Introduction
NEXO Intelligence SL ("NEXO", "we", "us", "our") operates a B2B software platform that helps suppliers in the food sector receive and manage orders from their customers.
- Legal entity
- NEXO Intelligence SL
- Tax ID (CIF)
- B27546712
- Registered office
Urb. La Cancela de la Quinta, C/ Aguamarina, edif. 9, local 2, 29670 San Pedro Alcántara (Marbella), España
- Contact
- info@nexoapp.es
Scope
This policy covers the personal data processed when you use our website and platform. Our services are intended exclusively for business users. NEXO does not knowingly provide services to minors.
Our role under the GDPR
As a processor
When we handle messages, orders and related content on behalf of our supplier customers, we act on their instructions. Suppliers are the controllers of their contacts' data.
As a controller
When we process data to run our own business: account administration, billing, security and legal obligations.
What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account and contact data (name, email, phone, company) | Account creation and provision of the service | Performance of a contract (Art. 6(1)(b)) |
| WhatsApp messages, including text, photos and voice notes | Order processing on behalf of suppliers | Performance of a contract (Art. 6(1)(b)) |
| Order content (products, quantities, delivery instructions) | Provision of the core service | Performance of a contract (Art. 6(1)(b)) |
| Technical logs and error data | Security and reliability of the service | Legitimate interests (Art. 6(1)(f)) |
| Website usage data | Analytics and service improvement | Consent (Art. 6(1)(a)) |
AI-assisted processing
Incoming messages, including photos and voice notes, are processed using AI tools to extract structured order information. This processing assists users and does not produce automated decisions with legal effects. Orders require human review before confirmation.
We do not process special categories of data under Art. 9 GDPR.
Who we share data with
We share data with service providers that help us operate the platform, acting as sub-processors under our instructions. The categories include:
- Infrastructure and database hosting
- AI processing (text analysis, image OCR, audio transcription)
- Messaging delivery (WhatsApp Business Platform)
- Error monitoring
We do not sell personal data. The full list of sub-processors is available to customers on request or within the platform's Data Processing Agreement (DPA).
International transfers
Some of our sub-processors are located outside the EU, including in the United States. Where personal data is transferred to such providers, the transfers are governed by the Standard Contractual Clauses (SCCs) approved by the European Commission.
Retention
We retain personal data only for as long as necessary:
- Platform and order data: for the duration of the active account, plus up to 60 days after termination for data export.
- WhatsApp content and media files: deleted after the supplier disconnects or the account is canceled (within 30 days).
- Account records: in accordance with applicable tax and legal obligations (normally up to 7 years after the end of the contract).
- Technical logs: up to 12 months.
- Analytics data: according to the provider's configuration, up to 14 months.
Your rights
Under the GDPR, you may request access, rectification, erasure, restriction or portability, or object to processing. Where NEXO acts as a processor, requests concerning data we hold on behalf of a supplier must be addressed to that supplier.
For data that NEXO processes directly as a controller, contact us at info@nexoapp.es or use the export/deletion options in your account settings.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or the supervisory authority of your EU member state.
This policy complies with the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
Security
We apply appropriate technical and organizational measures, including encryption in transit and at rest, role-based access controls and activity logging.
NEXO integrates the WhatsApp Business Platform so that suppliers can receive orders. We process WhatsApp data (messages, media files, phone numbers) exclusively for order automation, in compliance with Meta's Platform Terms.
Suppliers are solely responsible for ensuring they have a lawful basis to communicate with their contacts and process their data through WhatsApp and the NEXO platform.
Changes
We may update this policy from time to time. Material changes will be communicated by email to active users. The current version will always be available at nexoapp.es/privacidad.
Contact
For any questions about this Privacy Policy or data protection matters, contact us at: info@nexoapp.es.
In the event of any discrepancy between the Spanish and English versions, the Spanish version shall prevail.
