This is an English translation provided for convenience. The binding version is the Spanish original, available at Política de Privacidad. In the event of any discrepancy, the Spanish text prevails.
In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 (LOPDGDD), we set out below how we process your personal data at onext.
1. Key information on data protection
Controller
ONEXT INNOVATION, SL
Tax ID (CIF)
B93847648
Purpose
Handling enquiries, providing services, managing workshop and event registrations, and sending the newsletter
Legal basis
Consent, pre-contractual measures or contract, and legitimate interest, depending on the purpose (see section 5)
Recipients
Providers processing data on behalf of onext and authorities where the law requires; transfers to the US with safeguards (see section 7)
Rights
Access, rectification, erasure, objection, restriction and portability
2. Who is the controller of your data?
3. What personal data do we collect?
At ONEXT INNOVATION, SL we collect the personal data you voluntarily provide through the forms available on our website:
3.1. Contact form
- Name and surname
- Email address
- Company (optional)
- Message or enquiry
3.2. Newsletter (where applicable)
- Email address
- Name (optional)
3.3. Browsing data, cookies and the record of your choice
When you visit the website, our hosting provider (Vercel) processes technical request data (IP address, browser, date and time) to serve the page and keep it secure. We do not use that data to identify you.
If, and only if, you accept statistics cookies, Google Analytics 4 collects usage data through a random identifier. If you reject them, no analytics tool is loaded.
If you accept statistics cookies, Google Analytics 4 data may be used in Google Ads only to measure the conversions of our campaigns, with personalised advertising turned off (there is no remarketing).
To be able to keep your choice on record, we store a record with a random identifier (a pseudonymised data item), the date, the version of the cookie policy, the language and the categories chosen. We do not store your IP address in that record. To exercise your rights over this record, tell us the identifier of your choice (it is in the onext_consent cookie). More information in our Cookie Policy.
4. For what purposes do we process your personal data?
The personal data you provide will be processed for the following purposes:
Handling enquiries
Responding to and managing the requests for information or enquiries you submit through the contact forms.
Provision of services
Managing the contracting of technology consulting, AI implementation, DevSecOps, QA and Talent as a Service.
Commercial communications
Sending you information about our services, news and content: only if you tick a specific subscription box or, if you are a customer, about services similar to those you contracted, with the option to unsubscribe in every message.
Improving your experience
Analysing use of the website in order to improve our services and the user experience, only if you accept statistics cookies.
5. What is the legal basis for processing your data?
The legal basis for processing your personal data is:
a) Consent of the data subject (Art. 6(1)(a) GDPR): for subscribing to commercial communications and the newsletter, through a specific box separate from any other.
b) Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR): to handle the enquiry you send us and, when you request our services, to perform the contract.
c) Legitimate interest (Art. 6(1)(f) GDPR and Art. 21(2) LSSI): commercial communications about services similar to those contracted, only to customers and with the option to unsubscribe in every message.
d) Consent for statistics cookies (Art. 6(1)(a) GDPR and Art. 22(2) LSSI): web analytics with Google Analytics is only activated if you accept it in the cookie banner, and you can withdraw your consent at any time from “Cookie settings” at the bottom of every page.
e) Legitimate interest (Art. 6(1)(f) GDPR): to keep the website secure and to keep proof of your cookie choice (Art. 7(1) GDPR).
6. How long will we keep your data?
Contact data: until you request erasure, or for 2 years from the last interaction.
Client data: for the duration of the business relationship and thereafter for the limitation period of the applicable legal obligations (normally 6 years from the last invoice).
Newsletter data: until you unsubscribe or cancel your subscription.
Record of your cookie choice: while your choice is in force and for 3 more years after it ends (expiry, withdrawal or replacement), for the limitation period of infringements, after which it is deleted.
Web analytics data (Google Analytics): the retention periods configured in the tool; the identification cookie expires after 13 months.
7. To which recipients will your data be disclosed?
Your personal data will not be transferred or disclosed to third parties, except in the following cases:
a) Legal obligation: where a legal obligation so requires (tax, judicial or administrative authorities).
b) Service providers (processors): we may share your data with providers that process data on our behalf, under a contract in line with Art. 28 GDPR: hosting and server functions (Vercel), email delivery (Resend), the CRM where we manage contacts, registrations and communications (HubSpot), corporate email, video conferencing and document storage (Microsoft), the provider of the database that holds the record of your cookie choice (in the European Union) and, only if you accept statistics cookies, Google Ireland Ltd. (Google Analytics).
c) International transfers: Google, Vercel, Resend, HubSpot and Microsoft, or their sub-processors, may process data in the United States. The transfer relies on the European Commission’s adequacy decision (EU-US Data Privacy Framework) where the provider is certified and, otherwise, on standard contractual clauses (Arts. 45 and 46 GDPR). You can ask us for a copy of the safeguards at info@onext.es.
8. What are your rights?
Anyone has the right to obtain confirmation as to whether we are processing personal data concerning them. Data subjects have the right to:
Withdrawing consent: you can withdraw your consent at any time, including from “Cookie settings” at the bottom of every page, without affecting the lawfulness of the earlier processing. You can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Right of access
Obtain information about what data we are processing
Right to rectification
Request correction of inaccurate data
Right to erasure
Request deletion of your data
Right to object
Object to the processing of your data
Right to restriction
Request restriction of processing
Right to portability
Receive your data in a structured format
How to exercise your rights
To exercise your rights, send a request to info@onext.es stating:
- • Your full name and email address
- • The right you wish to exercise
- • If we have reasonable doubts about your identity, we may ask you for additional information to confirm it
We will respond within 1 month, extendable by two further months if the request is complex (we will tell you).
Right to lodge a complaint
If you believe the processing does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es
9. Security measures
ONEXT INNOVATION, SL undertakes to adopt the necessary technical and organisational measures, at a level of security appropriate to the risk of the data collected.
The security measures implemented include:
- SSL/TLS encryption on all website communications
- Access to personal data restricted to authorised staff only
- Regular backups
- Protection through strong passwords
- Regular updating of security systems
- Confidentiality agreements with employees and suppliers
10. Contact
For any query relating to this Privacy Policy, you can contact us:
11. Workshops and events
What data do we process?
The data you give us when you register for an onext workshop or event or ask us about it: name, email address, company, job title and the session you choose; if you tell us, that none of the dates work for you and you want to hear about new ones, that you are interested in training for your team and the size of your development team (in ranges); and, if you have agreed to receive commercial communications, the date and the text you accepted. During the session, which we run on Microsoft Teams, we also process the name you join with, anything you share in the chat or by voice and, if you turn them on, your image and voice. We do not record sessions; if we ever wanted to, we would tell you before starting.
For what purposes?
a) To manage your registration and the workshop: confirming your place and the capacity, sending you the access link, notices and changes, tailoring the content to the attendees’ profile and, after the workshop, sending you the materials and a short feedback survey.
b) If you tell us that none of the dates work for you: emailing you when we open new dates for this workshop. We will send you nothing else this way.
c) If you tell us you are interested in training for your team: our sales team will write to you to arrange the initial training (date, format and number of attendees).
d) Only if you agree by ticking the relevant box: sending you commercial emails from onext (other workshops, content and services).
On what legal basis?
a) and c) Your request (Art. 6(1)(b) GDPR): you ask us to register you or to organise training for your team. The required fields of the form are needed to deal with it; the team size is optional.
b) and d) Your consent (Art. 6(1)(a) GDPR and Art. 21 LSSI), which you give by choosing the notice option or ticking the commercial communications box. Neither is needed to register, and you can withdraw them at any time using the unsubscribe link in every email, by replying “unsubscribe” or by writing to info@onext.es, without affecting your registration or the lawfulness of earlier messages.
How long do we keep it?
- Registration data (a): up to 12 months after the session; we then erase it, unless you agreed to purpose d).
- New date notices (b): up to 6 months from your request, or until you unsubscribe; during that time we will tell you about new dates for this workshop. If you register, the registration period applies.
- Training for your team (c): while we handle your request and up to 12 months from the last contact about it. If the training takes place, the attendees’ data follows the registration period.
- Commercial communications (d): until you unsubscribe.
- Once these periods end, we keep the proof of your consents and unsubscriptions blocked for 3 years, to deal with any claims, and then erase it.
Who is it disclosed to?
We do not share or sell your data to third parties unless the law requires it. Other attendees can only see the name you join the session with; we do not show them your email address or registration details. It is accessed by the onext staff who organise the workshops and, for purpose c), by our sales team. The providers that give us the following services also have access to it as processors, under a contract in line with Art. 28 GDPR: the CRM where we keep your registration and requests (HubSpot), sending the confirmation email and notices (Resend), video conferencing and corporate email (Microsoft), and website hosting and form submission (Vercel).
International transfers
Some of these providers, or their sub-processors, may process data outside the European Economic Area, in particular in the United States. In that case, the transfer relies on the European Commission’s adequacy decision (EU-US Data Privacy Framework) where the provider is certified and, otherwise, on standard contractual clauses (Arts. 45 and 46 GDPR). You can ask us for more information at info@onext.es.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, by writing to info@onext.es. We will reply within one month. If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
12. Self-assessments and resources
What data do we process?
In the onext.es self-assessments (SDD Checklist and AI self-assessment), the result is calculated in your browser and we do not receive your answers unless you ask us to email you the report. In that case we process your email and, if you provide them, your name and company, together with your answers and your result, and where the request comes from: the page you make it on and, if the link carries them, the UTM tags of the campaign. If you agree to receive commercial communications, we also process the date and the text you accepted.
What for?
a) To send you the report you ask for; we will not use this channel to contact you about anything else.
b) Only if you agree by ticking the corresponding box: to send you commercial emails from onext, including an email to discuss your result.
On what legal basis?
a) Your request (Art. 6(1)(b) GDPR).
b) Your consent (Art. 6(1)(a) GDPR and Art. 21 of the Spanish Information Society Services Act, LSSI). It is not required to receive the report, and you can withdraw it at any time using the unsubscribe link or instruction included in each email, replying “unsubscribe” or writing to info@onext.es, without affecting the lawfulness of previous emails.
How long do we keep it?
- Report (a): up to 12 months from your request in our systems; the technical records of our providers are deleted according to their own periods, which are shorter.
- Commercial communications (b): until you unsubscribe.
- After these periods, we keep proof of your consents and unsubscriptions blocked for 3 years to handle any claims, and then delete it.
Who do we share it with?
We do not share or sell your data to third parties unless required by law. The providers that deliver these services access it as processors, under contracts in line with Art. 28 GDPR: website hosting and form submission (Vercel), email delivery (Resend), the corporate mailbox where we receive your request (Microsoft) and, if you have agreed to commercial communications, our CRM (HubSpot).
International transfers and your rights
International transfers and the exercise of your rights, including the right to complain to the Spanish Data Protection Agency (www.aepd.es), work as explained in sections 7.c and 8.