Privacy policy

1. Data controller

In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we inform you that the controller of your personal data is:

• Name: Nuño Valencia Castrillo.
• Tax ID (NIF): 71439854Z.
• Address: Calle La Presa, León (España).
• Contact email (also for exercising your rights): [email protected].
• Website: kaimban.com (Kaimban (kaimban.com)).

No data protection officer has been appointed as it is not mandatory in this case; any privacy question can be sent to the email above.

2. What data we process, why, and on what legal basis

We process the data you give us or that is generated when you use the site. For each processing activity we state the data, the purpose, the legal basis and the retention period.

• Early access list (form on the home page and early access pop-up). Data: your email address, the form and page you signed up from, language, date and time, campaign parameters in the web address (utm_*) if any, and the fact that you ticked the consent box. Purpose: to let you know when your place opens, to send you Kaimban news, and to be able to prove you gave consent. Legal basis: your consent (Article 6.1.a GDPR and Article 21 LSSI-CE). Retention: until you withdraw consent or unsubscribe; afterwards, blocked for the limitation periods of possible liabilities.
• Contact form. Data: name, email, company (optional), your role, team size and interest you select, the plan you ask about, your message and the same technical data as above. Purpose: to answer your enquiry or commercial request and, if you tick the box, to send you communications about Kaimban. Legal basis: your request (Article 6.1.b GDPR) or our legitimate interest in assisting you (Article 6.1.f) and, for communications, your consent (Article 6.1.a). Retention: as long as needed to assist you and afterwards blocked for the applicable limitation periods.
• Server logs. Data: IP address, date and time, requested page, browser type and response code. Purpose: to ensure the security and proper operation of the site and detect abuse and errors. Legal basis: legitimate interest in the security and operation of the service (Article 6.1.f GDPR). Retention: for a limited, proportionate period, after which they are deleted or anonymised.
• Preferences stored in your browser. Data: whether you closed the early access pop-up or the language suggestion. Purpose: not to nag you. They are stored only on your device and we do not receive them. More information in the cookie policy.

Data marked as optional is not needed to use the site. To join the early access list you must enter your email and tick the consent box; without it we will not send you commercial communications.

3. Source of the data

The data comes directly from you (forms and messages) or from your browser (server logs and page address). We do not obtain data from third-party sources.

4. What we do not do

We do not sell or hand over your data to third parties for their own purposes, we do not show advertising, we do not use visitor analytics or third-party tracking tools on the site, and we do not take automated decisions, including profiling, that produce legal effects on you or significantly affect you.

5. Recipients and processors

Your data is disclosed to third parties only when necessary to provide the service or required by law:

• Infrastructure and hosting providers of the site, who process server logs and form submissions on behalf of the owner.
• Our lead capture service (lead-intake) and contact management system (CRM), where form and subscription data is stored, and, if used, the email delivery service; they act as processors under the safeguards required by the GDPR.
• Fallback mail service: if the lead capture service is unavailable, the form content is sent by email through the owner’s own sending service (api.nunovalencia.com) so your request is not lost.
• Public authorities, courts and law enforcement, where there is a legal obligation.

This site does not load fonts, scripts, videos or images from third-party servers: everything is served from its own domain, so your browser does not connect to third parties when you visit it.

6. International transfers

Data is processed on servers under the owner’s control. If a provider processed data outside the European Economic Area, it would do so with the safeguards provided by the GDPR, such as an adequacy decision or standard contractual clauses. You can ask us for more information at [email protected].

7. Your rights

You can exercise the following rights over your personal data at any time:

• Access: to know whether we process your data and obtain a copy.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to ask us to delete it when it is no longer necessary, you withdraw consent or for another legal reason.
• Objection: to object to processing based on legitimate interest, or to direct marketing.
• Restriction: to ask us to suspend processing in the cases provided by law.
• Portability: to receive the data you gave us in a structured, commonly used format.
• Withdrawal of consent: without affecting the lawfulness of processing before withdrawal.

To exercise them, write to [email protected] stating which right you want to exercise and attaching the data needed to identify you. We will reply within one month at most, extendable as the GDPR provides, and free of charge except for manifestly unfounded or excessive requests.

If you believe the processing of your data infringes the regulations, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es; C/ Jorge Juan, 6, 28001 Madrid) or with the supervisory authority of your country of residence.

8. Unsubscribing from communications

You can unsubscribe at any time using the unsubscribe link in our emails, or by writing to [email protected]. After unsubscribing we will not send you further commercial communications.

9. Minors

The site and the product are not aimed at children under 14. If you are under that age, do not give us your data without the consent of your parents or guardians. If we detect that we have collected data from a minor without that consent, we will delete it.

10. Security

We apply reasonable technical and organisational measures proportionate to the risk to protect your data against loss, unauthorised access, alteration and disclosure, including encrypted communications (HTTPS), access control and backups. If a security breach entailing a high risk to your rights occurs, we will notify you in accordance with the GDPR.

11. Changes to this policy

We may update this policy to reflect changes in data processing or in the regulations. The date of the last update appears at the top of the page; if changes are significant, we will say so prominently.