Privacy policy

Last updated: 08/11/2026

1. Who is responsible for your data

Netneo is the trade name under which I, Mario Roberto Rivera, work as a self-employed professional. I am the controller of the data explained here.

• NIE (Spanish identity number for foreign nationals): Y4312286F
• Address: C. Julio Álvarez Mendo, 2, 33010 Oviedo, Asturias (Spain)
• Email: info@netneo.es
• Phone and WhatsApp: +34 642 46 96 83

I work alone: nobody but me has access to your data, apart from the providers I name in section 8.

2. When you visit this site

Umami (cookie-free analytics). I use Umami, a tool installed on my own server, to measure how many people visit the site, which pages they see, where they come from and which contact buttons they press. It stores nothing in your browser and does not identify you: your IP address is used at that moment to work out your country and approximate city, and it is not stored. I only use aggregate statistics for this site: I do not combine them with other data or follow you on other sites.

• Legal basis: my legitimate interest in knowing how the site is used in order to improve it (art. 6(1)(f) GDPR).
• Where: on my server at Hetzner Online GmbH, in Helsinki (Finland).
• How long: a maximum of 25 months; after that, it is deleted.

Google Analytics (only if you accept it). For a while I am also using Google Analytics, to compare its figures with Umami's. It is only activated if you accept it in the cookie notice. It processes an identifier for your browser, the pages you visit and the buttons you press.

• Legal basis: your consent (art. 6(1)(a) GDPR). You can withdraw it whenever you like with the button at the end of this page or from "Cookie settings" in the footer of the site.
• Who: Google Ireland Limited. Google may transfer data to the US; that transfer is covered by the EU-US Data Privacy Framework, to which Google adheres.
• How long: Google keeps the detailed data for 2 months.

What is stored in your browser is detailed in the cookie policy.

3. When you write to me

If you write to me by WhatsApp, email, phone, Instagram or LinkedIn, or your request reaches me through a quote platform, I process your name, your contact details and what you tell me.

• What for: to reply to you and, if you ask, to prepare a proposal for you.
• Legal basis: handling your request and the steps prior to a possible contract (art. 6(1)(b) GDPR).
• How long: if we do not end up working together, I delete your data 12 months after our last contact. If you are a client, section 4 applies.

4. If you are a client

I process your contact and billing details (name or company name, tax ID, address, email and phone), what we discuss about the project, and invoices and payments.

• What for: to provide the contracted service, invoice it and meet my tax obligations.
• Legal basis: the contract (art. 6(1)(b) GDPR) and my legal obligations (art. 6(1)(c)).
• Who else sees them: my tax advisers, who manage my taxes on my behalf, and the Spanish Tax Agency (Agencia Tributaria), when the law requires it.
• How long: for as long as our relationship lasts and, after that, for the time required by tax and commercial law.

5. If I contacted you

I look for businesses I think my work could help. If I have written to you, I took your details from public sources: your website, your Google Business Profile or your social media. I process the name of the business, the name of the contact person, the phone number or email you publish and my notes on the conversation.

• What for: to present my services to you and follow up on the conversation.
• Legal basis: my legitimate interest in contacting businesses and professionals about their activity (art. 6(1)(f) GDPR and art. 19 of the LOPDGDD, the Spanish data protection act).
• How long: if we do not keep talking, I delete your data 12 months after our last contact. If you tell me not to write to you again, I stop and delete it.

6. Documents I send you by link

If you are a client or have asked me for a proposal, I may send you contracts, annexes, notices or proposals through a private link. The document page is in Spanish. When you open it and respond («Recibido» ("Received"), accepting with the code sent to your email, or «Quiero seguir adelante» ("I want to go ahead")) I process:

• your name and email and, if you act on behalf of a business, its company name and tax ID;
• the date and time, IP address and browser you use to open the document and respond;
• the acceptance code, of which I only store a fingerprint, never the code itself.

What for: to send you the document and keep a record that you received, read or accepted it, together with the file's fingerprint, which proves it has not changed.

Legal basis:

• If you are a client: the performance of your contract (art. 6(1)(b) GDPR). Confirming by email that you have accepted a contract is also a legal obligation (art. 6(1)(c) GDPR and art. 28 of the LSSI, the Spanish e-commerce law).
• If you have asked me for a proposal: the pre-contractual steps you have requested (art. 6(1)(b)).
• If I notify you of something the law requires me to tell you, such as a new provider processing data on your behalf: a legal obligation (art. 6(1)(c) and art. 28(2) GDPR).
• If you act on behalf of a company: my legitimate interest in dealing with it (art. 6(1)(f) GDPR and art. 19 of the LOPDGDD).
• Keeping the record as evidence: my legitimate interest in being able to prove the delivery and your response (art. 6(1)(f)).

How long: for as long as our relationship lasts. When it ends, the record is blocked: no ordinary access, and available only to judges, courts, the Public Prosecutor's Office and public authorities, for five years from the end of the relationship or from your last response to the document (art. 1964.2 of the Spanish Civil Code and art. 32 of the LOPDGDD). After that, it is deleted.

If you ask me to erase your data, I erase everything that is not needed. The document sent and its record are kept, with restricted access, for as long as they may be needed to handle a claim (art. 17(3)(e) GDPR), and at most five years from the end of the relationship. After that period, they are deleted.

7. Client panel accounts

If you have an account on the Netneo client panel, I process your first name, surname, email, password (stored encrypted), account type and the date of each login. Your session is kept with a technical cookie set by the panel, which it needs in order to work.

• What for and legal basis: to give you access to the service you have contracted (art. 6(1)(b) GDPR) and to keep it secure (legitimate interest, art. 6(1)(f)).
• How long: for as long as you have the account.

What you publish or manage in the panel about your own clients, visitors or students I process on your behalf, as a processor, under the data processing agreement we sign. It is not governed by this policy.

8. Providers that process data on my behalf

• Hetzner Online GmbH: the server for the website, Umami, the panel and the documents, in Helsinki (Finland).
• Backblaze, Inc.: backups, in its European Union region. It is a US company: should any data be transferred to that country, the transfer is covered by the EU-US Data Privacy Framework, to which it adheres, and by the European Commission's standard contractual clauses included in its data processing agreement.
• SMTP2GO: sending the panel and document emails, from its European Union data centre. Some of its providers are outside the European Union: those transfers are covered by the European Commission's standard contractual clauses (Decision (EU) 2021/914) in its data processing agreement, which also bind its sub-processors.
• Hostinger International Ltd. (Cyprus): my email, info@netneo.es, where I also keep a copy of the document confirmations.
• KIOVI, my tax advisers: invoices, every quarter.
• Google Ireland Limited: Google Analytics, only if you accept it and for as long as I use it.

9. Your rights

You can ask me to access your data, correct it, erase it, restrict its use, take it with you or object to my processing it, especially when I rely on my legitimate interest (sections 2 and 5). Write to me at info@netneo.es; I will reply within one month at most. If you believe I have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency, AEPD (www.aepd.es).

10. Changes

If I change anything important in this policy, you will see it reflected in the date at the top.

11. Withdrawing or changing your consent to Google Analytics

Change cookie preferences