Privacy policy

1. Summary

• Controller: Nebula Software Solutions Ltd Co (HelixNebula).
• Purposes: answering your enquiry, preparing a quote and managing any resulting business relationship; protecting the Site against abuse.
• Legal bases: pre-contractual steps taken at your request and your consent; legitimate interest for security.
• Recipients: Vercel Inc. (hosting) and Resend (email delivery), as processors. We do not sell your data.
• Transfers: to the USA, under the EU-US Data Privacy Framework or Standard Contractual Clauses.
• Retention: up to 2 years after the last contact, unless you become a client.
• Rights: access, rectification, erasure, restriction, portability, objection and withdrawal of consent, by writing to privacidad@helixnebula.dev. You may complain to the Spanish Data Protection Agency (AEPD) or your local authority.

2. Data controller

• Controller: Nebula Software Solutions Ltd Co (trading as HelixNebula), a company organized in New Mexico (USA)
• Address: 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, New Mexico (USA)
• Data protection: privacidad@helixnebula.dev
• General contact: hola@helixnebula.dev
• EU representative (Art. 27 GDPR): Juan · juan@helixnebula.dev. You may contact our representative directly about any matter concerning your data.

3. Data we process

Contact form. Your name, email address, company (optional), the services you are interested in, approximate budget, your message, the language you are browsing in, and your acceptance of this policy.

Email. The data contained in the messages we exchange with you (name, address, signature, job title and the content of the conversation).

Technical data. As with any website, when you visit the Site your browser sends the server your IP address and request data (browser, operating system, page visited). Our hosting provider processes this data to serve the pages and protect them against attacks. The form also includes a hidden field that only automated programs fill in: if it arrives filled in, we discard the submission.

You provide this data yourself. Required fields are marked, and without them we cannot handle your request. Please do not include special categories of data (such as health data) or other people's data without their permission.

4. Why we use your data and on what legal basis

• Answering your enquiry and preparing a quote. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Privacy checkbox. By ticking it, you consent to our processing of the form data for that purpose (Art. 6(1)(a) GDPR). You may withdraw your consent at any time, without affecting prior processing.
• Managing the relationship if you become a client. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with legal obligations, such as tax and accounting rules (Art. 6(1)(c) GDPR).
• Security and abuse prevention (hidden anti-spam field and hosting technical logs). Legal basis: our legitimate interest in protecting the Site and preventing fraudulent or automated submissions (Art. 6(1)(f) GDPR).

We will not send you marketing you have not asked for, we do not build profiles, and we do not make automated decisions that produce legal effects concerning you or similarly significantly affect you.

5. Who we share your data with

• Vercel Inc. (USA): hosting of the Site and the server functions that process the form; where applicable, also the aggregated web analytics described in Section 10.
• Resend (USA): delivery of form submissions to our team by email.
• Our email provider, which hosts the messages we exchange with you.

All of them act as processors under a contract that complies with Article 28 GDPR, and only process data on our instructions. We may also share data with professional advisers bound by confidentiality, with authorities and courts when required by law and, in corporate transactions (merger, sale or financing), with the counterparties under appropriate safeguards. We do not sell personal data or share it for advertising.

6. International transfers

HelixNebula is a US company and so are its providers, so your data is processed in the United States. These transfers rely on the adequacy decision for the EU-US Data Privacy Framework for certified companies and, where it does not apply, on the Standard Contractual Clauses approved by the European Commission, with supplementary measures where appropriate. You can ask us for information about these safeguards at privacidad@helixnebula.dev.

7. How long we keep your data

We keep enquiries and correspondence while a possible business relationship is being evaluated and for up to 2 years after the last contact. If you become a client, we keep the data for the duration of the relationship and afterwards for the periods required by law (for example, tax and commercial law) and until any claims arising from the contract are time-barred. Technical logs are kept for the limited periods applied by our hosting provider.

Once these periods end, we delete or anonymize the data. If it cannot be deleted immediately (for example, from backups), it is blocked and isolated from any further use until deletion, as required by Article 32 LOPDGDD.

8. Your rights

• Access: find out whether we process your data and get a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete it when it is no longer needed.
• Restriction: ask us to stop using it temporarily, for example while its accuracy is checked.
• Portability: receive it in a structured format or have us send it to another controller.
• Objection: object to processing based on our legitimate interest.
• Withdrawal of consent: at any time, without affecting prior processing.

To exercise them, write to privacidad@helixnebula.dev or to our EU representative (juan@helixnebula.dev). We may ask for information to verify your identity. We reply within one month, extendable by two further months for complex requests, and if we cannot fulfil a request we will explain why.

9. Complaints

If you disagree with our response or with how we process your data, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es) or with the supervisory authority of the EU or EEA country where you live (edpb.europa.eu). In the United Kingdom, the authority is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve it with you first.

10. Analytics, cookies and third-party resources

We use Vercel Web Analytics and Vercel Speed Insights to see, in aggregate, how many visits each page receives and how fast it loads. They do not use cookies, do not store personal data and do not track you across websites: we only get anonymous statistics.

Fonts and all images are served from our own domain: browsing the site makes no requests to third-party servers beyond our hosting provider.

If you follow a link to a third-party website, its own privacy policy applies.

11. Security

We apply technical and organizational measures appropriate to the risk: the Site and the form only work over encrypted connections (HTTPS), access to enquiries is limited to the team handling them, and we work with providers that offer security guarantees. No system is completely secure; if a breach affecting your data occurred, we would act in accordance with Articles 33 and 34 GDPR.

12. Children

The Site is aimed at businesses and professionals, not at anyone under 18. We do not knowingly collect children's data. If you believe a child has sent us their data, write to us and we will delete it.

13. US residents

If you live in a US state with an applicable privacy law (such as California, Colorado, Connecticut or Virginia), you can exercise the rights of access, correction, deletion and portability granted by that law by writing to privacidad@helixnebula.dev, without being discriminated against for doing so. We do not sell personal data or share it for targeted advertising.

14. Changes to this policy

We may update this policy because of legal, technical or Site changes. The current version will always be published on this page with its revision date. If a change materially affects data you have already given us, we will let you know by email.