Privacy Policy

1. Controller

• Controller: KELVADO, SOCIEDAD LIMITADA (Sociedad Unipersonal)
• Tax ID: B93797355
• Address: Calle Lepanto, 270, bajos, 08013 Barcelona, España
• Data protection contact: support@kelbado.eu

No Data Protection Officer has been appointed, as the conditions of article 37 GDPR do not apply. Enquiries are handled at the address above.

2. Two roles: controller and processor

• We are the controller for data of the people who create and manage an account on Kelbado (account owners, administrators, authors, instructors) and for the associated billing and security data.
• We are a processor for the data of Learners that a customer brings onto the platform to train its staff. There the customer (usually the employer) is the controller and determines purposes and means. Those relationships are governed by the Data Processing Agreement. If you are a learner and wish to exercise your rights, contact your employer or training body; we will help route the request. This includes the evidence employees submit for tasks and audits set by the customer (photos, videos, signatures, scanned codes, answers) and, only where the customer enables it for a task, the device location at the moment of submission — a single point, not continuous tracking, which the customer must tell its workers about in advance.

3. Data we process and why

Category	Data	Purpose	Legal basis (art. 6 GDPR)
Account	name, email, hashed password, language, role, organisation	providing and managing the service	performance of a contract (6.1.b)
Service usage	access logs, IP address, browser, actions recorded in the audit log	security, fraud prevention, support, traceability	legitimate interest (6.1.f) and legal obligation (6.1.c)
Sanctions compliance	country declared at sign-up and for the organisation; the country derived from the IP address when signing up, creating an organisation or paying (looked up in a geolocation database hosted on our own servers — the IP address is not sent to any third party); refusals are kept in the audit log	not providing the service where EU restrictive measures prohibit it (Regulation (EU) No 833/2014 art. 5n, Regulation (EC) No 765/2006)	legal obligation (6.1.c)
Content	uploaded documents, courses, quiz answers, results and certificates	providing the service	contract (6.1.b); as processor, on the customer's instructions
AI requests	text and instructions sent to models to generate or translate content	generating the content the user asked for	contract (6.1.b)
Billing	tax details, plan, order history	contract management and accounting obligations	contract (6.1.b) and legal obligation (6.1.c)
Marketing messages	email address, preferences	product news	consent (6.1.a) or legitimate interest for existing customers (LSSI art. 21.2)
Launch waitlist (before launch)	email address, language, the page where it was left (public site or sign-in page), the consent text accepted and its version, date, IP address and browser	a single email telling you that Kelbado is open	consent (6.1.a), given by ticking the box in the form and withdrawable at any time by writing to support@kelbado.eu
Integration enquiries	email address, company, approximate number of learning materials and of learners, the integration requested and its description, language, the consent text accepted and its version, date, IP address and browser	answering your enquiry about an integration and contacting you about it	consent (6.1.a), given by ticking the box in the form and withdrawable at any time by writing to support@kelbado.eu; where the enquiry leads to an offer, steps taken at your request before entering into a contract (6.1.b)
Assistant memory	preferences and instructions the AI assistant remembers between sessions (one entry per person and organisation)	personalising the assistant	contract (6.1.b); deleted with the account
Tutor conversations	messages Learners send to the AI tutor within a course, the answers and their references to the course materials	answering the Learner's questions about the course	as processor, on the customer's instructions
Tasks and audits	answers, photos, videos, signatures and scanned barcode/QR values submitted for a task, the reviewer's decision and comment; where the customer enables it for the task, the device location (one point with its accuracy) at the moment of submission, visible to the reviewer	checklists, audits and practical assignments set by the customer and their review	as processor, on the customer's instructions
Support and feedback	support requests (subject, message and attachments), satisfaction-survey answers (NPS: score and comment), feature requests	handling issues and improving the product	contract (6.1.b) and legitimate interest (6.1.f)
Illegal-content notices and complaints (DSA)	for notices: name and email of the notifier (optional only for child sexual abuse material), the reported address, the explanation, the IP address and browser; for complaints against our decisions: the message and IP address; the decision and its reasons. The notifier's identity is not disclosed to the owner of the content	handling notices, deciding on them, giving reasons and handling complaints (Regulation (EU) 2022/2065, arts. 16, 17 and 20)	legal obligation (6.1.c)
Technical security reports	Content-Security-Policy violation reports sent by the browser: violated directive, blocked URL, page and source file; the IP address and browser are processed on receipt to limit report volume	detecting attacks and misconfigurations	legitimate interest (6.1.f)
Referral programme	the organisation's invitation code, which organisation invited which, and the reward granted	running the referral programme and preventing abuse	contract (6.1.b) and legitimate interest (6.1.f)
Web analytics (public site only)	pseudonymous usage data of the public pages (home, pricing, blog, legal pages): pages viewed, events, device type and browser, approximate location derived from the truncated IP address, cookie identifiers; with Hotjar, heatmaps and session recordings with form fields masked	measuring and improving the public site	consent (6.1.a), given in the cookie banner and withdrawable at any time under "Cookie settings"
Advertising (public site only)	Google Ads cookie identifiers, pages visited on the public site and conversions (for example a sign-up)	building remarketing audiences and measuring conversions of Kelbado's own campaigns	consent (6.1.a), withdrawable at any time under "Cookie settings"

Where the legal basis is legitimate interest (art. 6.1.f GDPR), the data subject may object at any time by writing to support@kelbado.eu; the corresponding balancing assessment is documented internally and available on request.

We do not process card payment data. Payments are processed by the Merchant of Record (see Terms, clause 5.1), which acts as an independent controller for payment data.

4. Automated decisions and profiling

We make no automated decisions producing legal or similarly significant effects on individuals. Grades, certificates and any AI-assisted assessment are reviewed and validated by a human (instructor or training manager) before taking effect. See the AI Transparency Notice.

5. Retention periods

• Account data: while the account is active and thirty (30) days after closure, unless legally required otherwise.
• Content and courses: while the account exists; after closure, thirty (30) days for export and then deletion or anonymisation.
• Billing and accounting: six (6) years (art. 30 of the Spanish Commercial Code) and four (4) years for tax purposes.
• Audit and security logs: up to twenty-four (24) months; up to thirty-six (36) months for organisations whose plan includes the extended audit log, at the Customer's choice of plan.
• Technical security reports (CSP): up to twenty-four (24) months.
• Launch waitlist: until the launch email is sent and never longer than twelve (12) months from the consent; deleted earlier if consent is withdrawn.
• Integration enquiries: up to twelve (12) months from the consent; deleted earlier if consent is withdrawn. If a contract follows, the data needed for it is kept as account and billing data.
• Support requests and feedback: up to twenty-four (24) months after closure.
• Illegal-content notices and complaints (DSA): twenty-four (24) months after the last decision on the notice (or after it was filed, if still open), to answer complaints and requests from authorities.
• Assistant memory and tutor conversations: while the account exists; deleted with it.
• Task submission location: the coordinates are erased twelve (12) months after the submission is reviewed (or after it was submitted, if never reviewed); the rest of the submission follows the customer's data.
• Backups: overwritten within a maximum thirty (30) day cycle.
• Public-site analytics and advertising: Google Analytics 4 with data retention set to fourteen (14) months; Hotjar session recordings, three hundred and sixty-five (365) days.
• Learner data processed on a customer's behalf: as instructed by the customer, under the DPA.

6. Recipients and processors

We share data only with providers supplying hosting, email, artificial intelligence, speech synthesis, monitoring, payment and, on the public site, analytics and advertising services. The full list, with country and transfer mechanism, is published and kept current at Sub-processors.

If you consent in the public site's cookie banner, analytics and advertising data is shared with Google Ireland Ltd (Google Analytics 4 and Google Ads; Google may also process it at Google LLC, United States, under the Data Privacy Framework) and with Hotjar Ltd (Malta, European Union).

We may also disclose data to competent authorities where legally required.

7. International transfers

Primary servers are in the European Union. Some providers are established in the United States; those transfers rely on the Data Privacy Framework where the provider is certified, or otherwise on the European Commission's standard contractual clauses together with supplementary measures. Google LLC (United States), which may receive the public site's analytics and advertising data when you consent, is certified under the Data Privacy Framework. Per-provider details are in Sub-processors.

8. Artificial intelligence and model training

Content you send to the platform is transmitted to model providers solely to produce the output you request. We do not authorise the use of your data to train third-party models and we use zero- or minimal-retention settings where the provider offers them. Should any processing ever require additional consent, it will be requested explicitly.

No customer content and no learner data is ever used for advertising. The analytics and advertising described in section 3 measure only visits to the public site (home, pricing, blog and legal pages); they never load inside the application or the learner portal.

9. Security

We apply appropriate technical and organisational measures: encryption in transit (TLS), passwords stored with a key-derivation function, role-based access control, isolation between organisations, available two-factor authentication, an audit log, encrypted backups and regular dependency review.

In the event of a personal data breach posing a risk to individuals' rights, we will notify the Spanish Data Protection Agency within 72 hours and the affected individuals where the risk is high. Where we act as processor, we will inform the customer without undue delay.

10. Your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection at any time, and withdraw any consent given, by writing to support@kelbado.eu or from Profile → Privacy in the application, where account export and deletion are available.

We may ask for documentation proving your identity. We will respond within one month, extendable by two further months for complex requests.

If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).

11. Minors

The service is intended for people over 18. We do not knowingly process data of children under fourteen (14). Where a customer enrols minors, it is responsible for holding the legal basis and the consent of their legal guardians under article 7 of the LOPDGDD.

12. Cookies

The use of cookies and similar technologies is described in the Cookie Policy.

13. Changes to this policy

Any change will be published on this page with a new version number and effective date. Material changes will be notified by email thirty (30) days in advance.