1. Controller
The controller is White Lodge Solutions, S.L.U., trading as NordPax AI, tax ID (NIF) B02648814, VAT ID ESB02648814, Calle Lillo 3, Floor 3B, 28041 Madrid, Spain. Email: [email protected].
This policy covers personal data we process through nordpax.ai and when we prepare or deliver services to companies. We do not sell personal data.
2. Data we process
Depending on how you deal with us, we may process:
- Identity and contact details: name, email address and, if you provide it, company.
- The content of the enquiry: the process or need you describe in the contact or diagnostic form, and the language of the form.
- Engagement data, if a proposal is accepted: what we need to deliver the service, invoice and meet legal duties.
- Browsing data, only if you accept analytics cookies: pages viewed, where the visit came from, approximate device and events such as a form submission (without your name or email). Processed by Google Analytics.
- Technical server data: IP address, browser type, date and time, and the page requested. The host records these for security. We do not use them to build profiles.
3. Purposes
We use the data to:
- Answer contact and diagnostic requests.
- Prepare quotes and proposals.
- Deliver the contracted service and maintain the commercial relationship.
- Meet accounting, tax and other legal duties that apply.
- Protect the site against abuse and security failures.
4. Legal bases
Answering an enquiry and preparing a proposal rely on steps taken at the request of the person writing to us before a contract (GDPR article 6.1.b).
Delivering a contracted service relies on performance of the contract (article 6.1.b).
Keeping invoices and books relies on compliance with legal obligations (article 6.1.c).
Web analytics relies on your consent (article 6.1.a), which you can withdraw at any time from the cookie banner.
Technical security logs rely on the legitimate interest in keeping the site secure (article 6.1.f). That interest does not override people's rights where the logs are used only for security and for a limited time.
The form checkbox records that this policy has been read. We do not use the data to send marketing sequences or newsletters.
5. Retention
Enquiries that do not become a contract are kept for as long as needed to reply and, at most, for twelve months from the last contact. They are then deleted or anonymised.
Contract and billing data are kept for the life of the relationship and afterwards for the periods required by Spanish law: six years for commercial records (article 30 of the Commercial Code) and four years for tax obligations (article 66 of the General Tax Act), where those periods apply.
Technical logs are kept for as long as the hosting provider retains them for security. We do not turn them into a client file.
6. Recipients and processors
We do not pass data to third parties for their own use. The following may access it as processors, and only to provide a service to us:
- Cloudflare, Inc., which hosts the site, protects it against abuse (Turnstile) and processes form submissions and keeps a backup copy of each message for up to twelve months.
- Resend (Plus Five Five, Inc.), which delivers form messages to the [email protected] inbox.
- Google Ireland Limited, with Google Analytics and Google Tag Manager, only if you accept analytics cookies.
- CookieYes Limited, which runs the banner and stores your cookie choice.
- HubSpot, Inc. (data hosted in the European Union), the CRM where we keep form contacts and manage call bookings. Details in section 7.
- The email provider we use to read and reply to messages sent to [email protected].
7. Contact management (CRM): HubSpot
When you write to us through the form or book a call, we store your data in our CRM, HubSpot, so we can reply and follow up on the conversation: first name, last name, email, company, message, language and page of origin and, if you book, the call date and your answers to the booking form.
- Provider: HubSpot, Inc. (USA), acting as processor under a signed data processing agreement (DPA).
- Where it is stored: in HubSpot's European Union data centre.
- International transfers: HubSpot may access data from outside the EEA for support purposes. These transfers are covered by the EU-U.S. Data Privacy Framework, under which HubSpot is certified, and by the European Commission's standard contractual clauses.
- Legal basis: taking pre-contractual steps at your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering and following up on your enquiry (Art. 6(1)(f)).
- Retention: for as long as the business relationship lasts or, if none begins, as set out in section 5: up to twelve months from your last contact.
- We do not use HubSpot to send you marketing without your prior consent.
8. International transfers
Cloudflare, Resend, Google, HubSpot and some email providers may process data in the United States. Where that happens, the transfer relies on the EU-US Data Privacy Framework if the provider is certified, or on the applicable standard contractual clauses.
We will also disclose data to authorities when the law requires it.
9. Rights
You may request access, rectification, erasure, restriction and portability, and you may object to processing based on legitimate interest. To exercise a right, email [email protected], name the right and give an address for the reply.
If you believe the processing does not comply with the law, you may complain to the Spanish Data Protection Agency (AEPD), Calle Jorge Juan 6, 28001 Madrid, https://www.aepd.es.
We do not make automated decisions that produce legal effects or similarly significantly affect you.
10. Children
The services and the site are aimed at companies, not at children. We do not knowingly collect data from anyone under 14. If we learn that we have received a child's data, we delete it. You can tell us at [email protected].
11. Changes
If this policy changes, we will publish the new version on this page with a new update date.