Privacy policy
This policy explains how NEXTGENWEBS, S.L. processes personal data on the website and in the naranjatec firma service, in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Controller: NEXTGENWEBS, S.L. — Tax ID (NIF) B97380067
- Registered address: Pol. Ind. Fuente del Jarro, Plaza Gerardo Salvador, nº 1, oficinas 17-19, 46988 Paterna (Valencia), España
- Privacy contact: info@naranjatec.com
2. Two different roles
- As controller, we process the data of people who visit the website, sign up, purchase the service, request the custom service from us or write to us.
- As processor, we process, on behalf of each customer company, the data of its employees that is included in the signatures (name, job title, phone, photo…). In that case the customer company is the controller and the processing is governed by the Data processing agreement.
3. What data we process, for what purpose and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, company and password (encrypted) | Creating and managing the account and providing the service | Performance of the contract (Art. 6.1.b GDPR) |
| Billing and payment method details | Charging the subscription and issuing invoices | Performance of the contract and legal obligation (Art. 6.1.b and 6.1.c) |
| Data from the custom service form | Responding to the request and preparing a proposal | Pre-contractual measures at the request of the data subject (Art. 6.1.b) |
| Support communications | Handling queries and incidents | Performance of the contract and legitimate interest (Art. 6.1.b and 6.1.f) |
| Technical data (security logs, IP address at login) | Security and fraud prevention | Legitimate interest (Art. 6.1.f) |
| Log of support team access to an account | Auditing technical support | Legitimate interest and security (Art. 6.1.f and 32) |
We do not carry out profiling or make automated decisions with legal effects.
4. Signature images and banner clicks
Signatures load images (icons, logo, banners, QR codes) from our servers. Those requests do not use cookies or store the IP address of the email recipient. For campaign banners we only count the total number of clicks, without identifying who clicks.
5. Recipients and processors
We do not sell data. We share it only with the providers needed to provide the service, under a data processing agreement and with appropriate safeguards:
- Stripe Payments Europe, Ltd. — payment processing and billing.
- Hosting: NEXTGENWEBS, S.L. (naranjatec), Paterna (Valencia), España.
- Email delivery: [email_provider].
If any provider processes data outside the European Economic Area, it does so with appropriate safeguards (an adequacy decision or the European Commission's standard contractual clauses).
We will also disclose data to the authorities when required by law.
6. Retention
- Account data: while the account is active and, afterwards, for the limitation periods applicable to legal liabilities.
- Billing data: the period required by tax and commercial legislation (generally, 6 years).
- Custom service requests that do not lead to a purchase: up to 12 months.
- Security logs and support access logs: up to 12 months.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent where it is the legal basis, by writing to info@naranjatec.com. If the data is processed on behalf of your company (your signature data), please preferably contact your company; we will help it respond.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).
8. Security
We apply appropriate technical and organisational measures: encryption in transit (HTTPS), encrypted passwords, optional two-step authentication, separation of each company's data, access control and logging of support interventions.
9. Changes
We may update this policy. If the changes are significant, we will notify you by email or within the application.
Last updated: October 5, 2026