Privacy Policy

Privacy Policy

In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), we provide you with detailed information about how we treat your personal data when you interact with our website.

1. Data Controller Identity

  • Identity: Nomasystems S.L.
  • Contact Email: hello@nomasystems.com

We want to explicitly clarify that Nomasystems is the sole owner and data controller for all data collected on this website and our job portal subdomains. Third-party developers of our site, such as Bizneo, are merely service providers and are not the controllers of the data managed therein.

2. Data We Collect and How We Collect It

We collect personal data in the following scenarios:

  • Via our AI Chat Assistant: When you interact with our chat system, we collect the contents of your messages and a technical session identifier to maintain the conversation’s context (see also our Cookie Policy). The content of your messages may be processed by third-party AI technology providers acting as data processors on behalf of Nomasystems (see Section 5). When the assistant cannot find an answer, the system saves the topic of the question, without your session identifier or anything else that identifies you, to create future FAQ pages.
  • When you dictate a question: If you use the microphone to dictate, speech recognition is done by your own browser, not by Nomasystems. Depending on the browser, the audio may be sent to its maker to turn it into text (for example, to Google for Chrome), under that company’s own terms. We only receive the resulting text, which is treated like any other chat message.
  • Via a contact request in the chat: If you tell the assistant you would like Nomasystems to contact you, it asks you to write your contact details in your own words: your name, email address, phone number, when you prefer to be contacted, and the reason for your enquiry. Gemini (see Section 5) extracts these details from your message, and they are emailed to the Nomasystems staff designated to handle these requests, so that a person can get back to you.
  • Via the in-chat CV attachment feature: If you tell the assistant you are interested in working at Nomasystems, it may let you attach your CV (one PDF file of up to 5 MB) to your message. Before the file reaches our recruitment team, it goes through one automated check: it is sent to Gemini (see Section 5), which only says whether it looks like a CV or like another kind of file, such as a ticket, a photo or an unrelated document. This check filters out files sent by mistake. It does not rate your profile and plays no part in any decision about your application. If the file passes, it is forwarded to Nomasystems’ recruitment team and reviewed by a person. If it does not, the assistant says so in its reply and the file is neither forwarded nor kept.
  • Via a referral from a Nomasystems employee: Our employees can recommend someone by sending that person’s CV through the internal chat. In that case we receive your data from the employee, not from you. The CV goes through the same check described above and then to our recruitment team. Employees must have your permission before sending your CV. We will tell you about this processing, and where your data came from, the first time we contact you, and in any case within one month of receiving it.
  • Via the Job Portal: When you apply for a job offer and attach your CV.
  • Via Employee Authentication: If you are an internal employee, we process the corporate email address associated with your Google account to grant you access to internal chat features.

Giving us your CV or contact details is voluntary: you can use the chat without telling us who you are, but without those details we cannot answer your contact request or consider your application. Please do not include especially sensitive data in your CV, such as information about your health, religion, beliefs or sexual orientation; if it does contain any, it will not be taken into account when evaluating your application.

This website is not intended for children under 14. If you are under 14, please do not give us any personal data.

3. Purpose of Processing

Your data will be processed for the following specific purposes:

  • To operate and provide automated responses through our RAG-based AI chat assistant.
  • To manage contact requests and enquiries collected through the chat assistant, including follow-up communication by email or phone, using the details and preferred time you gave us.
  • To manage spontaneous applications received through a CV attached via the chat assistant: checking automatically that the file is a CV, then forwarding it to Nomasystems’ recruitment team for manual evaluation.
  • To manage candidates recommended by our employees.
  • To manage our recruitment processes, evaluate your candidacy, and communicate with you regarding job opportunities when you apply for an offer.
  • To authenticate internal employees securely via Google Workspace for internal operations.
  • To investigate unexpected errors, fix bugs and improve the service, using the error records described in Section 6.
  • To improve the site’s content: when the assistant cannot find an answer, we use the topic of the question to create new FAQ pages.

We process your data on the following legal bases:

  • Consent: When you voluntarily initiate contact with us via the chat or provide your contact details (name, email address, phone number, preferred time and reason) so that we can contact you, you consent to us processing your data to answer your query. You may withdraw this consent at any time, as described in Section 8, without affecting the lawfulness of processing carried out prior to its withdrawal.
  • Pre-contractual measures / Legitimate Interest: When you apply for a job offer and submit your CV, whether through the Job Portal or by attaching it directly in the chat assistant, the processing is legitimised by the necessity to evaluate your profile for a potential employment relationship. This includes the automated check that the attached file is a CV, which is needed to deliver it to the recruitment team.
  • Legitimate Interest (referrals): When an employee recommends you, we process your CV on the basis of our legitimate interest in finding talent through people who know our work. You can object at any time (Section 8), and we will then delete your data.
  • Contractual Relationship: For internal employees, authenticating via your corporate email is processed under the basis of your employment relationship and our legitimate interest in securing corporate assets.
  • Legitimate Interest (service improvement): When an unexpected error occurs, we keep the data involved, and when the assistant cannot find an answer, we save the topic of the question. We do both on the basis of our legitimate interest in fixing bugs and improving the service and its content. You can object to this processing as described in Section 8.

5. Data Recipients and Sub-processors

To provide our services, your data may be processed by or shared with the following recipients:

  • Nomasystems AI Infrastructure: Messages sent through the chat assistant are processed by our internal orchestration system to generate responses.
  • OVHcloud (hosting provider): The website and our AI system run on OVHcloud servers located in the European Union, so everything you send through the chat passes through them, and the chat history, error records and topics of unanswered questions are stored there. OVHcloud acts as a data processor on behalf of Nomasystems under its data processing agreement.
  • Google LLC (language model provider — Gemini API): The content of your conversation with the chat assistant, including any contact details you write in it, is forwarded to Google’s Gemini API, which acts as a data processor on behalf of Nomasystems to generate the assistant’s responses and to extract your contact details when you ask us to contact you. When you attach a CV, the file is also sent to the Gemini API, solely to check whether it is a CV. This processing is governed by the Data Processing Addendum entered into between Google and Nomasystems, and may involve a transfer of data outside the European Economic Area, subject to the safeguards required by Chapter V of the GDPR (such as the European Commission’s Standard Contractual Clauses).
  • CV attached via the chat assistant: When you attach your CV in a conversation with the assistant, the file travels through our own infrastructure to Nomasystems’ recruitment team. Besides the Gemini API, for the check described in Section 2, it is delivered by email, so it is also stored in Gmail (see Google Workspace below). It does not pass through Bizneo.
  • Designated Nomasystems staff: Contact requests are emailed to the Nomasystems staff designated to handle them.
  • Google LLC (OAuth provider): When internal employees authenticate via Google, the authentication request is processed by Google’s OAuth service. Google returns a verified corporate email address to grant access. This processing is governed by Google’s privacy policy and the applicable data processing agreement between Google and Nomasystems.
  • Google LLC (corporate email provider — Gmail / Google Workspace): Nomasystems’ corporate email runs on Google Workspace (Gmail), so the contact requests and CVs we receive through the chat are stored in the Gmail mailboxes of the Nomasystems staff designated to handle them. Google acts as a data processor on behalf of Nomasystems under the data processing agreement between the two, and this processing may involve a transfer of data outside the European Economic Area, subject to the safeguards required by Chapter V of the GDPR.
  • Bizneo: When you apply for a job offer through our recruitment portal, your application data is processed on infrastructure provided by Bizneo as a service provider. Bizneo acts strictly as a data processor and does not control or own the data submitted.

All sub-processors are bound by data processing agreements that require them to handle your personal data in accordance with the GDPR.

International transfers: Google LLC is certified under the EU-US Data Privacy Framework, so the European Commission recognises that it provides an adequate level of protection. The transfers to Google described in this section rely on that adequacy decision and, in addition, on the European Commission’s Standard Contractual Clauses included in Google’s data processing terms.

6. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy:

  • Chat session data: Conversation history and associated session identifiers are stored in server memory and automatically and permanently deleted 7 days after your last message in that conversation. There is no long-term or permanent database retention of chat data. Beyond that period we only keep the CV and contact details you choose to send us, the records of any unexpected errors, and the topics of questions the assistant could not find an answer to, as described below.
  • CV submitted via the chat assistant: The file is retained as an email in the corporate mailboxes (Gmail, see Section 5) of the recruitment team, independently of the conversation history (which is deleted after 7 days as described above), for a maximum of one year from receipt, so that we can consider you for current or future vacancies, unless you ask us to delete it sooner or you are still taking part in a selection process. Files the check identifies as not being a CV are neither forwarded to the recruitment team nor kept, except in the case described under “Error records”.
  • Contact requests: Your request is sent by email, so it is stored in the corporate mailboxes (Gmail, see Section 5) of the Nomasystems staff designated to handle it. If it does not lead to a commercial or employment relationship, it is kept for a maximum of one year from receipt; if it does, for as long as that relationship lasts plus the periods required by law. You can ask us to delete it at any time by writing to hello@nomasystems.com.
  • Error records: If an unexpected technical error occurs while our system is processing a message or a file, the data involved is saved in that system’s error log to fix bugs and improve the service, and is kept only for as long as needed for that purpose. Without an error, nothing is saved there.
  • Topics of unanswered questions: They are saved without anything that identifies you and kept while they are useful for planning the site’s content.
  • Processing by the language model provider (Google): Message content and attached files are transmitted to the Gemini API solely to generate the real-time response and, for files, to check whether they are a CV. Google’s retention of this data is governed by its own data processing agreement with Nomasystems, and may differ from the 7-day period applied by Nomasystems to internally stored session data.
  • Authentication session: The session cookie containing your authenticated email address expires 7 days after your last visit and is deleted on sign-out.
  • Job application data: CV and application data are retained for the duration of the recruitment process and, where applicable, for the period required by applicable employment and data protection law.

Our website contains links to external platforms such as GitHub and social networks.

  • While we are not responsible for the privacy policies of these third-party platforms once you are redirected there, Nomasystems remains responsible for any data processing that we initiate directly on our own domain before the redirection.
  • If you interact with our corporate social media profiles, the data processing will also be governed by the terms of those specific platforms, though we will treat any data you provide us through them with the same confidentiality.

8. User Rights

As a data subject, you have the right to:

  • Access your personal data.
  • Request the rectification of inaccurate data.
  • Request the erasure of your data when, among other reasons, they are no longer necessary for the purposes they were collected.
  • Request the limitation of the processing of your data.
  • Object to the processing of your data.
  • Request data portability.
  • Not be subject to a decision based solely on automated processing.
  • Withdraw your consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

You can exercise these rights at any time by sending a written request to hello@nomasystems.com.

If you think the automated check wrongly rejected your CV, write to hello@nomasystems.com or apply through the Job Portal, and a person will review it.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at www.aepd.es if you consider that the processing of your personal data violates the applicable regulations.

For more information about the cookies used on this site, please see our Cookie Policy.