Privacy Policy

1. Controller

• Controller: KELVADO, SOCIEDAD LIMITADA (Sociedad Unipersonal)
• Tax ID: B93797355
• Address: Calle Lepanto, 270, bajos, 08013 Barcelona, España
• Data protection contact: support@kelbado.eu

No Data Protection Officer has been appointed, as the conditions of article 37 GDPR do not apply. Enquiries are handled at the address above.

2. Two roles: controller and processor

• We are the controller for data of the people who create and manage an account on Kelbado (account owners, administrators, authors, instructors) and for the associated billing and security data.
• We are a processor for the data of Learners that a customer brings onto the platform to train its staff. There the customer (usually the employer) is the controller and determines purposes and means. Those relationships are governed by the Data Processing Agreement. If you are a learner and wish to exercise your rights, contact your employer or training body; we will help route the request.

3. Data we process and why

Category	Data	Purpose	Legal basis (art. 6 GDPR)
Account	name, email, hashed password, language, role, organisation	providing and managing the service	performance of a contract (6.1.b)
Service usage	access logs, IP address, browser, actions recorded in the audit log	security, fraud prevention, support, traceability	legitimate interest (6.1.f) and legal obligation (6.1.c)
Content	uploaded documents, courses, quiz answers, results and certificates	providing the service	contract (6.1.b); as processor, on the customer's instructions
AI requests	text and instructions sent to models to generate or translate content	generating the content the user asked for	contract (6.1.b)
Billing	tax details, plan, order history	contract management and accounting obligations	contract (6.1.b) and legal obligation (6.1.c)
Marketing messages	email address, preferences	product news	consent (6.1.a) or legitimate interest for existing customers (LSSI art. 21.2)
Assistant memory	preferences and instructions the AI assistant remembers between sessions (one entry per person and organisation)	personalising the assistant	contract (6.1.b); deleted with the account
Tutor conversations	messages Learners send to the AI tutor within a course, the answers and their references to the course materials	answering the Learner's questions about the course	as processor, on the customer's instructions
Support and feedback	support requests (subject, message and attachments), satisfaction-survey answers (NPS: score and comment), feature requests	handling issues and improving the product	contract (6.1.b) and legitimate interest (6.1.f)
Technical security reports	Content-Security-Policy violation reports sent by the browser: violated directive, blocked URL, page and source file; the IP address and browser are processed on receipt to limit report volume	detecting attacks and misconfigurations	legitimate interest (6.1.f)
Referral programme	the organisation's invitation code, which organisation invited which, and the reward granted	running the referral programme and preventing abuse	contract (6.1.b) and legitimate interest (6.1.f)
Web analytics (public site only)	pseudonymous usage data of the public pages (home, pricing, blog, legal pages): pages viewed, events, device type and browser, approximate location derived from the truncated IP address, cookie identifiers; with Hotjar, heatmaps and session recordings with form fields masked	measuring and improving the public site	consent (6.1.a), given in the cookie banner and withdrawable at any time under "Cookie settings"
Advertising (public site only)	Google Ads cookie identifiers, pages visited on the public site and conversions (for example a sign-up)	building remarketing audiences and measuring conversions of Kelbado's own campaigns	consent (6.1.a), withdrawable at any time under "Cookie settings"

Where the legal basis is legitimate interest (art. 6.1.f GDPR), the data subject may object at any time by writing to support@kelbado.eu; the corresponding balancing assessment is documented internally and available on request.

We do not process card payment data. Payments are processed by the Merchant of Record (see Terms, clause 5.1), which acts as an independent controller for payment data.

4. Automated decisions and profiling

We make no automated decisions producing legal or similarly significant effects on individuals. Grades, certificates and any AI-assisted assessment are reviewed and validated by a human (instructor or training manager) before taking effect. See the AI Transparency Notice.

5. Retention periods

• Account data: while the account is active and thirty (30) days after closure, unless legally required otherwise.
• Content and courses: while the account exists; after closure, thirty (30) days for export and then deletion or anonymisation.
• Billing and accounting: six (6) years (art. 30 of the Spanish Commercial Code) and four (4) years for tax purposes.
• Audit and security logs: up to twenty-four (24) months.
• Technical security reports (CSP): up to twenty-four (24) months.
• Support requests and feedback: up to twenty-four (24) months after closure.
• Assistant memory and tutor conversations: while the account exists; deleted with it.
• Backups: overwritten within a maximum thirty (30) day cycle.
• Public-site analytics and advertising: Google Analytics 4 with data retention set to fourteen (14) months; Hotjar session recordings, three hundred and sixty-five (365) days.
• Learner data processed on a customer's behalf: as instructed by the customer, under the DPA.

6. Recipients and processors

We share data only with providers supplying hosting, email, artificial intelligence, speech synthesis, monitoring, payment and, on the public site, analytics and advertising services. The full list, with country and transfer mechanism, is published and kept current at Sub-processors.

If you consent in the public site's cookie banner, analytics and advertising data is shared with Google Ireland Ltd (Google Analytics 4 and Google Ads; Google may also process it at Google LLC, United States, under the Data Privacy Framework) and with Hotjar Ltd (Malta, European Union).

We may also disclose data to competent authorities where legally required.

7. International transfers

Primary servers are in the European Union. Some providers are established in the United States; those transfers rely on the Data Privacy Framework where the provider is certified, or otherwise on the European Commission's standard contractual clauses together with supplementary measures. Google LLC (United States), which may receive the public site's analytics and advertising data when you consent, is certified under the Data Privacy Framework. Per-provider details are in Sub-processors.

8. Artificial intelligence and model training

Content you send to the platform is transmitted to model providers solely to produce the output you request. We do not authorise the use of your data to train third-party models and we use zero- or minimal-retention settings where the provider offers them. Should any processing ever require additional consent, it will be requested explicitly.

No customer content and no learner data is ever used for advertising. The analytics and advertising described in section 3 measure only visits to the public site (home, pricing, blog and legal pages); they never load inside the application or the learner portal.

9. Security

We apply appropriate technical and organisational measures: encryption in transit (TLS), passwords stored with a key-derivation function, role-based access control, isolation between organisations, available two-factor authentication, an audit log, encrypted backups and regular dependency review.

In the event of a personal data breach posing a risk to individuals' rights, we will notify the Spanish Data Protection Agency within 72 hours and the affected individuals where the risk is high. Where we act as processor, we will inform the customer without undue delay.

10. Your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection at any time, and withdraw any consent given, by writing to support@kelbado.eu or from Profile → Privacy in the application, where account export and deletion are available.

We may ask for documentation proving your identity. We will respond within one month, extendable by two further months for complex requests.

If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).

11. Minors

The service is intended for people over 18. We do not knowingly process data of children under fourteen (14). Where a customer enrols minors, it is responsible for holding the legal basis and the consent of their legal guardians under article 7 of the LOPDGDD.

12. Cookies

The use of cookies and similar technologies is described in the Cookie Policy.

13. Changes to this policy

Any change will be published on this page with a new version number and effective date. Material changes will be notified by email thirty (30) days in advance.