Privacy policy

I. PRIVACY POLICY AND DATA PROTECTION

Respecting what is established in the current legislation, Nemus Arboricultura y Formación (hereinafter, also Website) undertakes to adopt the technical and organizational measures necessary, according to the appropriate level of security for the risk of the data collected.

Laws that incorporate this privacy policy

This privacy policy is adapted to Spanish and European legislation in force on the protection of personal data on the internet. Specifically, it respects the following rules:

• Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
• Organic Law 3/2018, of December 5, on Data Protection and guarantee of digital rights (LOPD-GDD).
• Act 34/2002, of July 11, on Services of the Information Society and Electronic Commerce (LSSI-CE).

Identity of the data controller

The data controller for the personal data collected on Nemus Arboricultura y Formación is: NEMUS ARBORICULTURA Y FORMACION SL, with tax identification number: B75280594, registered in: Registro Mercantil de Palma de Mallorca with the following registration details: Sección 8, hoja PM101918, inscripción 1 (16 de diciembre de 2024) (hereinafter, Data Controller). Their contact details are as follows:

Address: Carrer de França, 37, S'Arracó (Andratx), Illes Balears, 07159, España

Contact phone: +34 622 477 902

Contact email: info@nemusarboricultura.com

Scope of this policy

This policy explains data processing on the Nemus public website and in enquiries received through its forms. Data comes from the person contacting us and from use of the website. We do not request health data or other special categories; please avoid including them in your message.

Principles applicable to personal data processing

Data will be processed lawfully, fairly and transparently, for specified purposes and with data minimisation, accuracy, storage limitation, security and confidentiality. The basis applicable to each purpose is set out below.

Categories of personal data

• Enquiries: name, email address, message and, when provided, phone number, course or training interest and language. The date and technical data used to manage and send the request are also retained.
• Browsing: random session and visit identifiers, pages and actions viewed, language, dates, referring domain and campaign tags. A request may be associated with its browsing context. These data are pseudonymous, not necessarily anonymous.
• Operation and security: technical request data, including IP address and details needed to diagnose incidents and prevent abuse. Error logs may contain request data.

Legal basis for processing personal data

• Requests for services or training and steps before entering a contract taken at your request: precontractual measures or performance of a contract (Article 6(1)(b) GDPR).
• General enquiries, website security and first-party statistics about its operation: legitimate interests in responding to communications and maintaining and improving the service (Article 6(1)(f) GDPR), subject to applicable rights and safeguards and without prejudice to consent where required for storing or accessing information on your device.
• Legal obligations: Article 6(1)(c) GDPR. Where a specific processing activity requires consent, it must be specific and affirmative and can be withdrawn without affecting the lawfulness of earlier processing.

Fields marked as required are necessary to handle your enquiry. Reading this policy or simply browsing the website does not constitute consent.

Purposes for which personal data will be used

• Responding to enquiries and requests about arboriculture, services and training and managing the resulting arrangements.
• Sending the enquiry to the Nemus team, acknowledging receipt to the sender with a copy of the message, and managing delivery and any incidents.
• Understanding page use and relevant actions to improve the website through first-party analytics, without third-party advertising.
• Protecting the service, preventing abuse and resolving technical errors.

The form does not automatically subscribe you to a marketing list. This workflow does not make decisions with legal effects based solely on automated processing.

Retention periods for personal data

• Enquiries in the application: content is cleared by periodic tasks starting 24 hours after final delivery or closure due to an error. Pending content expires after 7 days. Technical receipt and delivery records are retained for 90 days.
• Detailed analytics: retained for 90 days, with periodic deletion.
• Received emails and professional relationship documents: for as long as needed to handle the request or relationship and then for applicable statutory retention or liability periods.
• Security and incident logs: for the time needed for diagnosis, service protection and dealing with liabilities. Application cleanup periods do not mean that email or backup copies are immediately deleted.

Recipients of personal data

Data may be accessed by authorised Nemus personnel and hosting, technical maintenance and email providers involved in delivering the service, as well as competent public bodies where legally required. Data is not sold or disclosed for third-party advertising.

If a service involves international data transfers, the safeguards required by the GDPR must apply, such as an adequacy decision or standard contractual clauses, and information about the relevant transfers must be provided.

First-party analytics and session storage

The first-party measurement tool uses browser sessionStorage for a session identifier and a temporary event queue; it does not use cookies or persistent local storage for this measurement. The session is renewed after 30 minutes of inactivity and queued events expire after 24 hours. It records visits and actions without including form names, email addresses or messages in analytics events.

The current configuration respects the browser’s Do Not Track signal. You may also object to analytics processing by emailing the contact address. The absence of a separate cookie policy page does not make these data anonymous or replace the safeguards required for processing.

Personal data of minors

Respecting what is established in articles 8 of the GDPR and 7 of Organic Law 3/2018, of December 5, on Data Protection and guarantee of digital rights, only those over 14 years of age will be able to provide their consent for the processing of their personal data lawfully by Nemus Arboricultura y Formación. If it concerns a person under 14 years of age, the consent of parents or guardians will be required for processing, and this will only be considered lawful to the extent that they have authorized it.

Secrecy and security of personal data

Communication with the website uses HTTPS/TLS. Nemus will apply technical and organisational measures appropriate to the risks to protect data and restrict access to authorised personnel. No system can guarantee absolute security. Data breaches will be managed and notified where required by applicable law.

Rights arising from personal data processing

You may request access, rectification, erasure, restriction, portability or objection where the relevant legal requirements are met, and withdraw consent where it is the basis for processing. Send your request to info@nemusarboricultura.com or to the controller’s postal address, stating your name, a way to reply and the right you wish to exercise.

A copy of your identity document is not generally required. Proportionate additional information will only be requested if there are reasonable doubts about your identity. If acting for another person, you must demonstrate your authority to do so. Requests will be answered within GDPR time limits.

Links to third-party websites

The Website may include hyperlinks or links that allow access to third-party web pages different from Nemus Arboricultura y Formación, and therefore not operated by Nemus Arboricultura y Formación. The holders of these websites will have their own data protection policies, being themselves, in each case, responsible for their own files and their own privacy practices.

Complaints before the control authority

In case the User believes that there is a problem or infringement of current regulations in the way personal data is being processed, they will have the right to effective judicial protection and to file a complaint with a control authority, in particular, in the State where they habitually reside, place of work or place of the alleged infringement. In the case of Spain, the control authority is the Spanish Data Protection Agency (https://www.aepd.es/).

II. INFORMATION AND CHANGES TO THIS POLICY

This policy provides information. Material changes to processing will be reflected on this page, and further information will be provided or consent requested where necessary. Last updated: 14 October 2026.

Prepared using the GenLegalTxts generator and adapted to the website configuration on 14/10/2026.