Privacy policy

The controller of the personal data collected on this site is its owner:

Name or company name

RAMON-ANTONIO-ARIAS-ABREU

Tax ID (NIF)

53849973G

Address

CALLE-VALDERROMAN-34-MADRID-SPAIN

Email

contact@niloa.es

The owner has not appointed a data protection officer because there is no obligation to do so: the owner is not a public authority or body; the owner’s core activity does not consist of regular and systematic monitoring of individuals on a large scale, or of large-scale processing of special categories of data or data relating to criminal convictions and offences (article 37(1) GDPR); and the owner is not one of the entities listed in article 34.1 of the Spanish data protection act (LOPDGDD).

For any question about your data, write to the controller’s email address.

We process the data you give us when you write to us, through the contact form or by email: your email address, the content of your message and, if you choose to give them, your name and your company’s name. If you write to us directly by email, also the data you include in it, such as your signature or attachments. Along with the message, the form tells us the language of the page you are writing from, so that we can reply in that language.

We use this data only to read your message, reply to you and continue the conversation you start until it ends. We do not use it to send you advertising or for any other purpose, and we do not combine it with data from other sources.

Your messages are read and answered by a person. We do not use artificial intelligence tools to read or answer them.

Please do not include health data or other specially protected data. If you do, we will not use it, we will reply without repeating it and we will erase the conversation when it ends, without waiting for the monthly mailbox review. Please do not include data about other people that is not needed for your enquiry either.

To send the form you must give your email address and write a message: without them we cannot reply, and the form is not sent. Your name and company are optional; if you leave them out, we will still reply.

Providing this data is not a statutory or contractual requirement.

We process your data because we have a legitimate interest in replying to people who write to us and in dealing with what they ask (article 6(1)(f) GDPR). If you write on behalf of your company or as a professional, Spanish law also presumes, unless proven otherwise, that processing your business contact details is based on that legitimate interest (article 19 LOPDGDD).

Before starting to process this data, we assessed in writing that your interests and rights do not override that interest: you decide whether to write to us and what to tell us, a reply is what you expect when you do, we only ask for the data we need, we keep it for a limited time and you can object at any time.

We keep your messages, our replies and the data they contain for a maximum period of 12 months from the last message we exchange. We review the mailbox once a month so that no conversation goes beyond that period.

If you ask us to erase your data or object to its processing, we erase it at that point, without waiting for the monthly review.

If the conversation leads to an engagement, the necessary data moves to the management of that relationship and is kept in line with its contract and the legal obligations that apply to it.

Erasing does not mean deleting straight away: Spanish law requires us to block the data first (article 32 LOPDGDD). We keep it blocked, without using or viewing it, for up to 3 years, only to make it available to the courts, the public prosecutor or the competent authorities, in particular data protection authorities, should any liability arising from the processing need to be addressed. After that, we destroy it.

If, while it is blocked, we receive a complaint or an order from an authority or a court about a conversation, we keep it blocked until those proceedings end.

While the data is blocked, the basis for processing is no longer our legitimate interest but the legal obligation to block it (article 6(1)(c) GDPR), so you cannot object during that time.

In addition, what we erase from the mailbox may remain in the backups of our email provider, IONOS, for as long as IONOS keeps those backups. We have asked IONOS what that period is and will state it on this page.

We use two providers that process your data on our behalf and on our instructions, as processors, under the data processing agreements that each of them publishes and that we have accepted (except as explained under “Browsing and hosting”):

Scaleway SAS (France) hosts this site and the form, and forwards to us by email the messages you send with it. Scaleway erases the content of those emails, including the subject, your message and your address, almost immediately after it delivers them to our mailbox or, if the sending is finally rejected, as soon as it is rejected. If delivery is delayed, it may keep them in a queue for a maximum period of 36 hours. Once erased, they may remain in its backups for a maximum period of 7 days.

Scaleway keeps technical logs and metadata of each sending for as long as our domain remains active in its service. As it has confirmed to us in writing, those logs contain the date, the outcome and the delivery attempts, with the response from our mail server, the technical identifiers of the sending, the IP address from which Scaleway sends it, and the sender and recipient of the sending, which are always the same and do not include your data. They do not contain the subject or the message: your address is only inside the message.

IONOS Cloud S.L.U. (Spain) provides the email service for our domain: we receive and store messages there, both those from the form and those you send us directly, and we reply to you from it. Like any email service, it also processes technical data about the delivery of each message, such as the sender and recipient addresses, and filters unwanted email. We have asked IONOS which logs of that delivery it keeps, for how long and whether it processes them on our behalf or on its own account, and will state it on this page.

We do not disclose your data to anyone else unless the law requires us to; for example, in response to an order from a court or an authority.

We do not intend to transfer your data outside the European Economic Area (EEA), and we are not aware of a transfer of your data. Our providers’ contracts govern this as follows:

IONOS: under its data processing agreement (clause 4.3), processing takes place in a Member State of the European Union or of the EEA, unless a transfer to third countries is necessary to provide the service; in that case, IONOS must meet the requirements of articles 44 et seq. of the GDPR. According to the list of sub-processors it publishes, those of our email service are in Germany. We have asked IONOS whether that exception applies to our email service and, if so, to which countries and with which safeguards, and will state the answer on this page.

Scaleway: under its data processing agreement (article 11), its services are located in the European Union by default, and it may not transmit, disseminate or store personal data in a country outside the European Union without having expressly informed us in advance, unless the law of the European Union or of the Member State to which it is subject prohibits it from giving us that information on important grounds of public interest. Should it transfer personal data outside the European Union or to a country without an adequacy decision, that agreement requires it to apply the European Commission’s standard contractual clauses (Commission Implementing Decision (EU) 2021/914), in their controller-to-processor module, and to take the technical and organisational measures needed to protect the data.

For this site we have chosen its Paris region (France). For sending the form emails, Scaleway has told us in writing that this data is processed only by Scaleway SAS, in France, and its documentation for that service states that no personal data is transferred outside the European Union. For its services as a whole, its documentation also states that, in rare and exceptional cases, it may work with partners in the United States or Canada, under recognised adequacy mechanisms, such as the EU-US Data Privacy Framework, and under the standard contractual clauses of its agreement.

If we learn of a transfer affecting your data, we will update this page and state the safeguards that apply. You can ask us for a copy of the safeguards that apply to a transfer of your data by writing to the controller’s email address.

You can exercise the rights under articles 15 to 22 of the GDPR at any time and free of charge:

Access (article 15): find out whether we process data about you and obtain a copy, together with the information in this policy.

Rectification (article 16): have inaccurate data corrected, or incomplete data completed.

Erasure (article 17): ask us to erase your data. We will do so whenever you ask, even if none of the cases in article 17 applies, with the blocking explained under “Retention period”.

Restriction of processing (article 18): ask us only to store your data, without using it, in the cases that article provides for; for example, while we check its accuracy, if you prefer that to erasure or when you need it for a legal claim.

Notification to recipients (article 19): if we rectify, erase or restrict your data, we will tell everyone we have disclosed it to, unless this proves impossible or involves disproportionate effort, and we will tell you who they are if you ask.

Portability (article 20): receive the data you gave us in a structured format, where processing is based on your consent or on a contract. As this processing is based on our legitimate interest, this right does not apply; even so, if you ask, we will send you a copy of your messages in a commonly used format.

Objection (article 21): object to our processing of your data, as explained in the next section.

Automated individual decisions (article 22): not to be subject to decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We do not take decisions of that kind.

To exercise them, write to the controller’s email address or by post to the address shown above, saying which right you wish to exercise. If you write from the same email address you used to contact us, we will not ask for anything else; otherwise, only what is needed to confirm your identity.

We will reply without undue delay and in any event within one month of receiving your request. Where necessary, given its complexity or the number of requests, that period may be extended by two further months; in that case we will tell you within the first month, with the reasons. If we do not act on your request, we will tell you why within that month and that you can lodge a complaint with the supervisory authority or go to court.

You can object at any time to our processing of your data (article 21 GDPR), without having to tell us why. Just write to the controller’s email address or reply to any of our emails.

If you object, we will stop processing it and erase your conversation, without claiming grounds to keep using it. We will only keep it blocked, as the law requires and as explained under “Retention period”.

If you believe we have not handled your data properly or have not respected your rights, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the supervisory authority of the EU Member State where you live or work or where the alleged infringement took place (article 77 GDPR). If you prefer, you can write to us first to try to resolve it.

We do not take decisions based solely on automated processing of your data, and we do not build profiles.

When you visit this site, your browser sends, as with any website, your IP address and technical details of the request, such as the page you ask for, the type of browser and the language. We use them only to deliver the page to you and keep the site secure, on the basis of our legitimate interest in doing so (article 6(1)(f) GDPR). Scaleway’s use on its own account is explained below.

The application that runs this site does not store your IP address or the pages you visit, and its technical logs contain no data about visitors or about what is entered in forms.

This site is hosted by Scaleway, whose platform receives that data to deliver the page to you. In addition, as Scaleway has told us in writing, its platform logs for each request your IP address, the date and time, your browser’s identification (which usually shows its type, its version and your operating system) and the response code, but not the page you ask for, and keeps those logs for a period of 70 days. Scaleway uses them on its own account, as controller, to calculate the service level it guarantees us, and on our behalf, as processor, only if we ask its technical support for help with an incident. Only Scaleway’s internal teams have access to them. Scaleway has told us that its use on its own account is governed by its privacy policy, published at www.scaleway.com/en/privacy-policy/.

If you go to niloa.es without “www”, the request first reaches IONOS, our domain provider, which receives that same data to redirect you to www.niloa.es and may log it. We have asked IONOS what data it logs from that redirection, for how long, in which country and whether it does so on our behalf or on its own account, and will state the answer on this page.

This site does not use cookies, analytics tools or third-party resources. The details are on the cookies page.

If anything explained in this policy changes, for example a provider, or we receive the answers we are waiting for from our providers, we will publish the new version here.

If a change shows that your data was processed in a way this policy did not explain, for example through a transfer outside the EEA or through processing by a provider on its own account, and you had already written to us, we will also tell you by email, or in our reply if we have not answered you yet. We cannot do so if your data is already blocked, because the law then does not allow us to use it.

Date of this version: 2026-10-21.