Privacy policy

In accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the protection of personal data and digital rights (LOPDGDD), this policy explains how personal data collected through this website is processed.

1. Data controller

Controller

K&D LEGALTECH, S.L.

Tax ID (NIF)

[NIF: pending]

Address

Paseo de los Navegantes 9, 3.º derecha, 28500 Arganda del Rey (Madrid)

Contact

cdicu@kdlegaltech.com

The company is not required to appoint a data protection officer. Any privacy question can be sent to the address above.

2. What data we process and why

a) Assessment and contact form. Name, job title, organisation, email, phone (optional), preferred time for the call, comments and your assessment answers (type of organisation, AI uses and needs). They are used only to respond to your request, hold the discovery call and, if you ask, prepare a proposal. They are not used for marketing and no profiles are built.

b) Technical connection data. When you visit the website, our infrastructure provider processes your IP address and technical request data solely to serve the page, protect the site against attacks and abuse (for example, limiting form submissions) and diagnose errors. We don't use analytics or advertising tools.

3. Legal basis

• Form: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, where you write on behalf of an organisation, our legitimate interest in maintaining professional contact with it (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD).
• Technical data: legitimate interest in the security and operation of the website (Art. 6(1)(f) GDPR).

Providing the form data is voluntary, but without it we cannot handle your request.

4. How we protect your data

Form data is encrypted in your own browser before it is sent, with a key whose private part is held only by the K&D LEGALTECH team. Neither the hosting provider nor anyone with access to the servers can read it. It is decrypted only in the company's internal dashboard, which is protected by strong authentication, and every access is recorded in an audit log.

5. How long we keep it

• Requests that do not lead to an engagement: 12 months from the last contact; then they are deleted.
• If an engagement is agreed, the data becomes part of the contractual relationship and is kept for the legal periods (for example, six years for commercial records under Article 30 of the Spanish Commercial Code).
• Technical connection data: a few days at most, unless needed to investigate a security incident.

6. Recipients and processors

We do not share data with third parties unless required by law. We use one provider acting as a processor under a contract compliant with Article 28 GDPR:

• Cloudflare, Inc. and its affiliates: website hosting, delivery network and database. The database is located in the European Union. As a US company, it may process technical data outside the European Economic Area; it participates in the EU-US Data Privacy Framework and offers the European Commission's standard contractual clauses. Remember that form data reaches it already encrypted.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to cdicu@kdlegaltech.com, stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it. We will reply within one month.

If you believe we have not handled your rights correctly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.

8. Other matters

No automated decisions are made and no profiles are built. The website is not aimed at children under 14. If this policy changes, we will publish the new version here with its date. For cookies, see the cookie policy.