Privacy Policy
Last updated: July 2026
At Nexion Grid Storage Systems, S.L. we are committed to protecting and respecting your privacy. This Privacy Policy describes how we collect, use, store and protect your personal data when you visit our website or contact us. It applies in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD), and all other applicable national and international data protection frameworks in the jurisdictions in which we operate.
Data controller
1. Applicable legal framework
The processing of personal data by Nexion Grid Storage Systems, S.L. is governed by the following legal instruments, as applicable depending on the jurisdiction of the data subject: (a) European Union: Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 of 5 December (LOPDGDD — Spain); Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE); Directive 2002/58/EC as amended by Directive 2009/136/EC (ePrivacy Directive). (b) United Kingdom: UK GDPR and Data Protection Act 2018. (c) Turkey: Personal Data Protection Law No. 6698 (KVKK). (d) Saudi Arabia: Personal Data Protection Law (PDPL), Royal Decree M/19 of 2021. (e) UAE: Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL). (f) Egypt: Personal Data Protection Law No. 151 of 2020. (g) Morocco: Law No. 09-08 on the Protection of Personal Data. (h) South Africa: Protection of Personal Information Act No. 4 of 2013 (POPIA). (i) Brazil: Lei Geral de Proteção de Dados Pessoais (LGPD — Law 13.709/2018). (j) Chile: Law 19.628 on Protection of Private Life and its reform in progress. (k) Colombia: Statutory Law 1581 of 2012 and Decree 1377 of 2013 (Habeas Data). (l) Mexico: Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations. (m) Argentina: Personal Data Protection Law No. 25.326 (LPDP). Where the laws of a specific jurisdiction impose additional requirements, Nexion Grid Storage Systems, S.L. will comply with those requirements in respect of data subjects in that jurisdiction.
2. Data we collect
We collect only the personal data you voluntarily provide through our website contact and enquiry forms. This may include: full name and surname; corporate email address; telephone number; company or organisation name; professional role; project country and type; estimated power and energy capacity; project stage and timeline; and any additional information you choose to include in free-text fields. We do not collect special categories of personal data (sensitive data) as defined under Article 9 GDPR, nor data relating to persons under 16 years of age. We do not use tracking cookies, advertising pixels or behavioural profiling technologies without your prior informed consent.
3. Purpose and legal basis for processing
Your personal data is processed for the following purposes and on the following legal bases: (a) Handling and managing enquiries and requests for information submitted via the contact or enquiry forms — legal basis: consent of the data subject (Art. 6.1.a GDPR; Art. 6 LOPDGDD). (b) Sending commercial information about our products and services — legal basis: express prior consent (Art. 6.1.a GDPR; Art. 21 LSSI-CE). (c) Compliance with applicable legal and regulatory obligations — legal basis: compliance with a legal obligation (Art. 6.1.c GDPR). (d) Legitimate interests in maintaining the security and proper functioning of the website — legal basis: legitimate interests (Art. 6.1.f GDPR), subject to a balancing test. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
4. Data retention
Your personal data will be retained for as long as necessary to handle your enquiry and, where applicable, for the period established by law for the fulfilment of legal obligations. Specifically: data processed on the basis of consent will be retained until you withdraw that consent or request erasure; data processed for compliance with legal obligations will be retained for the periods prescribed by applicable law (generally 5 years under Spanish commercial law and 4 years under Spanish tax law). Once the applicable retention period has expired, data will be securely deleted or anonymised. Blocked data will be kept solely for the purpose of making it available to competent authorities during the applicable limitation periods.
5. Recipients and international data transfers
Your data will not be disclosed to third parties except: (a) where required by law or court order; (b) where strictly necessary for the provision of the requested service, in which case data processors will be bound by a data processing agreement in accordance with Art. 28 GDPR. Where it is necessary to transfer personal data outside the European Economic Area (EEA), Nexion Grid Storage Systems, S.L. will ensure that adequate safeguards are in place, including: adequacy decisions by the European Commission; standard contractual clauses (SCCs) approved by the European Commission; binding corporate rules; or other appropriate safeguards as permitted under the GDPR. For data subjects in the United Kingdom, transfers will comply with the UK GDPR and the International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs as applicable. For data subjects in other jurisdictions (Turkey, Saudi Arabia, UAE, South Africa, Brazil, Chile, Colombia, Mexico, Argentina), transfers will comply with the applicable local data protection law requirements for cross-border data transfers.
6. Your rights as a data subject
Under the GDPR, LOPDGDD and equivalent applicable legislation, you have the following rights in relation to your personal data: (a) Right of access — to obtain confirmation of whether your data is being processed and to receive a copy. (b) Right to rectification — to request correction of inaccurate or incomplete data. (c) Right to erasure ('right to be forgotten') — to request deletion of your data where it is no longer necessary, consent has been withdrawn, or processing is unlawful. (d) Right to restriction of processing — to request that processing be limited in certain circumstances. (e) Right to data portability — to receive your data in a structured, commonly used and machine-readable format. (f) Right to object — to object to processing based on legitimate interests or for direct marketing purposes. (g) Right not to be subject to automated individual decision-making, including profiling, that produces legal or similarly significant effects. To exercise any of these rights, please write to [email protected], stating your name and attaching a copy of your identity document. We will respond within one month of receipt of your request (extendable by a further two months in complex cases). You also have the right to lodge a complaint with the competent supervisory authority: in Spain, the Agencia Española de Protección de Datos (AEPD) at www.aepd.es; in the UK, the Information Commissioner's Office (ICO) at www.ico.org.uk; in other EU Member States, the relevant national data protection authority.
7. Rights of data subjects in specific jurisdictions
In addition to the rights set out above, data subjects in the following jurisdictions have specific additional rights: Turkey (KVKK): rights to learn whether personal data is processed, to request information about processing, to learn the purpose of processing and whether data is used in accordance with its purpose, to know the third parties to whom data is transferred, to request rectification or erasure, and to object to processing. Saudi Arabia (PDPL): rights to access, correct, destroy and object to processing, and to withdraw consent. UAE (PDPL): rights to access, correct, complete, update, destroy and object to processing. South Africa (POPIA): rights to be notified of collection, to access, to correct or delete, and to object to processing. Brazil (LGPD): rights to confirmation, access, correction, anonymisation, portability, deletion, information on sharing, and revocation of consent. Colombia (Habeas Data): rights to know, update, rectify and delete personal data, and to revoke consent. Mexico (LFPDPPP): ARCO rights — access, rectification, cancellation and objection. Argentina (LPDP): rights to access, rectification, update, suppression and confidentiality. To exercise any jurisdiction-specific rights, please contact [email protected]
8. Data security
Nexion Grid Storage Systems, S.L. has implemented appropriate technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, in accordance with Art. 32 GDPR and equivalent provisions under applicable national law. These measures include: encryption of data in transit using TLS; access controls and authentication mechanisms; regular security assessments; staff training on data protection; and incident response procedures. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, Nexion Grid Storage Systems, S.L. will notify the competent supervisory authority within 72 hours of becoming aware of the breach, and will inform affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
9. Cookies and tracking technologies
In accordance with Art. 22.2 LSSI-CE, the ePrivacy Directive (2002/58/EC as amended), and the guidelines of the AEPD, the Website uses only strictly necessary technical cookies for its correct operation. These cookies do not require prior consent as they are essential for the provision of the service. Analytical, advertising, social media or third-party tracking cookies are not used without your prior informed consent. Where consent is required, it will be obtained through a clearly visible and accessible consent mechanism before any non-essential cookies are placed. You may withdraw your consent or manage your cookie preferences at any time. You may also configure your browser to reject or delete cookies, although this may affect the functionality of the Website.
10. Data Protection Officer (DPO)
Nexion Grid Storage Systems, S.L. has assessed its obligation to designate a Data Protection Officer under Art. 37 GDPR. Where required by applicable law or as a matter of best practice, a DPO or privacy contact has been designated. For any data protection queries, please contact: [email protected]. Nexion Grid Storage Systems, S.L. is registered with the Agencia Española de Protección de Datos (AEPD) as required under Spanish law.
11. Changes to this privacy policy
Nexion Grid Storage Systems, S.L. reserves the right to amend this Privacy Policy at any time to reflect changes in applicable legislation, regulatory guidance (including guidance from the AEPD, the European Data Protection Board, and equivalent authorities in other jurisdictions), or our data processing practices. In the event of material changes, we will notify you via a prominent notice on our website and, where appropriate, by direct communication. The date of the most recent update is indicated at the top of this page. We recommend that you review this page periodically to stay informed of any updates. Continued use of the Website following notification of changes constitutes acceptance of the revised Privacy Policy.