Privacy Policy
Last updated 11 August 2026. Version 1.0.
1. Who we are
The data controller is Nexum Forge S.A. de C.V., Av. Bosque de Zafiro 1420, Piso 9, Col. Miravalle Poniente, 11940 Ciudad de México, CDMX, México. Folio mercantil N-2019041234, RFC NFO190412K7A. We are an eCommerce engineering company registered in Mexico. For anything relating to this policy or to your personal data, write to officeSales@nexumforge.com with “Privacy” in the subject line, or to the registered office above, marked for the attention of the Data Protection Officer.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Contact data | Name, company, business email, phone, the content of your enquiry | You, through our forms or by email |
| Client project data | Names and business contact details of your staff working on an engagement | You, during delivery |
| Recruitment data | CV, work history, links to code you have published, interview notes | You, when you apply |
| Usage data | Pages viewed, referrer, approximate location from IP, browser and device type | Automatically, when you visit |
| Billing data | Company billing address, tax identifiers, payment references | You, at contracting |
3. Why we process it and on what basis
- To answer enquiries and prepare proposals — steps taken at your request prior to a contract, and our legitimate interest in running a business.
- To deliver and support services — performance of a contract.
- To assess job applications — steps prior to an employment contract, and our legitimate interest in recruiting.
- To measure and improve the website — your consent, where analytics cookies are used.
- To meet accounting, tax and statutory obligations — legal obligation.
4. Cookies
| Cookie | Purpose | Type | Retention |
|---|---|---|---|
| Session and security cookies | Keep the site working, protect forms against abuse | Strictly necessary | Session |
| Consent preference | Remember your cookie choice | Strictly necessary | 12 months |
| Analytics | Aggregate page and traffic statistics | Consent required | Up to 14 months |
Strictly necessary cookies are set without consent because the site cannot function without them. Analytics cookies are only set after you accept, and you can withdraw consent at any time by clearing cookies in your browser.
5. Who we share data with
We use processors for hosting, email delivery, analytics, accounting and applicant tracking. Each is bound by a data processing agreement. We do not sell personal data and we do not use it for automated decision-making or profiling. Where data is transferred outside the EEA it is covered by Standard Contractual Clauses together with a transfer risk assessment.
6. How long we keep it
| Data | Retention |
|---|---|
| Enquiries that do not become projects | 24 months from last contact |
| Client project and contract records | Duration of the contract plus 10 years, for statutory accounting purposes |
| Recruitment data | 12 months from the end of the process, unless you ask us to delete it sooner |
| Website analytics | Up to 14 months, in aggregate form |
| Invoices and accounting records | 10 years, as required by Mexican commercial law |
7. Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to processing, and receive it in a portable format. Where processing rests on consent, you can withdraw that consent at any time without affecting processing already carried out. Write to officeSales@nexumforge.com; we respond within 30 days. You can also complain to your local supervisory authority, or in Mexico to INAI, the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales.
8. How we protect it
Access is granted on a need-to-know basis and reviewed quarterly. Secrets are held in a managed key store, data is encrypted in transit and at rest, systems are patched and monitored continuously, and staff take annual security training. We maintain an incident response procedure and will notify affected individuals and the supervisory authority where the law requires it.
9. Changes to this policy
We publish the version number and date at the top of this page. Material changes are announced to clients through their usual channel at least 30 days before they take effect.