Privacy Policy — B2B Clients

1. Data Controller

Legal name: Iberovita Nexum, S.L.
Tax ID (CIF): B88956065
Registered address: Calle Impresores, 20. P.E. Prado del Espino. 28660 Boadilla del Monte, Madrid, Spain.
Contact email: [email protected]

2. Data We Collect and Its Source

We process data that you provide directly when placing an order through our WhatsApp bot or website:

• Name and contact details of the person placing the order (phone, email).
• Company details: tax ID, registered name, delivery address.
• Content of the conversation required to process the order.

We do not process special categories of personal data (health, ideology, ethnic origin, etc.), and we do not collect data from minors — this service is directed exclusively at professionals managing orders on behalf of a company.

3. Purpose of Processing

• Processing and managing your B2B orders: company identification, product selection, application of volume pricing, generation of order confirmations and delivery notes.
• Maintaining the commercial relationship history and handling queries or incidents related to your orders.

We do not use this channel to send unsolicited commercial communications. If we offer promotions or offers via WhatsApp or email in the future, we will request your explicit consent separately, in accordance with applicable e-commerce legislation.

4. Legal Basis

Processing is based on Art. 6(1)(b) GDPR: it is necessary for the performance of the contractual or pre-contractual relationship between your company and Iberovita Nexum, S.L. (management of your order). It does not require your explicit consent as it derives from that commercial relationship.

5. Recipients and Data Processors

We do not share your data with third parties unrelated to the provision of the service. We use the following providers as data processors (Art. 28 GDPR), who process your data only on our instructions:

All three mechanisms are recognised as valid safeguards for international data transfers under Arts. 45–46 GDPR.

6. Data Retention

• Data linked to sales transactions is retained for the mandatory commercial retention period: 6 years (Art. 30 Spanish Commercial Code).
• WhatsApp conversations with no accounting or evidential value are deleted once the order is resolved, unless an open claim or incident justifies retaining them for longer.

7. Your Rights

You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to [email protected]. We will respond within a maximum of one month (Art. 12(3) GDPR).

If you believe the processing of your data does not comply with applicable law, you have the right to lodge a complaint with the Spanish Data Protection Authority:
Agencia Española de Protección de Datos (AEPD) — www.aepd.es

8. Automated Decision-Making

No automated decisions with legal or significant effects are made about you based on your data. The WhatsApp bot applies predefined pricing rules to process your order; it does not carry out profiling or make decisions that affect you legally.

9. Security

We apply reasonable technical and organisational measures to protect your data, including encryption in transit and at rest provided by the processors listed in section 5.

10. Changes to This Policy

We may update this policy to reflect legal or operational changes. The date of the last update is shown at the top of this document.