Política de Privacidad

Introduction

The companies operate under the highest level of commitment to responsibility and compliance with data protection regulations. In view of the above, this document has been prepared in order to provide information on the processing of personal data within the scope of the activities carried out by the companies of the NEXUM Group, as well as to inform data subjects of their data protection rights and of the service and support mechanisms made available in this regard.

Grupo NEXUM carries out its activities through a centralized organizational structure, managed from the offices in Pozuelo de Alarcón (Madrid), Spain. Therefore, the processing of personal data will be carried out in accordance with the data protection regulatory framework implemented through the General Data Protection Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD).

Scope of Application

This data protection information refers to the processing of personal data collected within the framework of the activities and operations of the NEXUM Group through the various available contact mechanisms, and which are processed for the purposes listed in the “Purposes” section.

Below, we list the categories of individuals regarding whom we collect and process personal data:

Shareholders and investors
Advisors
Candidates
Empleados
Interns
Personnel Provided by Temporary Employment Agencies
Self-Employed Individuals’ Data (Suppliers or Collaborators)
Individuals Visiting the Offices and Facilities of NEXUM Group Entities
Individuals Communicating with NEXUM Group Entities for Any Reason
Own Legal Representatives
Legal Representatives and Contact Persons of Clients / Contracting Authorities
Legal Representatives and Contact Persons of Suppliers
Legal Representatives and Contact Persons of Collaborating Entities for the Provision of Products and Services
Individuals Involved in NEXUM Group Projects for Coordination Purposes and Compliance with Regulatory Requirements and Occupational Risk Prevention
Data Subjects Whose Involvement Is Necessary in the Provision of Products and Services as Data Processor
Users of the Regulatory Compliance Mechanisms Implemented by the Group

Data Controller

This data protection information is established on behalf of the NEXUM Group and therefore applies to and encompasses all companies belonging to the Group that will process personal data as Data Controllers.

The contact details of the NEXUM Group for the purposes of this data protection information, as well as those of the Group Data Protection Officer, are as follows:

Address / Postal Code: Calle Ciudad Real, 1, A, 28223, Pozuelo de Alarcón (Madrid)

Email: nexum@

Telephone: 911548520

Data Protection Officer (DPO): dpdexterno@bonetconsulting.com

NEXUM Group General Channel: www.corporate-ethicline.com/nexum

Data Protection

The NEXUM Group comprises various companies through which it develops its projects and services nationwide. For these purposes, two subgroups have been structured: NEXUM FINANZA, S.L. and NEXUM INTEGRA, S.L. The identifying and contact details of the companies that make up each subgroup are detailed below:

Entity: NEXUM FINANZA, S.L.
Tax ID: B-87014031
Address / Postal Code: Calle Ciudad Real, 1, A, 28223, Pozuelo de Alarcón (Madrid)
Email: admin@nexumfinanza.es
Telephone: 911548520
Websites: www.nexumfinanza.es / www.nexumcapital.es

Entity: NEXUM CRETA, S.L.
Tax ID: B-01624600
Address / Postal Code: Calle Ciudad Real, 1, A, 28223, Pozuelo de Alarcón (Madrid)
Email: admin@nexumfinanza.es
Telephone: 911548520

Entity: INHABITAT STUDY HOUSES, S.L.
Tax ID: B-54948914
Address / Postal Code: Calle Marqués de Campo 31A – 3º, 03700 Denia (Alicante)
Email: info@inhabitat.es
Telephone: 900533874

Entity: CAN PICAROL, S.L.
Tax ID: B-57523102
Address / Postal Code: Carretera de Artá, number 88 ground floor, Port d Alcudia, 07400, Mallorca (Balearic Islands)
Email: admin@nexumfinanza.es
Telephone: 911548520

Entity: IH FLA144, S.L.
Tax ID: B-16955064
Address / Postal Code: Calle Ciudad Real, 1, A, 28223, Pozuelo de Alarcón (Madrid)
Email: admin@nexumfinanza.es
Telephone: 911548520

Entity: NEXUM INTEGRA S.L.
Tax ID: B-87279592
Address / Postal Code: Calle Ciudad Real, 1, A, 28223, Pozuelo de Alarcón (Madrid)
Email: dpo@nexumintegra.es
Telephone: 911548520
Websites: www.nexumimtegra.es

Entity: MONTE ENCINAS BY NEXUM, S.L.U.
Tax ID: B-88011564
Address / Postal Code: Calle Ciudad Real, 1, A, 28223, Pozuelo de Alarcón (Madrid)
Email: admin@nexumfinanza.es
Telephone: 911548520

Entity: VALDESQUI 45 LUXURY HOMES, S.L.
Tax ID: B-87981973
Address / Postal Code: Calle Ciudad Real, 1, A, 28223, Pozuelo de Alarcón (Madrid)
Email: valdesqui45@nexumintegra.es
Telephone: 911548520

Entity: ZENIT 21 BY NEXUM, S.L.
Tax ID: B-88102892
Address / Postal Code: Calle Ciudad Real, 1, A, 28223, Pozuelo de Alarcón (Madrid)
Email: admin@nexumfinanza.es
Telephone: 911548520

Entity: VALLE DE ASPE 32, S.L.
Tax ID: B-87994281
Address / Postal Code: Calle Ciudad Real, 1, A, 28223, Pozuelo de Alarcón (Madrid)
Email: admin@nexumfinanza.es
Telephone: 911548520

Entity: FLAMINGOS GOLF AND BEACH VILLAGE, S.L.
Tax ID: B-87598660
Address / Postal Code: Calle Ciudad Real, 1, A, 28223, Pozuelo de Alarcón (Madrid)
Email: admin@nexumfinanza.es
Telephone: 911548520

Source

Directly from Data Subjects: NEXUM Group Entities collect personal data directly from data subjects when they send an email, contact by telephone, complete a form, submit their CV, complete a questionnaire, or when necessary for the formalization of an agreement of any nature or to request assistance through the channels provided for this purpose.

Provided by Third Parties: personal data may also be collected when provided by a third party in the context of managing and fulfilling a contract for the provision of services and for the coordination of regulatory requirements associated with it.

Data Processors: NEXUM Group Entities may collect, access, and process personal data as Data Processors by virtue of the services provided to their clients.

This processing shall be governed by the data protection policies and information provided by the relevant Data Controller.

Processing Purposes

Within the NEXUM Group, we will maintain, use, and disclose personal information always within the limits of current data protection regulations and for the following purposes:

To manage your attention, visit, and meetings at our facilities and/or managed properties.
To manage any type of request, information, suggestion, petition, or complaint regarding the various products and professional services provided by NEXUM Group Entities that data subjects submit to us on their own behalf or on behalf of an entity.
To manage the relationship with our shareholders and investors.
To manage the provision and delivery of contracted services and products:
- Real Estate Sector
  - Real Estate Development and Management
  - Professional Consulting and Advisory Services
  - Location and Negotiation of Assets for Real Estate Investments
  - Marketing of Real Estate Projects
  - Architecture and Design
  - Commercial Design and Sales
  - To manage intermediation services as a real estate agent in commercial transactions of purchase and sale, exchange, transfer, assignment, and leasing of real property, as well as for the processing and promotion of matters related to real estate transactions and valuation of real estate assets and rights of any kind.
- Financial Sector
  - Financial Consulting and Advisory Services
  - Analysis and Assessment of Financial Situation
  - Granting of Mortgage-Backed Loans
  - Granting of Private and Bank Capital Loans
  - Financial Intermediation Services
  - Investor Portal Management
- Users may access detailed information about the activities of NEXUM Group in the “Services / Products” section of the websites of the various Group companies (www.nexumfinanza.es, www.nexumintegra.es, www.gestoriza.es).
To comply with coordination and regulatory compliance requirements, particularly regarding occupational risk prevention in the context of providing services and products and in health matters.
To formalize and manage the relationship with the Entities’ suppliers and collaborators.
To manage the various websites, intranets, social networks, and blogs owned by the Group.
To formalize and manage agreements for a Temporary Business Association (UTE) in which the Entities participate.
To send informative and commercial communications about our promotions, products, and services of the NEXUM Group related to the real estate and financial sectors, as well as to inform recipients about upcoming events in which the NEXUM Group will participate, activities, articles on innovations related to both sectors and the solutions provided, as well as general information related to our services, products, and projects that may be of interest to you.
Receipt of our communications may be canceled at any time through the channel www.corporate-ethicline.com/nexum or by unsubscribing through the link provided in the communication itself.
To manage data provided by candidates for a job position for selection and recruitment purposes.
To formalize, develop, maintain, and fulfill our obligations acquired by virtue of an employment or professional relationship or an agreement/convention with a third party.
To ensure the security of offices, facilities, and individuals through access controls, video surveillance systems, and other access control/identification systems.
To manage and control the operation of internal mechanisms, policies, and protocols established by the NEXUM Group for regulatory compliance purposes, prevention of criminal liability, prevention of money laundering, and management of whistleblowing channels.
To comply with legal provisions applicable to the Entities and their activities.
All processing applicable to us for due compliance with regulations and official/sectoral requirements to which our activity is subject.

For the proper purpose and development of your attention and management of the aforementioned purposes, the processing of your data for the corresponding purposes mentioned above will be carried out in strict compliance with Data Protection regulations and the Policy we are detailing to you. You may exercise your rights at any time (see specific section).

Legal Bases for Processing

The legal bases that enable the processing of personal data within the framework of NEXUM Group activities and operations are as follows:

The consent of data subjects for the processing and management of any request for information or inquiry about our services, products, and/or activities.
The contracting and/or awarding framework for services or products provided by the various business lines of the NEXUM Group, as well as compliance with the legal obligations associated with them.
The contractual framework established with our shareholders and investors, as well as compliance with obligations imposed by corporate regulations.
The contracting framework with our suppliers.
Legitimate interest in conducting due diligence checks and formalizing and managing agreements for the establishment of a UTE.
Legitimate interest in understanding and analyzing at Group level and individual Entity level the development of various business lines, improving products and services, and enhancing the Group’s corporate development.
Legitimate interest in sending informative and commercial communications related to our activity and the services and products offered via email or any other means.
Legitimate interest in ensuring the security of offices, facilities, and individuals.
Consent granted by the candidate when applying for our job offer(s) and the organization’s legitimate interest in including them in other selection processes of Group companies provided they match the candidate’s professional profile.
Fulfillment of the employment contract, professional agreement, and/or convention formalized with training entities.
Legitimate interest in implementing a regulatory compliance system, as well as in meeting security requirements and ethics and sustainability commitments.
Compliance with legal requirements and obligations to which NEXUM Group activity is subject.

Data Retention Criteria

Project Management and Execution: personal data included in contracts, offers, and/or service proposals, as well as that of other individuals whose involvement is necessary in the established contractual relationship, will be retained for as long as the service/product provision agreements remain in effect. Upon termination of the relationship, personal data will be retained in cases where liabilities may arise between the parties or in compliance with other regulatory frameworks applicable to it that require their retention. Personal data will be maintained in a manner that allows identification and exercise of the Rights of data subjects and under the technical, legal, and organizational measures necessary to ensure their confidentiality and integrity. Among other cases:

Analysis and Assessment of Financial Situation: Personal data will be retained for the time necessary to conduct the study for granting loans to interested parties.
Management of Mortgage Loan Granting: Personal data provided in the contract will be retained for the duration of said contract. Upon termination of the contract, data will be retained in cases where necessary to comply with Law 2/2009, of March 31, regulating contracting with consumers of mortgage loans or credits and intermediation services for the conclusion of loan or credit contracts, as well as in cases where liabilities may arise with the Entity and/or in compliance with other applicable regulatory frameworks requiring their retention.

CV Management: as a general rule, we retain your CV for a maximum period of one year; once this period has elapsed, it will be automatically destroyed in compliance with the data quality principle.

Management of Employment Contracts, Internship Agreements, and/or Contracts Formalized with Temporary Employment Agencies: personal data will be retained, in any case, for as long as the employment relationship remains in effect, the time agreed in the internship agreement or in the contract formalized with the Temporary Employment Agency and, upon its termination, in cases where liabilities may arise between the parties and when required by a law.

Other: the rest of the data and information provided by data subjects by any means will be retained for as long as necessary to fulfill the purpose for which they were collected and within the framework of responsibility and regulatory compliance associated with them. In any case, legal data retention periods will be respected and, if no legal requirement prevents it, they will be destroyed or anonymized.

Security and Control Measures

General

NEXUM Group, in fulfillment of its commitment to compliance with data protection regulations, will maintain personal data in a manner that allows identification and exercise of Rights by data subjects and under the technical, legal, and organizational measures detailed below:

Appointment of a Group Data Protection Officer (DPO).
Implementation of policies and action protocols regarding data protection and information security.
Formalization of Data Processor contracts with all third parties who access and process data on our behalf.
Implementation of access control policies for resources and systems, identification and authentication policies, as well as delegation of authorizations to users according to the functions they perform.
Backup and recovery of our information and personal data.
Periodic data protection audits and controls by an external expert.

We appreciate your bringing to the attention of the Data Controller / Data Protection Officer, through the contact details / Channel established in this Privacy Policy, any security risks of which you have indications or knowledge that may compromise the integrity and confidentiality of personal data and/or confidential information, in order to adopt the necessary measures to prevent unauthorized processing, loss, destruction, or accidental damage.

Cybersecurity

As a specific concept complementary to the above, the Entity applies cybersecurity measures to prevent and manage possible attacks and fraud by cybercriminals that threaten the privacy and protection of data that our Entity processes and accesses in the scope of its activities and operations.

In this regard, we wish to alert you that in possible risk situations due to communications whose content and/or format generate doubts about authenticity, we recommend disregarding them and contacting the Data Controller / Data Protection Officer through the contact details indicated in this Privacy Policy.

Likewise, any request you receive originating from our Entity regarding changes in payment methods, requests for data or contact persons or confidential (non-public) information, bank details and/or credit card data and/or other official data, should not be attended to without direct confirmation from our Entity by another alternative means. We appreciate and need your collaboration in reporting and denouncing any notification about this type of request and other possible cyberattack risk situations in which our Entity may be used, as well as any possible security risk of which you may have knowledge.

Recipients

NEXUM Group, whenever necessary for the achievement of the purposes described above, will share personal data with the following third parties:

NEXUM Group Companies: when necessary for the proper management of a service or product provision contract, for Group management by virtue of its centralized organizational structure, for sending commercial communications related to the real estate and financial sectors, as well as for sharing candidate data whose profiles may fit vacancies in the Entities.
Collaborating Entities: when their participation is required within the framework of a contract and/or agreement for the provision of products and services established with our clients or a public Entity. Likewise, personal data may be communicated within the framework of a Temporary Business Association agreement for the execution of a project.
Suppliers: personal data may be communicated to various suppliers by reason of the provision of services by them that requires access to and processing of personal data, such as, for example, consulting and legal advisory service providers, labor, tax, and accounting advisory providers, software providers and maintenance services thereof, etc.
Attorneys: if their intervention is required by reason of a judicial proceeding.
Financial Entities: when necessary to offer private capital solutions and materialize the financing management service.
Notaries: when their intervention is necessary to act as public notary of the transaction or formalization of the contract, providing full proof of the reality of the execution, the literal nature of the parties’ statements, and their identity.
Public Administrations or agencies in compliance with applicable regulations (labor, occupational risk prevention, tax, accounting, data protection, etc.).
Courts and Tribunals and State Security Forces: personal data will be communicated to these entities whenever officially required.

Apart from the cases detailed above, personal data will not be communicated to third parties, except in compliance with a legal provision.

Rights

Right of Access, Rectification, and Erasure: data subjects have the right to obtain confirmation as to whether NEXUM Group is processing personal data concerning them or not, as well as to request rectification of inaccurate data or request their erasure when, among other reasons, the data are no longer necessary for the purposes for which they were collected.

Right to Restriction and Objection: in certain circumstances, data subjects may request restriction of the processing of their data, in which case we will only retain them for the exercise or defense of claims or when necessary in compliance with a law. Likewise, in some cases and for reasons related to their particular situation, data subjects may object to the processing of their data. We will cease processing the data in this case, except for compelling legitimate reasons, or for the exercise or defense of possible claims.

Likewise, data subjects may revoke the consent granted for the processing of data for specific purposes, such revocation not having retroactive effects.

Data subjects may exercise their data protection rights by writing to the postal address c/ Ciudad Real, 1, A, 28223, Pozuelo de Alarcón (Madrid) or through the Group’s general Channel www.corporate-ethicline.com/nexum or specific to GESTORIZA INVERTIA, S.L. www.corporate-ethicline.com/gestoriza. Likewise, if you do not receive a response from us within one month, you may file a complaint with the Supervisory Authority (Spanish Data Protection Agency: www.agpd.es).

Security Breaches

In case of disagreements with the Entity regarding the processing of your data, you have the right to file a complaint with the corresponding Data Protection Supervisory Authority. In Spain, said Authority is the Spanish Data Protection Agency (www.aepd.es).

Attention and Support

NEXUM Group has appointed a Data Protection Officer (DPO) to provide support and information regarding data protection and in relation to the information provided in this Privacy Policy. The DPO’s contact details are specified at the beginning of this Policy.

Updates and Modifications

NEXUM Group reserves the right to modify and/or update the data protection information when necessary for proper compliance with regulations in this matter. If any modification occurs, the new text will be published in this same section of the website. In each case, the relationship with users will be governed by the rules in effect at the precise moment they access the website.