Privacy Policy
Last updated: 11 September 2026
This Privacy Policy explains how NEXO processes personal data through this website, the purposes and legal bases for processing, how long data is kept and how you can exercise your rights.
NEXO Digital Agency is the brand used by the activity responsible for processing data collected through this website. For privacy questions or to exercise your rights, contact nexogeral@outlook.pt. The full legal identity of the activity owner must appear on the Legal Information page and be kept up to date.
1. Applicable legislation
Personal-data processing is governed, in particular, by the following legislation and guidance, as amended and in force:
The links above point to official sources or the Portuguese supervisory authority. If the law changes, the legislation in force always prevails.
2. Personal data that may be processed
Depending on the feature used, we may process your name, email address, phone number, contact preference, message, information provided in the quote simulator, selected services and notes entered by you.
The request may also include attribution data such as landing page, referral source, UTM parameters and partner code, where available, as well as technical data strictly necessary for service security and operation.
3. Purposes and legal bases
| Purpose | Legal basis | Reference |
|---|---|---|
| Respond to enquiries, assess quote requests and take steps requested before a possible contract. | Pre-contractual steps at the data subject’s request. | Article 6(1)(b) GDPR. |
| Manage the business relationship, request source and operational follow-up where necessary and proportionate. | NEXO’s legitimate interest in managing requests and its business, provided this does not override the data subject’s rights. | Article 6(1)(f) GDPR. |
| Comply with legal, tax or accounting obligations, or respond to authorities where legally required. | Compliance with a legal obligation. | Article 6(1)(c) GDPR. |
| Use Google Analytics or other non-essential measurement technologies. | Prior, freely given, specific, informed and unambiguous consent. | Articles 6(1)(a) and 7 GDPR; Article 5 of Portuguese Law No. 41/2004. |
| Protect the website, prevent abuse and maintain technical security. | Legitimate interest in system security and, where applicable, compliance with legal obligations. | Articles 6 and 32 GDPR. |
4. Information provided at collection
Under Articles 12 and 13 GDPR, NEXO aims to provide information in a clear, accessible and transparent way. Fields marked as mandatory are required to process the relevant request; without them, it may not be possible to submit or answer the request.
Submitting a quote request does not automatically create a contract. The final scope and terms of any service are defined after review and validation by NEXO.
5. Cookies, local storage and Analytics
Technologies strictly necessary for the website to operate may be used without consent where they fall within the exception in Article 5(2) of Portuguese Law No. 41/2004. Analytics and other non-essential technologies remain disabled until consent is given.
Where processing relies on consent, consent may be withdrawn at any time as easily as it was given, without affecting the lawfulness of earlier processing, under Article 7(3) GDPR. See also the Cookie Policy.
6. Providers and recipients
NEXO uses technology providers only to the extent necessary to operate the website and process requests. The current architecture uses Netlify for hosting and functions, Supabase for the database and lead records, Resend for email notifications, and Google Analytics or Google Tag Manager only when optional measurement is authorised.
These providers may act as processors under Article 28 GDPR. Access is limited to what is necessary to provide their services and is subject to applicable contractual and data-protection terms.
7. International transfers
Some providers or subprocessors may process data outside the European Economic Area. Where personal data is transferred internationally, NEXO must ensure a valid mechanism under Articles 44 to 49 GDPR, such as a European Commission adequacy decision or appropriate safeguards, including Standard Contractual Clauses where applicable.
8. Data retention
Data is kept for as long as necessary to respond to the request, manage the business relationship, defend legal rights and comply with applicable legal obligations. Where no specific statutory period applies, retention is based on necessity, proportionality, request status and the existence of a business relationship, with periodic review and deletion when the data is no longer needed.
9. Data-subject rights
Under Articles 15 to 22 GDPR, and where the relevant conditions apply, you may exercise the rights of access, rectification, erasure, restriction, portability, objection and the right not to be subject to certain solely automated decisions.
Requests may be sent to nexogeral@outlook.pt. Under Article 12(3) GDPR, a response will be provided without undue delay and, as a rule, within one month, without prejudice to legally permitted extensions for complex or numerous requests.
Where processing is based on consent, you may withdraw it at any time. You may also lodge a complaint with the Portuguese Data Protection Authority (CNPD) under Article 77 GDPR, without prejudice to other administrative or judicial remedies.
10. Security and data protection by design
NEXO applies technical and organisational measures designed to protect data confidentiality, integrity and availability in accordance with Articles 25 and 32 GDPR. Private keys, credentials and sensitive operations are kept server-side and must not be exposed to the browser.
11. Automated decisions and profiling
The simulator may organise information and perform internal supporting calculations, but it does not make solely automated decisions that produce legal effects or similarly significantly affect the data subject. Requests are reviewed by a person before any proposal or contract.
12. Changes to this policy
This policy may be updated when features, providers, processing practices or applicable law change. The date shown at the top identifies the currently published version.