Controller and contact
The data controller is CXDE LTD, Company Number 16646885, with its registered office at 5 Brayford Square, London, E1 0SG, United Kingdom. Jose Vicente Muñoz Monerris handles requests on the company’s behalf. Privacy contact: hola@josevmunoz.com.
What data is processed and why
- Enquiries and proposals: name, email, phone number, a description of your needs and preferred call time. They are used to respond, prepare a quotation and continue the conversation about that project. The legal basis is taking pre-contractual steps at your request; if you contact us on behalf of an organisation, it is the legitimate interest in handling that professional communication.
- Meeting bookings: name, email, project description, and the selected date and time. NEXO records the appointment and links it to an existing enquiry with the same email or creates a new one. They are used to organise the meeting and handle the requested project, on the same pre-contractual or professional communication grounds. They are not sent to Analytics.
- Security: technical connection and browser data, anti-spam verification and retry identifiers to prevent abuse and duplicate submissions. The legal basis is the legitimate interest in protecting the service and communications.
- Optional analytics: with your consent, Google Analytics 4 provides information about page views, visits and scrolling. Form fields, emails, phone numbers and messages are not sent to Analytics. Google Signals and advertising personalisation are not used.
The five project form fields are needed to handle your request and arrange the requested phone call. Booking a meeting requires your name, email and project context, as well as the chosen time. If you prefer not to provide these, you can write by email. Do not include sensitive data or other people’s private information. No automated decisions with legal effects are made about your enquiries, and your contact details are not used for newsletters, audiences or advertising campaigns.
Form and NEXO
The form sends information to this website’s receiving endpoint, which validates the request and forwards it to NEXO, my private management tool. Receipt is confirmed only when NEXO returns a valid acknowledgement. The form does not send automatic emails.
If you book a meeting, the calendar checks availability and sends your details directly to NEXO’s public API, without signing in to its private dashboard. You will receive a private link to view, change or cancel the meeting and download it to your calendar. Keep it safe: anyone who has it can manage that meeting. The link uses a fragment that is not sent to the server when opening the page; it is sent to NEXO when viewing or managing the booking. The booking page does not load measurement tags. Delivery of an email confirmation is not guaranteed.
While a booking is awaiting confirmation, the tab session stores only a random identifier and its date, never personal data or the private link. It is removed once the response is confirmed or a definitive rejection is received. If an unanswered request is reloaded, you are asked to get in touch before making another booking to prevent duplicates.
During the tab session, the browser keeps a random submission identifier, its date and the form’s path, not the personal fields. The receiving endpoint does not store the message text: it keeps pseudonymised technical records to limit attempts and recognise retries. If receipt remains unconfirmed, retry with the same details without closing the tab.
Providers and recipients
- Hostinger: hosting for this website and its contact mailbox. Hostinger privacy information.
- Arsys: VPS infrastructure hosting NEXO and Consent Manager, tools administered by Jose. NEXO is not a public contact directory and does not provide access to other clients. Arsys legal and data protection information.
- Cloudflare: Turnstile security verification when you interact with the form. It processes technical signals such as IP and browser data; the text of your enquiry is not sent to Turnstile. Cloudflare’s documentation distinguishes processing for site protection from processing to improve its bot detection. Turnstile privacy.
- Google: Analytics 4 managed through Tag Manager, only with permission for analytics. Search Console helps review the domain’s presence on Google and does not add a visitor tracker to this website. Google privacy.
Your data is not sold. It may be provided to authorities where legally required. If you choose WhatsApp or Instagram, you access Meta services subject to their own policies; their pixels and tracking widgets are not embedded in this website.
International processing
CXDE LTD is registered in the United Kingdom, a country covered by a European Commission adequacy decision. Technology providers may also process data in other countries, including the United States, depending on their infrastructure and terms. Their documents explain the safeguards applicable to those transfers, such as adequacy decisions for participating entities or standard contractual clauses. You can request information about recipients and the relevant safeguards by writing to the privacy contact. There is no guarantee that all processing remains in Spain.
Data retention
Enquiries that do not result in a contract are kept for a maximum of twelve months from the last relevant conversation about the project, and deleted sooner when no longer necessary. A routine internal action does not restart that period. If you become a client, data needed for the service, billing or possible claims is retained separately for the periods required or necessary for those obligations.
Anti-spam counters use ten-minute windows and technical retry references expire after thirty days; they are cleaned up as new requests are processed. They do not contain the message. The tab identifier is removed after confirmed receipt or when the browser session ends. For preference and analytics cookie retention, see the cookie policy. GA4 user and event data retention is set to two months, without resetting on new activity; this does not mean that all aggregated reports are deleted.
Your rights
You may request access, rectification, erasure, objection, restriction or portability where applicable, and withdraw consent without affecting prior processing. Write to hola@josevmunoz.com stating your request. Additional identification information will only be requested if needed to verify it.
Requests will be answered within the applicable time limits, normally one month, with justified extensions as provided by law. You may lodge a complaint with the competent supervisory authority, including the Spanish Data Protection Agency or the Information Commissioner’s Office in the United Kingdom. To withdraw analytics consent, use Cookie settings at the bottom of each page.
Changes
This policy will be updated if the purposes, providers or operation of the site change. Adding advertising or using contact details for a different purpose requires reviewing this information and, where appropriate, obtaining new permission.