Privacy Policy

In compliance with the General Data Protection Regulation (GDPR) and applicable data protection laws, the data controllers responsible for processing your personal data are the following entities of the Navarro Business Group:

Through our website, we may collect the following types of data:

• Contact Data: Name, email, company, and message when you use our contact forms
• Navigation Data: IP address, browser type, and browsing behavior (automatically logged)
• Service Request Data: Information provided when requesting consultations or services

Note: We do NOT collect financial or banking data through our website.

We process your personal data for the following purposes:

• To respond to your inquiries and information requests
• To manage professional service requests
• To send requested information about our services
• To improve our services and user experience
• To comply with applicable legal obligations

The processing of your personal data is based on:

• User Consent (Art. 6.1.a GDPR) when you use our contact forms
• Legitimate Interest (Art. 6.1.f GDPR) for responding to business inquiries
• Contract Performance (Art. 6.1.b GDPR) for clients who engage our services
• Legal Obligation (Art. 6.1.c GDPR) when required by applicable regulations

Your personal data will NOT be disclosed to third parties except as required by law. The only recipients are:

• Hosting and Database Provider: Supabase (located in the European Union)
• Tax Authorities: When there is a legal obligation

We retain your personal data for:

• Contact Data: Until you withdraw consent or request deletion
• Client Data: According to legal tax and commercial obligations (minimum 6 years)
• Navigation Data: Maximum 2 years from last interaction

You have the right to:

• Access: Request information about what personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we use your data
• Portability: Receive your data in a structured format
• Objection: Object to the processing of your data
• Withdraw Consent: At any time, without affecting the lawfulness of prior processing

To exercise these rights, send an email to info@nrro.es with the subject "Exercise of GDPR Rights" and attach a copy of your identification document.

We implement technical and organizational measures to protect your data:

• SSL/TLS encryption for all communications
• Database with Row Level Security (RLS) enabled
• Access and security event auditing
• Rate limiting to prevent automated attacks
• Input data validation with specialized libraries
• Access restricted to authorized personnel

For detailed information about our use of cookies, please visit our Cookie Policy.

Your data is primarily stored and processed within the European Economic Area (EEA). If any transfer outside the EEA is necessary, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

• Spanish Data Protection Agency (AEPD): www.aepd.es

We encourage you to contact us first at info@nrro.es so we can address your concerns directly.

For any questions about this Privacy Policy, please contact us:

• Email: info@nrro.es
• Phone: +34 934 593 600
• Address: Ausias March 36 Principal, 08010 Barcelona, Spain