Summary (first layer)
| Controller | Marco Aurelio Leite da Silva (NIF Z0531428H), trading as Nexo Expat España |
|---|---|
| Address | Av. Moratalaz, 40, 3B, 28030 Madrid |
| Privacy contact | contacto@nexoexpat.com |
| Purpose | Answer enquiries, manage your account and the feasibility assessment, provide the consultancy services you hire and comply with legal obligations. |
| Legal basis | Consent, pre-contractual measures and performance of the contract, legal obligations and legitimate interest in the security of the service. |
| Recipients | Technical providers (hosting, e-mail, virtual assistant) acting as processors; authorities where required by law. |
| Rights | Access, rectification, erasure, restriction, objection and portability, through the contact e-mail. |
| Supervisory authority | Agencia Española de Protección de Datos (aepd.es) |
1. What data we process and where it comes from
Please do not send health data, criminal records or other special categories in the first message. If they are needed for the service they will be requested securely and with your explicit consent.
- Contact and assessment forms: name, e-mail, phone and the content of your enquiry.
- Client Area registration: name, e-mail, phone, address, optional identity document and password, stored encrypted (hashed).
- Feasibility assessment and documents uploaded to the digital vault: information about your personal, professional and document situation needed for the service.
- Messages with our team and with the virtual assistant Sofía.
- Technical data: IP address and security logs, used to prevent abuse and fraud.
2. Virtual assistant (Sofía)
The chat uses a third-party artificial-intelligence service (OpenAI) to generate replies. The messages you write are sent to that provider, which acts as a processor, and may involve an international transfer with the safeguards required by the GDPR (for example, standard contractual clauses). Do not enter sensitive data in the chat. The assistant does not give legal advice and makes no decisions with legal effects about you.
3. Retention
We keep data while the relationship lasts and afterwards, blocked, for the statutory limitation periods (tax, civil and administrative). Accounts pending activation and enquiries without follow-up are deleted when no longer needed.
4. Recipients and processors
We do not sell or assign your data. To provide the service, the server hosting provider, the e-mail service, the virtual-assistant provider and, if you hire translation, apostille or legal assistance, the professional we designate may access it, always under a data-processing agreement. We may also disclose data to authorities where the law requires.
5. Your rights
You may exercise your rights of access, rectification, erasure, restriction, objection and portability free of charge, and withdraw consent at any time, by writing to contacto@nexoexpat.com with proof of identity. If you believe the processing breaches the law you may complain to the Spanish Data Protection Agency (www.aepd.es).
6. Security
We apply appropriate technical and organisational measures: encrypted communications (HTTPS), hashed passwords, e-mail account activation, attempt limits, role-based access control and encrypted document storage.
7. Minors
Our services are intended for people over 18. Minors' data is processed only when supplied by their legal representatives in family procedures.
Last updated: November 1, 2026
Back to home