Data protection information (GDPR)

KIRALIA, S.L. complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR), and with Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (LOPDGDD). On this page we inform you clearly and transparently about how we process your personal data and the rights you have. This information complements our Privacy Policy, our Legal Notice and our Cookie Policy.

1. Who is the controller of your data?

Controller: KIRALIA, S.L.
Tax ID (NIF): B-64042658
Address: Sardenya, 261, Office 8 · 08013 Barcelona, Spain
Telephone: +34 93 415 35 30
E-mail: tic@kiralia.es
Registry details: registered with the Barcelona Commercial Registry, Volume 38270, Folio 180, Sheet B 319777, 1st entry.

KIRALIA, S.L. is not legally required to appoint a Data Protection Officer (DPO). Nevertheless, it has appointed an Information Security Officer, who can be contacted at tic@kiralia.es for any matter relating to the processing of your data.

2. For what purposes do we process your personal data?

We process the personal data you provide through the website, by e-mail, by telephone or in the course of our business relationship for the following purposes:

To handle enquiries, requests for information and quotation requests sent through our contact forms.
To manage the commercial, contractual and administrative relationship with customers and suppliers, including invoicing and the provision of the contracted services (technical support, maintenance, IT outsourcing, access control, management software and other services).
To manage technical support tickets and incidents and the related communications.
To send you informative and commercial communications about our products, services, news and events by any means, including electronic means, provided that you have authorised us to do so or a prior relationship exists that allows it.
To manage applications from people who send us their CV for recruitment processes.
To comply with the legal, tax, accounting and commercial obligations applicable to our activity.

3. What is the legal basis for processing your data?

The legal basis for each processing activity is as follows:

Performance of a contract or pre-contractual measures (art. 6(1)(b) GDPR): quotations, contracting, provision of services, invoicing and support.
Consent of the data subject (art. 6(1)(a) GDPR): sending of commercial communications, use of non-essential cookies and management of job applications. You may withdraw your consent at any time without affecting the lawfulness of prior processing.
Compliance with legal obligations (art. 6(1)(c) GDPR): retention of tax, accounting and commercial records, and responding to requests from the authorities.
Legitimate interest (art. 6(1)(f) GDPR): maintaining the relationship with customers and professional contacts, fraud prevention and ensuring the security of our systems and networks.

4. To whom will your data be disclosed?

Your data will not be disclosed to third parties, except where required by law or where necessary for the provision of the contracted service (for example, hardware and software manufacturers or distributors whose product you have purchased, banks for payment management, or Public Administrations).

To provide our services we rely on suppliers acting as data processors (web and e-mail hosting, management and invoicing software, support and communication tools, cloud backup services). All of them have signed the corresponding data processing agreement in accordance with Article 28 of the GDPR and provide sufficient guarantees of compliance.

Where a supplier is located outside the European Economic Area, international transfers are made only to countries with an adequacy decision of the European Commission or with the appropriate safeguards provided for in Chapter V of the GDPR (for example, standard contractual clauses or certification under the EU-US Data Privacy Framework).

5. How long will we keep your data?

Personal data will be kept for as long as the commercial or contractual relationship lasts and, once it has ended, for the periods required by law to address any potential liabilities (as a general rule, 6 years for commercial and accounting records under the Spanish Commercial Code, and 4 years for tax records under the Spanish General Tax Act).

Data from enquiries that do not lead to a contractual relationship will be kept for a maximum of 12 months. Data processed on the basis of your consent will be kept until you withdraw it. CVs will be kept for a maximum of 12 months from receipt.

6. What are your rights?

As a data subject, you have the right to:

Access: obtain confirmation as to whether we are processing your data and access it.
Rectification: request the correction of inaccurate or incomplete data.
Erasure: request the deletion of your data when it is no longer necessary for the purposes for which it was collected.
Objection: object to the processing of your data on grounds relating to your particular situation, and in any case to processing for direct marketing purposes.
Restriction of processing: request that processing be suspended in the cases provided for by law.
Portability: receive your data in a structured, commonly used and machine-readable format and transmit it to another controller.
Not to be subject to automated individual decision-making, including profiling, which produces legal effects or significantly affects you.
Withdraw consent given at any time.

7. How can you exercise your rights?

You can exercise your rights by sending a written request, stating the right you wish to exercise and enclosing a copy of your ID card or equivalent document proving your identity, to:

E-mail: tic@kiralia.es
Post: KIRALIA, S.L., Sardenya, 261, Office 8, 08013 Barcelona, Spain

We will respond to your request within one month of receipt, which may be extended by a further two months for particularly complex requests, in which case we will inform you. Exercising these rights is free of charge.

8. Where can you lodge a complaint?

If you consider that the processing of your data does not comply with current legislation, or that we have not properly handled the exercise of your rights, you may lodge a complaint with the competent supervisory authority: the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain, www.aepd.es. We would appreciate it if you contacted us first so that we can try to resolve the matter.

9. What security measures do we apply?

KIRALIA, S.L. has adopted the technical and organisational measures necessary to guarantee the security and integrity of the personal data it processes, in accordance with Article 32 of the GDPR, and to prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data and the risks to which it is exposed. Among other measures, we apply access controls, encryption of communications, regular backups, records of processing activities and training for staff with access to personal data.

10. Third-party data and minors

If you provide us with data of third parties (for example, other employees of your company), you guarantee that you have previously informed them of the content of this information and that you have their authorisation to share their data with us.

Our services are aimed at companies and professionals. We do not knowingly collect data from children under 14 years of age. If you become aware that a minor has provided us with personal data, please notify us at tic@kiralia.es so that we can delete it.

11. Accuracy of the data and updates to this information

The user guarantees that the data provided is true, accurate and up to date, and undertakes to notify us of any changes.

KIRALIA, S.L. may amend this information to adapt it to legislative developments or changes in its processing activities. We recommend that you review it periodically. Last updated: October 2026.