusively to individuals over 18 years of age. Registration of minors is prohibited. We implement logical controls to verify declared age.
10. MODIFICATIONS
We reserve the right to modify this policy to adapt it to legislative changes. The validity of this policy coincides with its publication on the website.