Privacy policy

1. Data controller

The controller of the personal data collected through this website and the Nexelia platform is:

• Owner: Madalin George Lingurar (sole trader)
• Tax ID (NIF): X7976831V
• Address: Calle Voleibol 4, Bajo-C, 04131 Retamar, Almería (Spain)
• Contact email: madalin.lingurar@gmail.com

2. Data we process

• Account and access data: name, email, password (stored encrypted as a hash) and platform role.
• Billing data: tax and payment details needed to manage sign-up and subscription. Card details are processed directly by Stripe; Nexelia does not store them.
• Support and contact data: whatever you provide when writing to us (name, email, organization and message content).
• Technical data: IP address and activity logs needed for service security (for example, rate limiting).

3. Purposes and legal basis

We process your data for the following purposes, on the legal bases of Article 6 GDPR indicated:

• Creating and managing your account and giving you access to the platform — performance of the contract (Art. 6(1)(b) GDPR).
• Managing sign-up, subscription and billing, and complying with tax and accounting obligations — performance of the contract and legal obligation (Arts. 6(1)(b) and 6(1)(c) GDPR).
• Sending transactional emails (confirmations, account notices, receipts, password resets) — performance of the contract (Art. 6(1)(b) GDPR).
• Handling enquiries and support requests — performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR).
• Keeping the service secure and preventing abuse — legitimate interest (Art. 6(1)(f) GDPR).

We do not use your data for advertising and we do not build commercial profiles.

4. Recipients and data processors

We do not sell or share your data with third parties. To provide the service we rely on providers acting as data processors, with whom the agreements required by Article 28 GDPR are in place:

• Vercel Inc. — application hosting (United States).
• Neon Inc. — database (United States).
• Stripe Payments Europe, Ltd. / Stripe, Inc. — payment processing (Ireland / United States).
• Cloudflare, Inc. — video storage and delivery via R2 (United States).
• Resend, Inc. — transactional email delivery (United States).

We may also disclose data to public authorities where a legal obligation so requires.

5. International transfers

Some of these providers are located in the United States or operate infrastructure outside the European Economic Area. In those cases, transfers rely on the EU-U.S. Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission, together with additional safeguards where necessary.

6. Retention periods

• Account data: while the account is active and, after cancellation, kept blocked for the limitation periods of potential legal claims.
• Billing data: for the periods required by tax and commercial law (generally up to 6 years under the Spanish Commercial Code).
• Support and contact data: as long as needed to handle the request and, afterwards, for the applicable limitation periods.
• Technical logs: short periods proportionate to the security purpose.

7. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, portability and restriction of processing by writing to madalin.lingurar@gmail.com, indicating the right you wish to exercise and providing information that allows us to verify your identity.

If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Cookies

This site only uses technical cookies, which are exempt from consent under Article 22.2 of the Spanish LSSI-CE: the session cookie, required to authenticate users, and the nx_lang cookie, which stores your language preference. We do not use analytics or advertising cookies.

9. Nexelia as data processor

When an academy uses the platform to manage its own students, that academy is the controller of its students' data and Nexelia acts as a data processor, under the data processing agreement that forms part of the service terms.

10. Changes to this policy

We may update this policy to reflect regulatory or service changes. The current version will be published on this page and, if the changes are significant, we will notify you by email.