LegalKybernes Tech
Privacy policy
Last updated: 16 October 2026
This policy explains what personal data we process when you use our websites, why, on what legal basis, how long we keep it, who we share it with and what rights you have.
1. Data controller
Company Group Kybernes, S.L.U. (Tax ID B26766253), Plaza Josep Rovira 13, 4.º 2.ª, 08018 Barcelona, Spain. Email for any data protection matter: legal@kybernesgroup.com.
We have not appointed a data protection officer because we are not required to.
All five websites (kybernesgroup.com and the subdomains realestate., tech., hotels. and pulse.) belong to the same company. When you contact one of our units, such as Kybernes Tech, the controller is still Company Group Kybernes, S.L.U.
2. What data we process and where it comes from
We process the data you give us (contact and quote request forms, meeting bookings, email, subscriptions, applications), data generated while you browse (IP address and, if you accept analytics, cookie identifiers and pages visited) and, for business contacts, the public contact details on your LinkedIn profile or your company’s website.
We do not process special categories of data (health, psychological data, beliefs, etc.) or data of children under 14 through our websites. Please do not include them in free-text fields.
The data maturity check on this site runs in your browser: what you enter is not sent anywhere unless you decide to request a quote and the result is copied into the form message, which you can review before sending. If you choose to book the first conversation from the result, the booking link only carries the overall level (for example, “level 3”).
3. Purposes, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Contact and quote request form: to handle your enquiry, qualify it, tell you who to speak to and, if you ask, prepare and send you a tailored quote and follow it up | Name, email, company, systems you use, number of employees, what you want to solve, timing, message and any information you give us for the quote | Steps taken at your request prior to entering into a contract (Art. 6.1.b GDPR) and, if you write on behalf of a company, our legitimate interest in dealing with business contacts (Art. 6.1.f GDPR and Art. 19 LOPDGDD) | While we handle the enquiry or the quote is valid, and up to 12 months after the last contact if no relationship follows; if the quote is accepted and a contract signed, the data becomes part of the contractual relationship |
| Booking the first conversation on Cal.com | Name, email and the answers you give when booking; date, time and time zone; source of the visit (for example, “web”) | Pre-contractual steps at your request (Art. 6.1.b) | As for the previous purpose; the meeting is kept in our Google Workspace calendar |
| Newsletter, if you subscribe | Email, name (optional), chosen unit, date and source of subscription | Consent (Art. 6.1.a GDPR and Art. 21 LSSI), which you can withdraw at any time | Until you unsubscribe; we then keep your email on a suppression list so we do not write to you again |
| Communications to clients about services similar to those contracted | Business email, services contracted | Legitimate interest and Art. 21.2 LSSI, with the option to opt out in every message | While you are a client and until you object |
| Job or collaboration applications | Name, contact details, CV, cover letter, LinkedIn profile, qualifications, availability, proposed fees | Pre-contractual steps at your request (Art. 6.1.b) and, to keep your application for future openings, your consent (Art. 6.1.a) | During the process and, if nothing follows, 12 months; with your consent, up to 24 months |
| Contractual relationship with clients, suppliers and collaborators | Identification, contact, billing and payment data, and data relating to the service | Performance of the contract (Art. 6.1.b); legal tax and accounting obligations (Art. 6.1.c) | For the duration of the relationship and then, blocked, for the statutory limitation periods (5 years by default; 4 and 6 years for tax and accounting obligations) |
| Business prospecting (business contacts who have not written to us) | Name, position, company, business email, public LinkedIn profile, sector | Legitimate interest in approaching companies that fit our services (Art. 6.1.f GDPR and Art. 19 LOPDGDD), with the option to object in the first and every following message. The first contact is made through LinkedIn or by phone; we only email you if you have replied, been introduced to us or are already a client (Art. 21 LSSI) | Until you object, or 24 months without a reply; the data is then deleted |
| LinkedIn (Kybernes pages) | Public interactions (following, comments, messages) | Legitimate interest in managing our professional presence; LinkedIn Ireland Unlimited Company is joint controller of page statistics under its terms | According to LinkedIn's terms; messages you send us are handled as in the first purpose |
| Web analytics | Cookie identifier, pages viewed, device, source of the visit, truncated IP | Consent (Art. 22.2 LSSI and Art. 6.1.a GDPR) through the cookie banner | See the cookie policy |
| Security and server logs | IP, date and time, page requested, user agent | Legitimate interest in the security of our websites (Art. 6.1.f) | The number of days set by the hosting provider for its logs |
| Handling rights requests and complaints | Identification data and details of the request | Legal obligation (Art. 6.1.c) | The limitation periods for infringements (up to 3 years) |
Fields marked as required in each form are needed to deal with your request; if you do not provide them, we will not be able to do so.
4. Automated decisions and profiling
We do not make automated decisions with legal effects on you through our websites. We sort enquiries by unit and urgency so we can reply sooner, but the reply always comes from a person.
5. Automatic confirmation
When you submit a form you may receive an automatic confirmation email. It is a service message, not a commercial one.
6. Children
Our websites are aimed at professionals and companies. We do not knowingly process data of children under 14 (Art. 7 LOPDGDD); if we find that such data has been provided, we will delete it.
7. Recipients and processors
We do not sell or share your data. We only disclose it:
- To public authorities, courts or regulators when the law requires it.
- To service providers who process data on our behalf as processors, under a data processing agreement (Art. 28 GDPR).
- To LinkedIn Ireland Unlimited Company, joint controller of company page statistics, under its terms of use.
| Provider | Service | Data location and safeguards |
|---|---|---|
| Google Ireland Limited (Google Workspace) | Email, calendar, document storage and contract signing | EU, with possible transfers to the US covered by the EU-US Data Privacy Framework and standard contractual clauses |
| Vercel, Inc. | Website hosting and web analytics (only with your consent) | Technical logs that may be processed in the US under standard contractual clauses |
| Formspree, Inc. | Receiving website forms | US, under standard contractual clauses |
| Resend, Inc. | Sending confirmation emails | Standard contractual clauses where data is transferred outside the EU |
| Cal.com, Inc. (US) | Session bookings: name, email and the answers you give when booking | US, under standard contractual clauses |
| Supabase, Inc. (Amazon Web Services) | Database for our internal management tool, where we record enquiries and opportunities | EU (Ireland); standard contractual clauses for support from outside the EU |
| Microsoft Ireland Operations Ltd. | Shared channel with clients (Teams) and data platform in projects | EU, with the safeguards of Microsoft's Data Protection Addendum |
| Accounting and tax advisers, and our bank | Invoicing and payment | Spain |
8. International transfers
Some providers are US companies or may access data from outside the European Economic Area for support. In those cases the transfer is covered by the adequacy decision for the EU-US Data Privacy Framework (where the provider is certified) or by the standard contractual clauses approved by the European Commission (Decision 2021/914), with any supplementary measures required. You can ask us for a copy of the safeguards at legal@kybernesgroup.com.
9. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given without affecting the lawfulness of earlier processing. To do so, write to legal@kybernesgroup.com or to Plaza Josep Rovira 13, 4.º 2.ª, 08018 Barcelona, Spain, stating which right you are exercising and, if we have doubts about your identity, some information that allows us to confirm it. We will reply within one month (extendable by two further months in complex cases, in which case we will let you know).
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid). We would appreciate it if you told us first.
10. Security
We apply technical and organisational measures appropriate to the risk: named accounts with two-factor authentication, encryption in transit and at rest, access control, backups and confidentiality commitments from our team and collaborators. No transmission over the internet is completely secure; if you spot any problem, write to us at legal@kybernesgroup.com.
11. Changes
We may update this policy to reflect legal changes or changes to our services. We will publish the new version with its date and, if the change is significant and we have your email, we will let you know.
This policy is also available in Spanish.