Document forming part of the NEQXOS Legal and Technology Governance Framework.
At NEQXOS, we believe that trust is the foundation of every organizational transformation process. Our Platform has been designed to foster emotional intelligence as an organizational performance infrastructure—at individual, team and organizational level—through the combination of proprietary methodology, advanced technology and artificial intelligence, supported by structured measurement as an integral element of its design.
This Privacy and Information Governance Policy forms an integral part of the NEQXOS Legal and Technology Governance Framework and shall be interpreted together with the remaining legal documentation governing the operation of the Platform. Its purpose is not limited to fulfilling the information obligations established under Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights. It also seeks to explain, in a transparent manner, how personal information is governed throughout the NEQXOS technology ecosystem.
All decisions relating to the processing of personal data, the use of Artificial Intelligence, the selection of technology providers and the development of new functionalities are based on a governance model founded upon: effective protection of individuals; responsible innovation; human oversight; transparency; and continuous improvement.
Accordingly, privacy protection is not regarded by NEQXOS as a mere regulatory obligation. Rather, it constitutes one of the core structural principles upon which the Platform's entire technological and methodological ecosystem has been designed. Our functional architecture incorporates the principles of Privacy by Design, Privacy by Default, responsible AI governance and data minimization from the earliest stages of service design.
This Privacy Policy explains, in a clear and transparent manner:
Our objective is to ensure that every individual understands not only what personal data we process, but also how such information is governed from a legal and organizational perspective throughout its entire lifecycle.
This Policy provides a general description of the legal framework governing the processing of personal data through the NEQXOS Platform. Certain processing activities may, however, be subject to specific characteristics arising from: the type of service contracted; the User profile; the Client Organization to which the User belongs; or the ongoing functional evolution of the Platform. Where this occurs, NEQXOS shall adopt the necessary measures to ensure that all affected individuals receive any additional information required under applicable data protection legislation.
For the purposes of this Privacy Policy, the following capitalized terms shall have the meanings assigned to them below, without prejudice to the definitions contained in Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and any other applicable legislation.
The NEQXOS technology solution, comprising the Website, the digital platform, its functionalities, applications, modules, tools and all associated services.
Any natural person who accesses or uses the Platform, whether individually or as part of a program promoted by a Client Organization.
Any public or private entity that contracts the services provided by NEQXOS in order to make the Platform's functionalities available to its employees, collaborators, members or participants.
The set of technological tools incorporating Artificial Intelligence models designed to facilitate guidance, interaction, analysis, methodological support and user assistance.
Information voluntarily provided by the User that reflects emotions, personal experiences, reflections, objectives, personal circumstances or any other elements relating to the User's personal or professional development process. Although such information does not necessarily constitute a special category of personal data within the meaning of Article 9 GDPR, NEQXOS applies an enhanced level of protection, taking into account its particular sensitivity and the context in which it is processed.
Information generated through assessments, questionnaires, exercises and methodological processes carried out within the Platform for the purpose of evaluating personal or professional competencies.
Any entity providing technological services necessary for the operation of NEQXOS, including infrastructure, hosting services, authentication services, payment processing, AI-powered functionalities and any other integrated technology components.
This Privacy Policy is intended to provide clear, transparent and easily accessible information regarding the processing of personal data carried out by NEQXOS in connection with the operation of its technology Platform, in accordance with:
This document also describes the legal and technological governance principles underpinning the design, development and operation of the Platform, forming an integral part of the NEQXOS Legal and Technology Governance Framework.
This Privacy Policy applies to all processing activities carried out by NEQXOS in relation to:
Where specific functionalities are governed by additional policies or specific contractual terms, those provisions shall supplement this Privacy Policy.
This Policy covers, among others, processing activities arising from the following Platform functionalities:
This Privacy Policy shall be interpreted together with:
We are committed to processing personal data (hereinafter, the "Personal Data") in accordance with the following principles established under the General Data Protection Regulation (GDPR):
We will collect Personal Data solely for specified, explicit and legitimate purposes and will not process such Personal Data in a manner that is incompatible with those purposes.
In accordance with Article 6 of the GDPR, Personal Data shall be processed only where a valid legal basis exists. Where processing is based on consent, such consent shall be freely given, specific, informed and unambiguous, reflecting the Data Subject's clear expression of intent.
Personal Data may also be processed where necessary:
In accordance with Article 5 of the GDPR, all processing activities shall be carried out fairly and transparently. Accordingly, Data Subjects shall be informed of the existence of each processing activity, its purposes and the essential circumstances surrounding the processing of their Personal Data.
We limit the collection of Personal Data to that which is strictly relevant, adequate and necessary for the purposes for which it is processed.
Personal Data shall be collected exclusively for specified, explicit and legitimate purposes and shall not subsequently be processed in a manner incompatible with those purposes.
We take reasonable steps to ensure that Personal Data remains accurate, complete and, where necessary, kept up to date.
We implement appropriate technical and organizational measures designed to ensure a level of security appropriate to the risks presented by the processing and the nature of the Personal Data concerned. Such measures are intended to prevent unauthorized disclosure, access, alteration, destruction, accidental loss or any other form of unlawful or unauthorized processing.
Any individual whose Personal Data is processed may exercise, free of charge, the rights recognized under the GDPR, including:
Requests shall normally be answered within one month of receipt, which period may be extended by up to two additional months where necessary, taking into account the complexity or number of requests, in accordance with Article 12 GDPR.
Personal Data shall be retained only for as long as necessary to fulfill the purposes for which it was collected and processed, without undue delay, and in accordance with the applicable retention periods established under the NEQXOS data governance framework.
The governance of personal information constitutes one of the core structural elements of the NEQXOS Legal and Technology Governance Framework. Accordingly, all processing activities carried out through the Platform shall be governed not only by the principles laid down in Article 5 of the GDPR, but also by the specific governance principles established by NEQXOS in order to promote the responsible use of technology and the effective protection of individuals.
All processing of Personal Data shall rely upon a valid legal basis, shall be carried out fairly in relation to the individuals concerned and shall be conducted with the highest possible level of transparency.
Only the Personal Data that is strictly necessary to achieve the purposes of the Platform shall be processed. NEQXOS shall periodically review the necessity of retaining each category of information processed.
All Platform functionalities shall be designed in accordance with the principles of Privacy by Design and Privacy by Default, as set out in Article 25 of the GDPR. Legal and regulatory considerations shall be integrated into technological decision-making from the earliest stages of product design, development and evolution.
AI-powered functionalities are intended to provide assistance and methodological support. Decisions producing significant effects for Users shall not be based exclusively on automated processing where human intervention is required or where applicable legislation so provides.
NEQXOS considers that Emotional Information, Competency Information and other information relating to an individual's personal development deserve a level of protection exceeding the minimum standards established under applicable legislation, taking into account the relationship of trust existing between the Platform and its Users.
Accordingly, such information shall be protected through enhanced organizational and technical safeguards designed to:
The implementation of new technological functionalities, including Artificial Intelligence systems, shall be subject to prior legal assessment, risk analysis, proportionality and the protection of individuals' rights and freedoms.
The NEQXOS Legal and Technology Governance Framework has been designed independently of any specific technology or technology provider. The replacement of a technology provider or technical solution by another functionally equivalent solution shall not, in itself, modify the data protection principles governing the Platform.
This Privacy Policy and the NEQXOS Legal and Technology Governance Framework shall be reviewed periodically in order to reflect legal, technological and organizational developments affecting the Platform.
The NEQXOS governance framework incorporates a permanent model for risk assessment and continuous compliance monitoring.
As a minimum, periodic reviews shall be carried out in relation to:
Any significant modification affecting the NEQXOS technology ecosystem shall be preceded by an appropriate legal assessment in order to verify its compliance with the applicable legal, regulatory and governance requirements.
The Data Controller of the Personal Data processed through the NEQXOS Platform is the entity that owns and operates the Platform:
EQ OPERATING SYSTEM SOLUTIONS, S.L.
Spanish Tax Identification Number (NIF): B88755889
Registered Office:
Calle Alejandro Dumas, 17
29004 Málaga, Spain
(hereinafter, the "Data Controller").
For any matters relating to the processing of Personal Data, you may contact NEQXOS by post at the above address or by email at:
Data Subjects may contact NEQXOS at any time regarding this Privacy Policy or any matter relating to the processing of their Personal Data through the contact channels made available on the Website.
Where NEQXOS has appointed a Data Protection Officer ("DPO") in accordance with Articles 37 et seq. of the GDPR, the DPO's contact details shall be published and kept permanently up to date.
Where no Data Protection Officer has been appointed, all responsibilities relating to privacy management and data protection compliance shall be performed by the competent internal governance body designated by NEQXOS.
As a general rule, NEQXOS determines the purposes and essential means of the processing of Personal Data necessary for the provision of its services and therefore acts as the Data Controller.
However, certain processing activities may be carried out in cooperation with Client Organizations or specialized Technology Providers.
Depending on the specific circumstances of each processing activity, such relationships may give rise to:
The precise role assumed by each party shall always be determined on the basis of the actual functional reality of the service provided and not solely by reference to the contractual terminology used by the parties.
NEQXOS does not operate as a standalone application developed entirely upon a single technological infrastructure.
Instead, the Platform integrates a number of specialized technology components that operate in a coordinated manner under the direction and governance of NEQXOS in order to deliver a seamless and unified user experience.
As a general principle, the NEQXOS technology ecosystem is structured as follows:
Users always interact with NEQXOS as their sole contractual counterpart.
NEQXOS defines the methodology, structures the learning journey, determines the functionalities made available through the Platform and establishes the rules governing the use and management of information processed within the Platform.
In order to deliver specific functionalities, NEQXOS relies upon specialized Technology Providers, including providers responsible for:
Each Technology Provider operates under contractual arrangements incorporating the safeguards required by the GDPR and processes only the Personal Data strictly necessary for the provision of the relevant service.
All information processed within the NEQXOS ecosystem is governed through an internal data governance framework based upon the following principles:
NEQXOS applies a functional information classification model that enables security measures and access controls to be tailored to the nature and sensitivity of each category of information processed.
This classification is based upon the organizational principles established under the NEQXOS Legal and Technology Governance Framework and complements the traditional categories of personal data recognized under applicable data protection legislation.
This category includes, among others:
This category includes:
User passwords are never accessible to NEQXOS and remain protected through appropriate cryptographic mechanisms in accordance with industry best practices.
This category comprises the information necessary for the administration of the contractual relationship between NEQXOS and the User or Client Organization.
It includes, among others:
NEQXOS processes information generated through the competency assessments carried out within the Platform.
Such information may include:
This information is processed exclusively for methodological support, learning and competency development purposes.
It does not, in itself, constitute a medical, psychological or clinical diagnosis.
During their use of the Platform, Users may voluntarily provide information relating to:
NEQXOS considers this category of information to deserve enhanced protection from an ethical, organizational and governance perspective.
Accordingly, enhanced technical and organizational safeguards shall apply irrespective of whether such information constitutes a special category of personal data within the meaning of Article 9 GDPR.
The use of AI-powered assistants may generate information relating to:
Such interactions shall be processed solely for the purpose of enabling the operation of the contracted AI-powered functionalities and in accordance with the principles established in this Privacy Policy.
In all cases, once collected, such information shall be processed exclusively in an anonymized and holistic manner for the preparation of impact assessments and analytical reports.
In order to ensure the security, availability and proper functioning of the Platform, NEQXOS may process:
Such processing is based upon NEQXOS' legitimate interest in safeguarding the security of the Platform, preventing unauthorized access, investigating security incidents and ensuring business continuity and service resilience.
All processing activities carried out by NEQXOS pursue specified, explicit and legitimate purposes previously defined within the NEQXOS Legal and Technology Governance Framework.
Personal Data shall not be processed for purposes incompatible with those for which it was originally collected.
As a general rule, Personal Data may be processed for the following purposes:
All processing of Personal Data carried out by NEQXOS is based upon one or more of the lawful bases set out in Article 6 of Regulation (EU) 2016/679 (GDPR).
The applicable legal basis shall depend upon the specific purpose of the processing, the relationship between NEQXOS and the User, and the context in which the Platform is used.
Under no circumstances shall Personal Data be processed without an appropriate lawful basis in accordance with the applicable data protection legislation.
Most of the processing activities carried out by NEQXOS are based upon the necessity to perform the contract entered into with the User or, where applicable, with the Client Organization to which the User belongs, pursuant to Article 6(1)(b) GDPR.
This legal basis includes, among others, processing activities necessary to:
Certain processing activities are necessary in order to comply with legal obligations applicable to NEQXOS pursuant to Article 6(1)(c) GDPR.
These include, among others:
NEQXOS may process certain Personal Data where such processing is necessary for the purposes of its legitimate interests or those of a third party, provided that such interests are not overridden by the fundamental rights and freedoms of the Data Subject.
Such processing may include, among others:
Where required, NEQXOS shall carry out the appropriate legitimate interest balancing assessment before relying upon this legal basis.
Where no other appropriate legal basis applies, NEQXOS shall obtain the User's freely given, specific, informed and unambiguous consent in accordance with Articles 6(1)(a) and 7 GDPR before carrying out the relevant processing activity.
Consent may be requested, among other circumstances, for:
Consent may be withdrawn at any time without affecting the lawfulness of any processing carried out prior to its withdrawal.
In order to provide the highest possible level of transparency, the principal Personal Data processing activities carried out by NEQXOS are described below.
This description is provided for information purposes and shall be supplemented by the Record of Processing Activities (RoPA) maintained by the Data Controller.
To register Users, establish and manage their digital identity, and administer their access to the Platform.
Article 6(1)(b) GDPR.
For the duration of the contractual relationship and thereafter for the period necessary to comply with applicable legal obligations and to establish, exercise or defend legal claims.
To enable Users to access and use the various programs, services and functionalities available through the Platform.
Article 6(1)(b) GDPR.
The competency assessments carried out through NEQXOS are intended to facilitate learning, personal development and competency enhancement processes.
The results obtained do not constitute psychological assessments, clinical evaluations or medical diagnoses unless expressly stated otherwise in connection with a specific service and supported by the corresponding legal authorization.
Assessment results shall be used exclusively for the methodological purposes associated with the relevant contracted program.
AI-powered functionalities are designed to provide personalized guidance, reflective support and methodological assistance throughout the User's learning and development journey.
Such functionalities may process, among other information:
NEQXOS shall endeavor to select Technology Providers whose processing practices are compatible with the principles established under the NEQXOS Legal and Technology Governance Framework.
The use of AI-powered functionalities shall not, in itself, result in decisions based solely on automated processing that produce legal or similarly significant effects for Users.
NEQXOS processes information provided by Users for the purposes of:
In order to safeguard the availability, integrity and confidentiality of its systems, NEQXOS may process technical information relating to:
Such processing is carried out on the basis of NEQXOS' legitimate interests together with its legal and regulatory obligations to maintain an appropriate level of information security.
NEQXOS incorporates AI-powered functionalities with the objective of enriching the User's learning experience, facilitating reflective processes, providing methodological guidance and enhancing interaction with the Platform.
These functionalities form part of a technology ecosystem designed and governed by NEQXOS and operate exclusively as tools intended to support Users throughout their competency development journey.
Under no circumstances are these AI-powered functionalities intended to provide medical, psychological, psychiatric or therapeutic assistance, nor are they designed to replace the professional judgment of appropriately qualified specialists.
The use of these technologies is governed in accordance with the principles of:
Depending on the program contracted and the ongoing development of the Platform, Artificial Intelligence may support, among others, the following functionalities:
The functionalities available may evolve over time through the incorporation of additional capabilities, provided that they remain compatible with the purposes of the services and the safeguards established under this Privacy Policy.
Where Users interact with AI-powered functionalities, the following categories of information may be processed, among others:
NEQXOS expressly recommends that Users avoid including information that is not necessary for the intended purpose of the interaction and, wherever reasonably possible, refrain from providing particularly sensitive information that is unrelated to the activity being undertaken.
Although NEQXOS does not deliberately request special categories of Personal Data within the meaning of Article 9 GDPR as a prerequisite for using the Platform, certain Users may voluntarily and spontaneously disclose information capable of revealing aspects relating to:
Where this occurs:
Where appropriate, NEQXOS may implement additional data minimization, anonymization or deletion measures in order to further reduce the risks associated with processing this type of information.
The Artificial Intelligence tools used by NEQXOS are not intended to replace human judgment.
The functional architecture of the Platform is based upon the principle that Artificial Intelligence constitutes a decision-support tool rather than an autonomous decision-making system.
Accordingly:
NEQXOS applies the principle of restricted access.
Conversations conducted through AI-powered functionalities are not freely accessible to members of NEQXOS personnel.
Access shall be granted only to individuals who have been expressly authorized where such access is necessary for one or more of the following purposes:
Any authorized access shall remain subject to organizational controls, activity logging and specific confidentiality obligations.
NEQXOS may analyze information generated through the operation of the Platform in order to:
Where these purposes can reasonably be achieved through the use of anonymized information, anonymization shall always be preferred over the processing of identifiable Personal Data.
This section shall be reviewed and updated to reflect the final technological architecture implemented within the Platform.
As a general principle, NEQXOS shall not use Users' individual conversations to train proprietary Artificial Intelligence models where such use would be incompatible with applicable law or with the information provided to Users regarding the processing of their Personal Data.
Likewise, NEQXOS shall endeavor to select Technology Providers whose contractual commitments ensure that Personal Data processed through the Platform is not used to train third-party general-purpose AI models unless:
At the date of this Privacy Policy, the AI-powered functionalities integrated into the Platform are provided through Kindred. Information regarding the privacy practices applicable to those services may be consulted through the direct link provided in Section 16.4 of this Privacy Policy.
One of the distinguishing features of NEQXOS is the use of proprietary methodologies designed to facilitate self-awareness, personal development and competency enhancement.
As a result of these processes, the Platform may generate:
These processing activities pursue the following purposes:
The results generated through these assessments do not constitute:
Where access to the Platform takes place within the framework of a program contracted by a Client Organization, company or institution, the disclosure of assessment results to that organization shall be carried out strictly in accordance with:
As a general principle, NEQXOS shall prioritize the use of aggregated or anonymized information whenever such use is compatible with the purposes of the relevant service.
Responses generated through AI-powered functionalities:
NEQXOS may provide its services either directly to individual Users or as part of programs contracted by companies, organizations, academic institutions, foundations or other public or private entities (collectively, "Client Organizations").
The existence of a Client Organization that sponsors or finances access to the Platform does not automatically determine the legal framework applicable to all Personal Data processed during the use of the services.
Accordingly, NEQXOS assesses each processing activity carried out within its technology ecosystem on an individual basis in order to determine the appropriate legal role assumed in each specific case. Depending on the circumstances, different allocation of responsibilities may arise under Regulation (EU) 2016/679 (GDPR).
This approach reflects the principle of accountability and avoids automatically assigning a single legal role to processing activities that pursue different purposes, involve different decision-making processes or entail different responsibilities.
Where access to the Platform is provided through a Client Organization, two separate legal relationships coexist.
This relationship covers:
This relationship concerns the User's actual use of the Platform, including:
These two legal relationships shall remain clearly separated from both a legal and an organizational perspective.
As a general rule, Client Organizations shall have access only to the information that is strictly necessary for the administration of the contracted services and always in accordance with the applicable contractual framework.
Depending on the specific program, such information may include, among other elements:
The specific configuration of each program may provide for different levels of access, which shall be defined and communicated in advance.
As a fundamental principle of its governance model, NEQXOS considers that information generated through personal learning processes, individual reflections, conversations with AI-powered assistants, open-ended exercises and individual competency assessments belongs to the User's personal sphere.
Accordingly, such information shall not be disclosed to the Client Organization unless one of the following circumstances applies:
This principle constitutes one of the cornerstones of the trust model developed by NEQXOS.
NEQXOS has not designed the Platform to facilitate automated decision-making concerning its Users.
Accordingly, the information and results generated through the Platform shall not, by themselves, be used as the sole basis for making decisions concerning individuals, particularly employment-related decisions adopted by a Client Organization, including decisions relating to:
Where a Client Organization intends to use information generated through the Platform for purposes other than those originally envisaged, it shall first assess the lawfulness of such processing and, where applicable, implement any additional measures required under the applicable legislation.
Failure to adopt such measures shall remain the sole responsibility of the relevant Client Organization.
The services provided by NEQXOS rely upon the coordinated use of specialized technology solutions designed to ensure the availability, security, scalability and functionality of the Platform.
Each Technology Provider performs specific functions within the NEQXOS technology ecosystem and is granted access only to the information strictly necessary for the provision of the relevant services, always operating in accordance with the governance principles established by NEQXOS.
The use of such services does not involve the unrestricted disclosure of Personal Data. Rather, it entails the participation of specialized Technology Providers acting either in accordance with the documented instructions of NEQXOS or, where applicable, under the legal framework governing their own role in the processing activity.
NEQXOS selects its Technology Providers not only on the basis of functional capabilities, but also by reference to legal, organizational and information security criteria.
Before any Technology Provider is incorporated into the Platform, NEQXOS shall assess, among other factors:
As a general rule, NEQXOS may engage Technology Providers operating in, among others, the following categories:
The specific list of Technology Providers may evolve as the Platform and its services continue to develop.
At the date of this Privacy Policy, the NEQXOS technology ecosystem includes, among others, the following Technology Providers:
The use of these providers is governed through the corresponding Data Processing Agreements (DPAs), confidentiality commitments and the safeguards required under applicable data protection legislation.
NEQXOS periodically reviews the legal and technical conditions applicable to these providers in order to verify that they continue to maintain an appropriate level of protection for Personal Data.
The continuing technological development of the Platform may require the replacement of existing Technology Providers or the incorporation of new specialized solutions.
Every new integration shall be subject to a prior assessment including, as a minimum:
Where such changes materially affect the processing of Personal Data, NEQXOS shall update this Privacy Policy and, where required by applicable law, inform Users in advance.
Technology Providers shall have access to Personal Data only where such access is strictly necessary for the provision of the contracted services.
NEQXOS shall contractually require all Technology Providers to:
Whenever a Technology Provider processes Personal Data on behalf of NEQXOS, the parties shall enter into an appropriate Data Processing Agreement (DPA) in accordance with Article 28 GDPR.
Such agreement shall specify, among other matters:
As a consequence of the use of certain technology services, some processing activities may involve the transfer of Personal Data outside the European Economic Area (EEA).
Where this occurs, NEQXOS shall verify in advance that the safeguards required under Articles 44 et seq. of the GDPR have been implemented.
Depending upon the Technology Provider concerned and the country of destination, international data transfers may rely upon one or more of the following transfer mechanisms:
NEQXOS shall periodically review the legal framework governing the international data transfers carried out by the Technology Providers integrated into the Platform.
Where appropriate, NEQXOS shall conduct additional transfer risk assessments and implement supplementary technical, contractual or organizational measures designed to reinforce the protection of Personal Data.
Personal Data shall be retained only for as long as necessary to fulfill the purposes for which it was collected and to comply with any applicable legal or contractual obligations.
Once the primary purpose of the processing has ceased to exist, the information shall no longer be used for operational purposes and, where appropriate, shall be placed under a restricted retention regime.
Throughout the provision of the services, Personal Data shall remain subject to active processing and may be used solely for the purposes described in this Privacy Policy.
Following the termination of the principal relationship, certain information may be retained within a segregated environment subject to restricted access where such retention is necessary in order to:
During this period, the information shall not be used for the ordinary operation or exploitation of the Platform.
Where Spanish law applies, Personal Data may remain subject to statutory blocking for the periods established by applicable legislation, during which the information shall be made available solely to courts, tribunals, the Public Prosecutor's Office or competent public authorities.
Wherever reasonably possible, NEQXOS shall prioritize the use of anonymized information for statistical analysis, methodological research and continuous improvement purposes.
Anonymization shall be implemented in such a manner that the identification of the Data Subject is no longer reasonably possible using means that are likely to be available.
Upon expiry of the applicable retention periods, Personal Data shall be securely erased or destroyed through procedures designed to ensure that the information cannot be reconstructed or recovered.
NEQXOS considers information security to be a fundamental component of its Legal and Technology Governance Framework.
The security measures implemented are designed having regard to the state of the art, the nature of the processing activities, the identified risks and the continuous evolution of the technology ecosystem.
Among other measures, NEQXOS may implement:
NEQXOS may implement, among others:
The description provided in this Privacy Policy is intended solely as a general overview and does not constitute an exhaustive list of all security measures implemented, as disclosing such information in detail could compromise the effectiveness of the security framework itself.
Access to the information processed by NEQXOS shall be limited exclusively to personnel whose functions require such access.
Privileged access shall be subject to specific controls, activity logging and periodic reviews, in accordance with the principles of least privilege and need-to-know.
NEQXOS maintains internal procedures designed to detect, assess, manage and document security incidents that may affect the confidentiality, integrity or availability of information.
Where required pursuant to Articles 33 and 34 of the GDPR, Personal Data Breaches shall be notified to the competent Supervisory Authority and, where applicable, to the affected Data Subjects.
NEQXOS recognizes the rights granted under applicable data protection legislation to every individual whose Personal Data is processed through the Platform.
Our objective is not merely to respond formally to requests received, but to enable each User to maintain meaningful control over their Personal Data throughout their relationship with the Platform.
Accordingly, the internal procedures governing the exercise of Data Subject rights form an integral part of the NEQXOS Legal and Technology Governance Framework and are subject to periodic review to ensure their continued effectiveness.
In accordance with the General Data Protection Regulation, Users may exercise the following rights.
To obtain confirmation as to whether NEQXOS processes Personal Data relating to the Data Subject and, where that is the case, to access such information and obtain a copy thereof.
To request the correction of Personal Data that is inaccurate, incomplete or no longer up to date.
To request the deletion of Personal Data where its continued retention is no longer necessary or where the processing is no longer supported by a lawful basis.
The exercise of this right shall be without prejudice to any statutory retention periods or restriction of processing obligations required in order to comply with legal, contractual or administrative responsibilities.
To request that specific processing activities be temporarily suspended or otherwise restricted in the circumstances provided for under applicable legislation.
To object to the processing of Personal Data where such processing is based upon the legitimate interests pursued by NEQXOS or any other lawful basis giving rise to a right of objection under the GDPR.
To receive the Personal Data provided to NEQXOS in a structured, commonly used and machine-readable format, or to request that such data be transmitted directly to another Data Controller where technically feasible and where the legal requirements for portability are satisfied.
Where processing is based upon the Data Subject's consent, such consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to its withdrawal.
Where applicable under data protection legislation, Users may request meaningful information regarding the functioning of AI-powered functionalities used within the Platform, particularly where such information is relevant to the processing of their Personal Data or to the safeguards implemented by NEQXOS.
Certain functionalities provided by NEQXOS present specific characteristics that merit additional explanation in order to ensure the highest level of transparency.
Users may request information regarding conversations conducted through AI-powered functionalities and, where applicable, exercise the rights available in relation to the Personal Data contained within those interactions.
However, the exercise of such rights may be subject to limitations where necessary to preserve the technical integrity of specific records, comply with legal obligations or ensure the security of the Platform.
Reports, metrics and results generated during competency development programs may be subject to rights of access, rectification or erasure in accordance with applicable legislation.
Where such results form part of programs contracted by a Client Organization, the exercise of Data Subject rights shall be coordinated in accordance with the legal framework governing the relevant contractual relationship.
The rights recognized under data protection legislation shall not apply to information that has been effectively anonymized and therefore no longer constitutes Personal Data.
As a general rule, NEQXOS does not make decisions based solely on automated processing that produce legal effects concerning Users or similarly significantly affect them.
The AI-powered functionalities incorporated into the Platform are designed exclusively for methodological and support purposes and remain subject to human oversight within the NEQXOS governance framework.
Data Subjects may exercise their rights at any time by contacting NEQXOS through the communication channels made available for this purpose.
As a general rule, requests should provide sufficient information to identify the applicant and specify the right being exercised in order to facilitate proper handling of the request.
Where necessary to safeguard Personal Data, NEQXOS may request additional information solely for the purpose of verifying the identity of the requester.
Requests shall be handled without undue delay and, in any event, within the time limits established by Article 12 of Regulation (EU) 2016/679, namely ONE (1) MONTH from receipt of the request.
Where justified by the complexity or number of requests received, this period may be extended in accordance with applicable legislation. In such cases, the Data Subject shall be informed of the extension within the time limits required by law.
NEQXOS considers the effective management of Data Subject rights to be an essential element of the trust placed in the Platform by its Users.
Accordingly, wherever reasonably possible, inquiries and requests shall be addressed through a constructive and transparent dialogue, providing clear information regarding the processing carried out and the options available to the Data Subject.
If a Data Subject considers that the processing of their Personal Data does not comply with applicable data protection legislation, they are encouraged to contact NEQXOS in the first instance so that the matter may be addressed and, where possible, resolved amicably.
Data Subjects also retain the right to lodge a complaint with the competent Supervisory Authority, without prejudice to any other administrative or judicial remedies available under applicable law.
In Spain, the competent Supervisory Authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD).
Before contacting the competent Supervisory Authority, NEQXOS encourages Users to contact us first so that any questions or concerns may be resolved promptly, transparently and efficiently.
NEQXOS maintains an ongoing commitment to the continuous improvement of its legal, technological and organizational governance processes.
The functional evolution of the Platform, the incorporation of new technologies, changes in the applicable legal framework and the experience gained through the provision of the services may make it necessary to update this Privacy Policy.
Where any amendments introduced are material and significantly affect the processing of Personal Data, NEQXOS shall take reasonable steps to inform Users before such changes become effective, using the communication channels deemed most appropriate in light of the nature of the changes.
Continued use of the Platform following publication of the updated version of this Privacy Policy shall constitute acceptance of the amendments, without prejudice to any circumstances in which applicable law requires NEQXOS to obtain renewed consent.
This Privacy Policy shall be interpreted together with the other legal documents governing the operation of the NEQXOS ecosystem, including the Legal Notice, the Terms and Conditions of Use, the Cookie Policy and the Artificial Intelligence Policy.
All of these documents form part of a single Legal and Technology Governance Framework and should be understood as complementary instruments designed to ensure a high standard of transparency, information security and protection of Users' rights.
NEQXOS regards the protection of Personal Data as an essential element of the trust that Users place in the Platform.
Accordingly, every decision relating to the functional design of the Platform, its technological evolution, the integration of new AI-powered functionalities and the selection of Technology Providers is guided by the principles of:
Our commitment extends beyond mere compliance with applicable legislation. We are committed to developing a technology ecosystem in which innovation and the effective protection of individuals progress together in a responsible, transparent and sustainable manner.
