Privacy policy

01 Controller

Luis Coronado (Ads&Nexus), NIF 79273745-J, with address at Castellar del Vallès (Barcelona), España.

Contact for data protection matters: info@adsandnexus.com.

Data Protection Officer (Delegado de Protección de Datos): none has been appointed, because none of the cases in Article 37(1) of the GDPR applies: we are not a public authority, our core activity does not consist of the regular and systematic monitoring of individuals on a large scale, nor of large-scale processing of special categories of data. For any data protection question you may write to info@adsandnexus.com, which is a monitored channel.

If the volume or nature of the processing were to change so that any of those cases applied, a Data Protection Officer would be appointed and its name and contact details published here.

02 Two separate processing activities: do not confuse them

Kommyt is the CONTROLLER of the data of its own customers: the person or business that requests registration, is invoiced and uses the dashboard as a customer of Kommyt.

Kommyt is the PROCESSOR of the data that each business enters into the CRM about the individuals it manages (its customers, members, patients, students… depending on its activity). In that case the controller is the business: it decides what data it collects and for what purpose, and it is the one that must respond to the rights of those individuals.

That relationship is formalised in a data processing agreement under Article 28 of the GDPR, which is signed when the business registers.

03 Data we process and purposes

Contact and billing data of the business and of the responsible person, to open the account, provide the service and issue invoices.

Technical usage data (access logs, IP address, activity in the application) to guarantee security, investigate incidents and maintain the traceability that is required.

Data you provide when you write to us, so that we can answer your enquiry.

How you got here: when you submit the contact or registration form, the channel through which you arrived (for example “google”, “adsandnexus” or “direct”), the domain or label of the link you clicked, and the sector page through which you entered, if you entered through one, travel with it. This helps us know which channels bring us customers. To obtain it, NOTHING is stored in your browser: it is deduced when you enter, lives only in the memory of the page for as long as the visit lasts, and is only sent if you submit the form.

04 Legal basis

Performance of the contract, to provide the service and invoice it.

Compliance with legal obligations, in tax and accounting matters.

Legitimate interest, for the security of the service and the prevention of fraud.

Consent, where it is requested expressly and separately.

05 Retention

Customer data is kept for as long as the relationship lasts and, afterwards, blocked for the legal limitation periods.

Data hosted on behalf of a business is returned or deleted at the end, at the business’s choice, within a maximum of 30 calendar days; if it says nothing, it is RETURNED and not destroyed. This is governed by clause 17 of the data processing agreement.

Specific periods, by category:

· Enquiries and quote requests that do not result in a contract: up to one year from the last contact.

· Contractual relationship data and commercial documentation: for the duration of the relationship and, afterwards, six years, in accordance with Article 30 of the Spanish Commercial Code (Código de Comercio).

· Invoices and supporting documents with tax effects: four years from the end of the filing period, in accordance with the Spanish General Tax Law (Ley General Tributaria).

· Audit log and access traces TO THE SYSTEM (who enters the software, from where and what they do): twelve months, unless they must be kept for longer to document a security incident.

· Entry and exit control of the people a business manages (who accesses the premises and when, whether they are identified by hand or with their card): these are NOT system traces, but business data. The business keeps them and decides their period, in accordance with the following point. Kommyt does not delete them on its own initiative.

· Data hosted on behalf of a business: whatever period that business decides, under the previous point; Kommyt does not keep it on its own beyond those 30 days.

Once the periods have elapsed, the data is deleted or anonymised in such a way that no one can be identified again.

06 Recipients and processors

Personal data is not sold or transferred to third parties for commercial purposes.

The providers involved are listed one by one, with their purpose and location, in Annex II of the data processing agreement, which you can consult from this same legal section.

In short: database hosting, always active; file storage, email and artificial intelligence providers, DISABLED by default and active only if the business configures them.

No third-party analytics, advertising or telemetry tools are used.

07 International transfers

Email and the artificial intelligence providers are based in the United States. Both are disabled by default: while the business does not enable them, no data leaves the European Economic Area through that channel.

No transfer is made without being covered by a valid mechanism under Chapter V of the GDPR: an adequacy decision or standard contractual clauses. That obligation is ours and is not passed on to the business.

The artificial intelligence assistant does NOT have access to the database: it can only request four specific things, and these are the four.

· About a person: their name, their number and the balance of their wallet.

· About a product: its name and its price.

· A table of business figures: the month’s consumption and its trend, how many people are active, the total balance of the wallets, the products that sell most and least, the upcoming events with their places and registrations, and up to five people with what they have pending payment and how many days they have been overdue.

· And preparing a payment, which it does NOT store: it is left pending and a person confirms it on screen.

Beyond that, it does not reach identity documents, images, addresses, dates of birth or notes. That is the main safeguard, and it is by design.

In addition, before anything is sent, identity document numbers, IBANs and card numbers, telephone numbers, email addresses, postal addresses and dates of birth that staff may have written are masked from the text.

With the same candour as in the rest of this document: we CANNOT guarantee that a health datum written in free prose by a person will be detected automatically, because there is no reliable way to do so. That is why the assistant warns on screen that it must not be written, and why its tools do not read the notes fields.

The service data is hosted entirely within the European Economic Area: the database at Neon, Inc. (Frankfurt region, Germany) and the application servers at Hetzner Online GmbH (Nuremberg, Germany). For neither of them does an international transfer take place.

Two US providers are also involved in ancillary functions: Cloudflare, Inc. (distribution and traffic protection) and Resend (transactional email delivery). In the case of Resend, email data (recipient, subject, content, sending records and metadata) is stored in the United States. For both, the Standard Contractual Clauses approved by the European Commission apply, incorporated into their data processing terms.

08 Your rights

You may exercise the rights of access, rectification, erasure, objection, restriction and portability, as well as withdraw any consent you have given.

By writing to info@adsandnexus.com, proving your identity.

If your data is in the CRM of a business that uses Kommyt (as its customer, member, patient…), contact that business first: it is the one that decides about that data, and Kommyt only processes it on its behalf.

You may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es.

09 Security

Technical and organisational measures appropriate to the risk are applied: encryption IN TRANSIT (HTTPS), access control by role and permission, isolation of each business’s data at database level, a limit on access attempts and audit logging. Annex III of the data processing agreement details them one by one.

Automatic daily backups are made. They are encrypted before leaving the server and are stored outside it; those from the last 30 days are kept, and older ones are deleted automatically. Once a month a real backup is restored on an isolated system to check that it can truly be done: a backup that is never restored is not a backup, it is an assumption.

With the same candour: encryption at rest is NOT applied at application level. That shortcoming is declared in clause 10 of that contract, with a commitment to correct it. We prefer to say so here rather than have anyone assume otherwise.

One consequence of the above should be known: when data is deleted, it disappears from the system immediately, but it may remain inside some backup until that backup expires, at most 30 days later. During that time it is not used for anything: it exists only in case the service has to be recovered.

If a security breach affecting a business’s data occurs, the business is notified within 24 hours of becoming aware of it, so that it has margin within the 72 hours that the GDPR gives it to notify the Spanish Data Protection Agency.