1. Who is responsible for your data

The data controller for this website is:

Grupo Torni, S.A. de C.V.
Uxmal 250, Colonia Narvarte
03020 Ciudad de México, Mexico
[email protected]

The advisory practice operates under the brand nyman.consulting. Where this policy says “we” or “I”, it refers to Grupo Torni, S.A. de C.V. acting through Christian Nyman.

This policy applies to the website at nyman.consulting and to the contact, scheduling, and email channels described below. It does not apply to third-party websites we link to.

2. Which laws apply

Because this practice is based in Mexico and works with clients in Finland, Sweden, and elsewhere in the European Union, two frameworks apply in parallel:

• Mexico — the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), published in the Official Gazette on 20 March 2025 and in force since 21 March 2025. This law repealed the previous 2010 statute. Enforcement now sits with the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), which took over the functions of the former INAI.
• European Union — Regulation (EU) 2016/679 (GDPR), which applies to visitors and clients located in the EU and EEA.

A Spanish-language Aviso de Privacidad Integral is published separately and is the operative version for purposes of Mexican law.

3. What personal data we collect

Data you give us directly

Through the contact form: first name, last name, email address, company name, your answer to “what best describes your situation”, your message, and your preferred language. Where a phone number field is presented, giving it is optional.

Through the booking page: your first and last name, email address, company name, and anything you add in the notes field. If you reschedule or cancel, the record of that change is kept with the booking.

By emailing us directly: whatever you choose to include in your message, together with your email address and any signature block.

Data collected automatically

Server logs. Our host records your IP address, browser type and version, the pages you request, timestamps, and referring URLs. This happens for every visitor and is a normal part of operating a web server.

Cookies, and tracking in some emails. Cookies are used on the website, and some emails we send to contacts in Mexico, the United States and Canada contain tracking technologies that record whether the email was opened and which links were clicked. See section 5.

We do not knowingly collect data from anyone under 18, and we do not collect sensitive personal data (health, biometric, religious, political, or financial data) through this website. Please do not send sensitive information through the contact form or by unencrypted email.

4. Why we process it, and on what legal basis

What we do	Why	GDPR legal basis
Reply to your enquiry	You asked us to	Steps prior to entering a contract (Art. 6(1)(b)), or legitimate interest (Art. 6(1)(f))
Schedule and hold an introductory call	To arrange the meeting you requested	Steps prior to a contract (Art. 6(1)(b))
Keep a record of our correspondence in the CRM	To manage the client relationship and avoid losing context	Legitimate interest (Art. 6(1)(f))
Follow up by email on your enquiry, the call or a proposal, including scheduled or automated messages	To continue the conversation you started	Steps prior to a contract (Art. 6(1)(b)), or legitimate interest (Art. 6(1)(f))
Send you follow-up communications you opted into	You consented	Consent (Art. 6(1)(a))
Operate and secure the website	To keep the site available and defend against abuse	Legitimate interest (Art. 6(1)(f))
Meet accounting, tax, and professional record-keeping obligations	Required by law	Legal obligation (Art. 6(1)(c))

Under Mexican law, the purposes above that are necessary to respond to you and to provide the advisory service are primary purposes. Two purposes are secondary, and you may refuse either without affecting the service: sending you optional marketing or insight communications, and measuring whether you open the emails we send and which links you click, so we can decide when and how to follow up (section 5).

To refuse open and click measurement, write to [email protected]. From then on we write to you without it. This measurement applies only to contacts located in Mexico, the United States and Canada — never to anyone in the European Union, the European Economic Area or the United Kingdom.

We do not sell personal data, and we do not use it for automated decision-making or profiling that produces legal effects.

5. Cookies and tracking

This website uses the following:

pll_language. The only cookie this website sets is pll_language, placed by Polylang — the plugin that runs the four language versions of the site. It stores a two-letter language code and nothing else: no identifier, no personal data. Its purpose is to keep you on the language version you are reading. It is a functional cookie and is not used for analytics or advertising.

Hosting and security. Our host and Cloudflare may set short-lived technical cookies to route traffic and mitigate attacks. These are strictly necessary to deliver the site.

HubSpot forms. The contact form is embedded from HubSpot and loads a script from HubSpot’s servers when the page is displayed. Loading the form does not place a cookie on your device. The form works and can be submitted whether or not cookies are accepted.

Emails sent through HubSpot — contacts in Mexico, the United States and Canada only. Some emails to business contacts located in Mexico, the United States or Canada — including scheduled or automated follow-up — are sent from our CRM, HubSpot. These emails contain a small invisible image and links routed through HubSpot’s servers before they reach their destination, which record whether and when the message was opened and which links were clicked. We use this only to decide when and how to follow up (a secondary purpose — section 4). It is stored with the contact record in our CRM for as long as that record is kept. We do not use it for advertising and do not share it with anyone other than HubSpot. We do not send tracked email to anyone located in the European Union, the European Economic Area or the United Kingdom. Every commercial email we send identifies us, gives our postal address (section 1) and lets you opt out of further messages.

How to avoid it. You can prevent the invisible image from loading by setting your email client not to download images automatically. You can also ask us not to track your emails by writing to [email protected]; emails we send you after that will not contain these technologies.

We do not run analytics or visitor tracking on the website. This site carries no site-wide analytics or tracking script — no Google Analytics, and not HubSpot’s website tracking code. We do not build a browsing profile of visitors, we do not record which pages you look at before contacting us, and we do not track you across other websites. Because we set no non-essential cookies, we do not ask you for cookie consent.

You can block or delete cookies in your browser settings at any time.

If this changes — if we later add analytics — we will update this section and, where the law requires it, ask for your consent before any such cookie is set.

6. Who else handles your data

We use established service providers. Each processes data only to deliver its service to us.

Provider	What it does	Where it processes data
HubSpot, Inc.	CRM, contact forms, scheduling and booking pages, email sending and open/click measurement	United States
Cloudflare, Inc.	DNS, CDN, TLS, security filtering — sees IP addresses and request metadata	Global edge network
Hostinger International Ltd.	Web hosting and server logs	Origin server in Phoenix, Arizona, United States
Microsoft Corporation	Business email and calendar (Microsoft 365), Teams meeting links	Regional Microsoft data centres

We may also disclose data to professional advisors, or to authorities where we are legally required to do so.

7. International transfers

Personal data collected through this site is processed outside the European Economic Area — principally in the United States, and in Mexico where the controller is established.

Mexico does not currently hold a European Commission adequacy decision. Transfers of EU personal data are therefore made under Standard Contractual Clauses or equivalent safeguards in our agreements with the providers listed above, together with supplementary measures where appropriate. You may request further information about these safeguards using the contact details in section 11.

Under the Mexican framework, by providing your data through this website you are informed that it will be processed by the providers listed in section 6, which operate outside Mexico.

8. How long we keep it

Data	Retention
Enquiries that do not become engagements	Up to 24 months from last contact, then deleted
Client records and correspondence	For the duration of the engagement, then as required by Mexican accounting and tax law — generally 5 to 10 years
Booking records	Up to 24 months
Email open and click records	For as long as the contact record is kept in our CRM, under the periods above
Marketing consent records	Until you withdraw consent, plus a record of the withdrawal itself
Server logs	Typically 30 to 90 days, per the provider’s standard configuration

9. Your rights

If you are in the EU or EEA (GDPR)

You have the right to access your data; to have it rectified; to have it erased; to restrict processing; to data portability; to object to processing based on legitimate interest, including direct marketing; and to withdraw consent at any time, without affecting the lawfulness of what was done before you withdrew it.

We will respond within one month, extendable by two further months for complex requests.

You may also lodge a complaint with your national supervisory authority:

• Finland — Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi
• Sweden — Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se
• Or the authority in your own country of residence or workplace.

If you are in Mexico (ARCO rights)

You have the right of Access, Rectification, Cancellation, and Opposition — the ARCO rights — and the right to revoke consent, and to limit the use or disclosure of your data.

To exercise them, write to [email protected] stating your name, a means of contacting you, proof of identity (or of authority to act on the data subject’s behalf), a clear description of the data concerned, and any documents supporting your request.

Under Article 31 of the Federal Law on the Protection of Personal Data Held by Private Parties, we will communicate our determination within 20 days of receiving your request, and if it is granted we will act on it within a further 15 days. Both periods may be extended once, for an equal period, where circumstances justify it.

If you are dissatisfied with the outcome, you may bring the matter before the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno).

10. Security

We use encrypted connections (TLS) across the site, access controls and multi-factor authentication on the systems that hold personal data, and providers that maintain recognised security certifications. No system is perfectly secure, and we cannot guarantee absolute security — but we will notify you and the relevant authority where a breach is likely to result in a risk to your rights.

11. Contact and changes

Questions about this policy, or requests to exercise your rights:

[email protected]

We may update this policy as the practice, its providers, or the law change. Material changes will be announced on this page with a revised “last updated” date. Where a change materially affects the purposes of processing, we will seek your consent again if the law requires it.