{"id":41403,"date":"2025-08-26T21:11:29","date_gmt":"2025-08-27T04:11:29","guid":{"rendered":"https:\/\/dev.iwsworld.com\/nuvarez\/?page_id=41403"},"modified":"2025-08-26T21:19:42","modified_gmt":"2025-08-27T04:19:42","slug":"nuvarez-gdpr","status":"publish","type":"page","link":"https:\/\/dev.iwsworld.com\/nuvarez\/nuvarez-gdpr\/","title":{"rendered":"GDPR Privacy Statement"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Effective Date: January 1, 2025<\/strong><\/p>

Last Updated: August 26, 2025<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Introduction<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This GDPR Privacy Statement supplements our main Privacy Policy and specifically addresses the rights and protections afforded to individuals in the European Union (EU) and European Economic Area (EEA) under the General Data Protection Regulation (GDPR).<\/span><\/p>

If you are located in the EU\/EEA, this statement outlines your specific rights regarding your personal data and how Nuvarez LLC (“we,” “us,” or “our”) processes your information in compliance with GDPR requirements.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Legal Basis for Processing Personal Data<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Under the GDPR, we process your personal data only when we have a valid legal basis. Our processing activities are based on:<\/span><\/p>

Article 6(1)(a) – Consent<\/b><\/span><\/p>

When you have given explicit consent for specific processing activities, such as:<\/span><\/p>

  • Marketing communications<\/span><\/li>
  • Optional data collection through forms<\/span><\/li>
  • Non-essential cookies and tracking<\/span><\/li><\/ul>

    Article 6(1)(b) – Contract Performance<\/b><\/span><\/p>

    When processing is necessary for:<\/span><\/p>

    • Fulfilling our consulting services agreement<\/span><\/li>
    • Pre-contractual steps taken at your request<\/span><\/li>
    • Client onboarding and service delivery<\/span><\/li><\/ul>

      Article 6(1)(c) – Legal Obligation<\/b><\/span><\/p>

      When we must process data to comply with:<\/span><\/p>

      • Financial record-keeping requirements<\/span><\/li>
      • Anti-money laundering regulations<\/span><\/li>
      • Tax and audit obligations<\/span><\/li>
      • Legal discovery requests<\/span><\/li><\/ul>

        Article 6(1)(f) – Legitimate Interests<\/b><\/span><\/p>

        When we have legitimate business interests that are not overridden by your rights, including:<\/span><\/p>

        • Website security and fraud prevention<\/span><\/li>
        • Business development and marketing to existing clients<\/span><\/li>
        • Internal analytics and service improvement<\/span><\/li>
        • Direct marketing to business contacts (B2B)<\/span><\/li><\/ul>

          We conduct balancing tests to ensure our legitimate interests do not override your fundamental rights and freedoms.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

          \n\t\t\t\t
          \n\t\t\t\t\t

          Your Rights Under GDPR<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          As an EU\/EEA data subject, you have the following rights:<\/span><\/p>

          Right of Access (Article 15)<\/b><\/span><\/p>

          You can request:<\/span><\/p>

          • Confirmation that we process your personal data<\/span><\/li>
          • Access to your personal data<\/span><\/li>
          • Information about how we process your data<\/span><\/li>
          • A copy of your personal data in a commonly used format<\/span><\/li><\/ul>

            Right of Rectification (Article 16)<\/b><\/span><\/p>

            You can request correction of:<\/span><\/p>

            • Inaccurate personal data<\/span><\/li>
            • Incomplete personal data<\/span><\/li><\/ul>

              Right of Erasure\/”Right to be Forgotten” (Article 17)<\/b><\/span><\/p>

              You can request deletion of your personal data when:<\/span><\/p>

              • The data is no longer necessary for the original purpose<\/span><\/li>
              • You withdraw consent and no other legal basis exists<\/span><\/li>
              • You object to processing and no overriding legitimate grounds exist<\/span><\/li>
              • The data has been unlawfully processed<\/span><\/li>
              • Deletion is required for legal compliance<\/span><\/li><\/ul>

                Note:<\/b> This right may be limited by legal retention requirements or other lawful grounds for continued processing.<\/span><\/p>

                Right to Restrict Processing (Article 18)<\/b><\/span><\/p>

                You can request restriction of processing when:<\/span><\/p>

                • You contest the accuracy of the data<\/span><\/li>
                • Processing is unlawful but you prefer restriction over deletion<\/span><\/li>
                • We no longer need the data but you require it for legal claims<\/span><\/li>
                • You object to processing pending verification of legitimate grounds<\/span><\/li><\/ul>

                  Right to Data Portability (Article 20)<\/b><\/span><\/p>

                  When processing is based on consent or contract and carried out by automated means, you can request:<\/span><\/p>

                  • Your personal data in a structured, commonly used, machine-readable format<\/span><\/li>
                  • Direct transmission of your data to another controller (where technically feasible)<\/span><\/li><\/ul>

                    Right to Object (Article 21)<\/b><\/span><\/p>

                    You can object to processing based on:<\/span><\/p>

                    • <\/b>Legitimate interests:<\/b> You can object at any time, and we must stop unless we demonstrate compelling legitimate grounds<\/span><\/li>
                    • <\/b>Direct marketing:<\/b> You can object at any time, and we will stop immediately<\/span><\/li>
                    • <\/b>Profiling:<\/b> Related to direct marketing activities<\/span><\/li><\/ul>

                      Rights Related to Automated Decision-Making (Article 22)<\/b><\/span><\/p>

                      You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. We do not currently engage in such automated decision-making.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

                      \n\t\t\t\t
                      \n\t\t\t\t\t

                      Exercising Your Rights<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                      \n\t\t\t\t
                      \n\t\t\t\t\t\t\t\t\t

                      How to Submit Requests<\/b><\/span><\/p>

                      To exercise your GDPR rights, contact us using:<\/span><\/p>

                      • <\/b>Email:<\/b> gdpr@nuvarez.com<\/span><\/li>
                      • <\/b>Subject Line:<\/b> “GDPR Data Subject Request”<\/span><\/li>
                      • <\/b>Include:<\/b> Your full name, email address, and specific request details<\/span><\/li><\/ul>

                        Verification Process<\/b><\/span><\/p>

                        To protect your privacy, we may request additional information to verify your identity before processing your request.<\/span><\/p>

                        Response Timeframes<\/b><\/span><\/p>

                        We will respond to your request:<\/span><\/p>

                        • <\/b>Within 1 month<\/b> of receiving a valid request<\/span><\/li>
                        • <\/b>Extended to 3 months<\/b> for complex requests (with notification of delay and reasons)<\/span><\/li>
                        • <\/b>Free of charge<\/b> unless requests are manifestly unfounded or excessive<\/span><\/li><\/ul>

                          Right to Lodge a Complaint<\/b><\/span><\/p>

                          If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at: https:\/\/edpb.europa.eu\/about-edpb\/board\/members_en<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

                          \n\t\t\t\t
                          \n\t\t\t\t\t

                          Data Transfers Outside the EU\/EEA<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                          \n\t\t\t\t
                          \n\t\t\t\t\t\t\t\t\t

                          When we transfer your personal data outside the EU\/EEA, we ensure adequate protection through:<\/span><\/p>

                          Adequacy Decisions<\/b><\/span><\/p>

                          We may transfer data to countries that have received an adequacy decision from the European Commission, including:<\/span><\/p>

                          • Countries deemed to provide adequate protection<\/span><\/li>
                          • [List specific countries if applicable to your operations]<\/span><\/li><\/ul>

                            Standard Contractual Clauses (SCCs)<\/b><\/span><\/p>

                            For transfers to countries without adequacy decisions, we use:<\/span><\/p>

                            • European Commission-approved Standard Contractual Clauses<\/span><\/li>
                            • Additional safeguards as required by regulatory guidance<\/span><\/li>
                            • Regular monitoring of data protection levels in destination countries<\/span><\/li><\/ul>

                              Other Safeguards<\/b><\/span><\/p>

                              Where applicable, we may also rely on:<\/span><\/p>

                              • Binding Corporate Rules (BCRs)<\/span><\/li>
                              • Certification schemes<\/span><\/li>
                              • Codes of conduct<\/span><\/li>
                              • Other lawful transfer mechanisms<\/span><\/li><\/ul>

                                Special Categories of Personal Data<\/b><\/span><\/p>

                                We do not intentionally collect special categories of personal data (sensitive data) such as:<\/span><\/p>

                                • Racial or ethnic origin<\/span><\/li>
                                • Political opinions<\/span><\/li>
                                • Religious or philosophical beliefs<\/span><\/li>
                                • Trade union membership<\/span><\/li>
                                • Genetic or biometric data<\/span><\/li>
                                • Health data<\/span><\/li>
                                • Data concerning sex life or sexual orientation<\/span><\/li><\/ul>

                                  If we inadvertently receive such data, we will delete it unless you provide explicit consent for processing or another GDPR exemption applies.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

                                  \n\t\t\t\t
                                  \n\t\t\t\t\t

                                  Data Protection by Design and by Default<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                  \n\t\t\t\t
                                  \n\t\t\t\t\t\t\t\t\t

                                  We implement data protection principles throughout our operations:<\/span><\/p>

                                  Technical Measures<\/b><\/span><\/p>

                                  • Encryption of personal data in transit and at rest<\/span><\/li>
                                  • Access controls and authentication systems<\/span><\/li>
                                  • Regular security assessments and penetration testing<\/span><\/li>
                                  • Automated data retention and deletion systems<\/span><\/li><\/ul>

                                    Organizational Measures<\/b><\/span><\/p>

                                    • Privacy impact assessments for new processing activities<\/span><\/li>
                                    • Staff training on GDPR compliance<\/span><\/li>
                                    • Data protection policies and procedures<\/span><\/li>
                                    • Regular compliance audits and reviews<\/span><\/li><\/ul>

                                      Data Minimization<\/b><\/span><\/p>

                                      We collect and process only the personal data that is:<\/span><\/p>

                                      • Necessary for the specified purpose<\/span><\/li>
                                      • Relevant and limited to what is needed<\/span><\/li>
                                      • Accurate and kept up to date<\/span><\/li>
                                      • Retained only as long as necessary<\/span><\/li><\/ul>

                                        Data Protection Officer (DPO)<\/b><\/span><\/p>

                                        Our Data Protection Officer oversees GDPR compliance and can be contacted at:<\/span><\/p>

                                        • <\/b>Email:<\/b> dpo@nuvarez.com<\/span><\/li>
                                        • <\/b>Role:<\/b> Privacy oversight, data subject rights, regulatory liaison<\/span><\/li>
                                        • <\/b>Availability:<\/b> Monday-Friday, 9 AM – 5 PM CET<\/span><\/li><\/ul>

                                          Cookies and Consent Management<\/b><\/span><\/p>

                                          For EU\/EEA visitors, we implement:<\/span><\/p>

                                          • <\/b>Cookie consent banners<\/b> with clear options<\/span><\/li>
                                          • <\/b>Granular consent<\/b> for different cookie categories<\/span><\/li>
                                          • <\/b>Easy withdrawal<\/b> of consent mechanisms<\/span><\/li>
                                          • <\/b>Cookie preference centers<\/b> for ongoing management<\/span><\/li><\/ul>

                                            Record of Processing Activities<\/b><\/span><\/p>

                                            In compliance with Article 30 GDPR, we maintain detailed records of our processing activities, including:<\/span><\/p>

                                            • Purposes of processing<\/span><\/li>
                                            • Categories of data subjects and personal data<\/span><\/li>
                                            • Recipients of personal data<\/span><\/li>
                                            • International transfers<\/span><\/li>
                                            • Retention periods<\/span><\/li>
                                            • Security measures<\/span><\/li><\/ul>

                                              These records are available to supervisory authorities upon request.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

                                              \n\t\t\t\t
                                              \n\t\t\t\t\t

                                              Data Breach Notification<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                              \n\t\t\t\t
                                              \n\t\t\t\t\t\t\t\t\t

                                              In the event of a personal data breach:<\/span><\/p>

                                              • <\/b>Supervisory Authority:<\/b> Notified within 72 hours when feasible<\/span><\/li>
                                              • <\/b>Data Subjects:<\/b> Notified without undue delay if high risk to rights and freedoms<\/span><\/li>
                                              • <\/b>Documentation:<\/b> Comprehensive breach records maintained<\/span><\/li>
                                              • <\/b>Mitigation:<\/b> Immediate steps taken to contain and remedy breaches<\/span><\/li><\/ul>

                                                Updates to This Statement<\/b><\/span><\/p>

                                                We will update this GDPR statement as needed to reflect:<\/span><\/p>

                                                • Changes in data processing activities<\/span><\/li>
                                                • Regulatory guidance and requirements<\/span><\/li>
                                                • Technological developments<\/span><\/li>
                                                • Organizational changes<\/span><\/li><\/ul>

                                                  Material changes will be communicated through:<\/span><\/p>

                                                  • Email notification to registered users<\/span><\/li>
                                                  • Prominent website notices<\/span><\/li>
                                                  • Updated effective dates<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                    \n\t\t\t\t
                                                    \n\t\t\t\t\t

                                                    Contact Information<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                    \n\t\t\t\t
                                                    \n\t\t\t\t\t\t\t\t\t

                                                    GDPR-Specific Inquiries<\/b><\/span><\/p>

                                                    Primary Contact:<\/b> gdpr@nuvarez.com
                                                    Data Protection Officer:<\/b> dpo@nuvarez.com
                                                    Phone:<\/b> [Insert EU Contact Number]<\/span><\/p>

                                                    EU Representative (if applicable)<\/b><\/span><\/p>

                                                    If required under GDPR Article 27: [Insert EU Representative Details]<\/span><\/p>

                                                    Postal Address<\/b><\/span><\/p>

                                                    Nuvarez LLC
                                                    Attn: GDPR Compliance
                                                    [Insert Address]<\/span><\/p>

                                                    Document Control<\/b><\/b><\/span><\/p>

                                                    • Document ID: NUV-GDPR-001<\/span><\/li>
                                                    • Version: 1.0<\/span><\/li>
                                                    • Owner: Data Protection Officer<\/span><\/li>
                                                    • Next Review Date: [Insert Date]<\/span><\/li>
                                                    • Approved by: [Legal Counsel\/DPO]<\/span><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                                                      \n\t\t\t\t
                                                      \n\t\t\t\t\t\t\t
                                                      \n\t\t\t
                                                      <\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

                                                      Effective Date: January 1, 2025 Last Updated: August 26, 2025 Introduction This GDPR Privacy Statement supplements our main Privacy Policy and specifically addresses the rights and protections afforded to individuals in the European Union (EU) and European Economic Area (EEA) under the General Data Protection Regulation (GDPR). If you are located in the EU\/EEA, this…<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":5,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-41403","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/dev.iwsworld.com\/nuvarez\/wp-json\/wp\/v2\/pages\/41403","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.iwsworld.com\/nuvarez\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/dev.iwsworld.com\/nuvarez\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/dev.iwsworld.com\/nuvarez\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.iwsworld.com\/nuvarez\/wp-json\/wp\/v2\/comments?post=41403"}],"version-history":[{"count":6,"href":"https:\/\/dev.iwsworld.com\/nuvarez\/wp-json\/wp\/v2\/pages\/41403\/revisions"}],"predecessor-version":[{"id":41417,"href":"https:\/\/dev.iwsworld.com\/nuvarez\/wp-json\/wp\/v2\/pages\/41403\/revisions\/41417"}],"wp:attachment":[{"href":"https:\/\/dev.iwsworld.com\/nuvarez\/wp-json\/wp\/v2\/media?parent=41403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}