Privacy Policy

1. Introduction and scope

At Kimetai we help organisations govern their systems in accordance with European regulations, and we apply that same standard of rigour to the processing of the personal data of those who interact with us.

This Privacy Policy describes how KIMETAI LABS, S.L. (hereinafter, "Kimetai") collects, processes and protects the personal data of users of the website kimetai.com and its subdomains (hereinafter, the "Website"), in compliance with Regulation (EU) 2016/679, of 27 April 2016, the General Data Protection Regulation (hereinafter, "GDPR"), Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (hereinafter, "LOPDGDD"), and Spanish Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (hereinafter, "LSSI-CE").

This Policy applies to the personal data processed by Kimetai as data controller through the Website and the contact channels associated with it. The data processing that Kimetai carries out as data processor, in the context of providing the Kimetai platform to its customers, is governed by clause 6 and by the data processing agreements signed with each customer.

2. Data controller

• Identity: Kimetai Labs, S.L.
• Tax ID (N.I.F.): B93911741.
• Address: Calle Manuel Tovar, 42, 2ª Planta, 28034 Madrid (Spain).
• Contact email address: info@kimetai.com.

Kimetai is not required to appoint a Data Protection Officer under Article 37 of the GDPR and Article 34 of the LOPDGDD, in view of the nature, scope and purposes of the processing it carries out as controller. For any query regarding the processing of your personal data, you may contact us at the email address indicated above.

3. What personal data we process and how we obtain it

Kimetai only processes personal data that is adequate, relevant and limited to what is necessary for each purpose (data minimisation principle). Depending on the channel through which you interact with us, the data processed is as follows:

• Demo and early access requests: first name and surname, corporate email address, telephone number (optional), job title, the organisation you belong to, the organisation's size and sector, country, and any information you choose to include in the message field about your organisation's needs (for example, the automation platforms you use).
• Contact by email or other available channels: the identification and contact details included in your communication and its content.
• Subscription to commercial communications or content (newsletter, blog, materials): corporate email address and, where applicable, name, job title and organisation.
• Job applications: identification and contact details, curriculum vitae and any other information you choose to provide in your application through the careers section of the Website or the channels indicated therein.
• Technical browsing data: IP address, technical identifiers of the device and browser, and access logs, processed for security purposes and for the proper functioning of the Website. Information on cookies and similar technologies is set out in the Cookie Policy.

As a general rule, we obtain your data directly from you. However, in the context of our B2B commercial activity we may also obtain your professional contact details from third-party sources: specialised business data providers with which Kimetai has a contractual relationship and which guarantee the lawful sourcing of the data, social networks and professional platforms (such as LinkedIn) to the extent your settings allow it, publicly accessible sources and business directories, Kimetai partners or collaborators, and events, trade fairs or webinars at which your data is lawfully collected and shared with Kimetai. Where we obtain your data from a source other than you, we will inform you of its origin and of the other particulars required by Article 14 of the GDPR in the first communication we send you and, at the latest, within one month of obtaining it.

The data marked as mandatory in each form is necessary to handle your request; failure to complete it will prevent us from processing the request.

4. Purposes and legal bases of the processing

We process your personal data for the following purposes, each supported by its corresponding legal basis under Article 6 of the GDPR:

a) Pre-contractual measures taken at the data subject's request (art. 6.1.b GDPR). Managing and responding to your requests for a demo, early access to the platform or information about our products and services; scheduling and holding demo sessions; assessing the request against the admission criteria of the early access programme; and, if the commercial relationship progresses, preparing and sending proposals tailored to your organisation's needs and formalising the corresponding contract.

b) Consent of the data subject (art. 6.1.a GDPR). Sending you commercial communications, newsletters or content about Kimetai's products and services and about developments in the field of automation governance, where you have subscribed or expressly consented; such communications may be personalised on the basis of the commercial profile described in clause 10. Likewise, managing your application in our recruitment processes. You may withdraw your consent at any time, without affecting the lawfulness of prior processing, through the unsubscribe link included in each communication or by writing to info@kimetai.com.

Recording and transcription of video calls (art. 6.1.a GDPR). When you take part in a video call with Kimetai (for example, a platform demo), we may record and transcribe it using tools that incorporate artificial intelligence features. You will be informed at the start of whether the session is going to be recorded and we will request your consent before starting the recording; you may object or ask for it to be stopped at any time during the session, without this affecting the holding of the meeting. The purposes are: (i) verifying and improving the quality of our service and of our commercial processes; (ii) internal training of our team; (iii) documenting key interactions and agreements for the follow-up of the relationship; and (iv) analysis of transcripts and basic metadata (such as meeting duration) for commercial improvement analytics. This analysis is performed on the transcribed text and technical data; under no circumstances does it analyse tone or emotions or process biometric data, its outputs refer to the meeting and not to the participants individually, and it incorporates human oversight before any conclusion or action.

c) Kimetai's legitimate interest (art. 6.1.f GDPR). (i) Processing the professional contact details of individuals acting on behalf of a legal entity, for the sole purpose of maintaining relations of any kind with the organisation in which they provide services, in accordance with the presumption established in Article 19 of the LOPDGDD; (ii) sending commercial communications about our own products or services similar to those already contracted, in accordance with Article 21.2 of the LSSI-CE, with the option to object in each communication; (iii) ensuring the security, integrity and availability of the Website and of our systems through the analysis of technical browsing data and access logs, and the detection, prevention of and response to security incidents; (iv) handling and managing communications received through the available channels; (v) building a basic commercial profile of you and your organisation, and applying scoring by means of predictive models, as described in clause 10; and (vi) carrying out advertising activities through custom or lookalike audiences on social networks and third-party platforms, as described in clause 10. You may object to processing based on legitimate interest at any time, without this worsening or conditioning your commercial relationship with Kimetai, and you may request information about the legitimate interest assessments carried out by writing to info@kimetai.com.

d) Compliance with legal obligations (art. 6.1.c GDPR). Responding to requests from competent authorities, complying with applicable tax, commercial and data protection obligations, and handling the exercise of data subjects' rights.

5. Professional nature of the Website and minors

The Website and Kimetai's services are directed exclusively at companies, professionals and entities, as stated in the Legal Notice. The data we process in the commercial context is therefore the professional contact data of individuals acting on behalf of their organisations.

Our services are not directed at minors. We do not authorise persons under 18 years of age to provide personal data through the Website. If we detect that data of a minor has been collected, we will delete it immediately.

6. Kimetai as data processor: the platform

Kimetai's main service consists of providing an automation governance platform (AI agents and deterministic workflows) that our customers use in the course of their business activity. In that context, any personal data that may be contained in the systems, inventories, policy decisions and audit records managed through the platform is processed by Kimetai as data processor, on behalf of the customer (data controller), in accordance with the customer's documented instructions and the data processing agreement signed pursuant to Article 28 of the GDPR.

Accordingly, if your personal data appears in the systems of a Kimetai customer organisation, any request for information or exercise of rights regarding that data must be addressed to the controller organisation. The platform infrastructure is hosted in the European Union, and the list of authorised sub-processors, together with the applicable safeguards, is provided to customers within the framework of the data processing agreement.

7. Recipients of the data

Kimetai does not sell or disclose your personal data to third parties for their own purposes. We only communicate data in the following cases:

• Data processors: service providers that process data on behalf of Kimetai, under data processing agreements signed in accordance with Article 28 of the GDPR and selected for offering sufficient guarantees. The categories include: form management and customer relationship management (Zoho CRM, hosted in European Union data centres), web hosting and deployment (Vercel), database infrastructure (Supabase, hosted in the Frankfurt region, EU), content delivery network and DNS (Cloudflare), corporate email and domain registration (IONOS), and productivity and analytics tools.
• Social networks and advertising platforms: for the custom audience activities described in clause 10, we may communicate certain professional contact details (such as the corporate email address) to social networks or advertising platforms (for example, LinkedIn or Meta). Before being shared, the data is encrypted (hashed) using the tools provided by those platforms, so that they can only verify a match against their own users; Kimetai does not access your user data on those platforms at any time.
• Authorities: law enforcement bodies, public administrations, courts and tribunals and other competent authorities, where a legal obligation exists.
• Corporate transactions: in the event of corporate transactions (merger, acquisition, restructuring), data may be communicated to the parties involved with appropriate confidentiality and data protection guarantees.

8. International data transfers

As a general rule, Kimetai hosts and processes data within the European Union, and requires the same of its platform infrastructure ("EU-hosted").

However, some of our service providers are entities established in third countries or belonging to corporate groups from third countries, so certain processing operations — including remote access to data for support or technical administration purposes — may involve an international data transfer. In such cases, transfers are covered: (i) by an adequacy decision of the European Commission under Article 45 of the GDPR — in particular, the EU-U.S. Data Privacy Framework in respect of certified U.S. entities, as is the case for certain infrastructure providers —; or (ii) by the standard contractual clauses approved by the European Commission under Article 46.2.c of the GDPR, together with any necessary supplementary measures, in respect of providers established in third countries without an adequacy decision (such as services whose corporate group operates from India, even where the data is hosted in European Union data centres). You may request further information about the safeguards applied by writing to info@kimetai.com.

9. Retention periods

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, in accordance with the following criteria:

• Demo, early access and contact requests: while the request is being handled and, where no contractual relationship is formalised, for a maximum of three (3) years from the last interaction, for the follow-up of the commercial relationship.
• Commercial communications: until you withdraw your consent or object to the processing.
• Job applications: for the duration of the corresponding recruitment process and, unless you request their deletion, for a maximum of two (2) years from receipt for future processes.
• Recordings and transcriptions of video calls: for a maximum of twelve (12) months from the date of the call, except for recordings or transcriptions directly related to a specific legal risk or an identified claim, which may be retained duly blocked, with restricted access and without use for other purposes, for the limitation periods of the corresponding actions, for the defence of Kimetai against claims.
• Technical data and access logs: for a maximum of twenty-four (24) months, unless they are needed for longer for the investigation of security incidents.

Once the above periods have elapsed, the data will be kept duly blocked, at the exclusive disposal of public administrations, courts and tribunals, to address any liabilities arising from the processing during their limitation periods, in accordance with Article 32 of the LOPDGDD. Once those periods have elapsed, the data will be permanently deleted.

10. Profiling, scoring and custom audiences

Basic commercial profile. As a relevant contact of your organisation, Kimetai may build a basic commercial profile of you, associated with your organisation, for exclusively commercial purposes and within the framework of our B2B relationship. This profile may be built from your job title, first name and surname, the organisation you belong to and its characteristics (size, sector, country), your interactions with our content and websites (provided you have consented to the use of cookies) and the features or automation platforms you have indicated as being of interest to you. The purpose is to offer you a personalised experience and send you information that is genuinely relevant to your organisation.

Scoring using predictive models. Kimetai may use algorithmic or statistical models to segment leads and customers according to a set of pre-established segments and to personalise its commercial strategy. These models are designed for specific tasks: they identify patterns in the data to estimate probabilities and provide predictions that help our team make better-informed decisions. They have no decision-making capacity of their own: decision-making always rests with people at Kimetai.

Custom and lookalike audiences. Kimetai may use the advertising services of social networks and third-party platforms known as custom audiences or matched audiences, as well as lookalike audiences, under the terms and with the encryption safeguards described in clause 7. In any event, the privacy settings you have established on those platforms will prevail, and their own privacy policies govern their processing as independent controllers.

Common safeguards. None of these activities is based on solely automated decisions producing legal effects on you or similarly significantly affecting you: there is human intervention in the determination of the criteria and in the decisions taken, and their only effect is the segmentation of our commercial communications. You have the right to object to any of these purposes at any time by writing to info@kimetai.com, without your objection worsening or conditioning your commercial relationship with Kimetai: if you object and we still have your consent to send you commercial communications, we will continue to do so in a more generic form. You may also request access to the essential elements of the legitimate interest assessments carried out. Should decisions based solely on automated processing with legal or similarly significant effects be adopted in the future, you would be duly informed of this, of the logic involved and of your rights to obtain human intervention, express your point of view and contest the decision, in accordance with Article 22 of the GDPR.

11. Your data protection rights

As a data subject, you may exercise the following rights at any time and free of charge:

• Right of access: obtain confirmation of whether we are processing your data and access it.
• Right to rectification: request the correction of inaccurate or incomplete data.
• Right to erasure: request the deletion of your data where, among other reasons, it is no longer necessary for the purposes for which it was collected.
• Right to restriction of processing: request the restriction of processing in the cases provided for in Article 18 of the GDPR.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object: object to the processing of your data based on Kimetai's legitimate interest, including the sending of commercial communications under Article 21.2 of the LSSI-CE.
• Right to withdraw consent: withdraw the consent given at any time, without retroactive effect.

You may exercise your rights by sending a written communication to info@kimetai.com, indicating the right you wish to exercise. In the event of reasonable doubt about your identity, we may ask you for additional information to verify it. We will respond to your request within a maximum of one month, which may be extended by a further two months in cases of particular complexity, in which case we will inform you of the extension.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), with address at C/ Jorge Juan, 6, 28001 Madrid, and electronic office at www.aepd.es, in particular if you consider that we have not properly handled the exercise of your rights.

12. Accuracy of the data provided

You are responsible for the truthfulness, accuracy and currency of the personal data you provide to us. Kimetai reserves the right not to process requests containing false, incomplete or inaccurate data, without prejudice to any other applicable legal actions.

13. Security measures

Kimetai applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. These include: encryption of communications using TLS, isolation of and access control to the systems hosting personal data in accordance with the principle of least privilege, activity logging, pseudonymisation where appropriate, and security incident management and response procedures, including the assessment of the obligation to notify the supervisory authority within the 72-hour period provided for in Article 33 of the GDPR.

We require these same guarantees from the data processors we work with, through the corresponding contracts and the verification of their security measures and certifications.

14. Changes to this Privacy Policy

Kimetai may amend this Privacy Policy to adapt it to legislative or case-law developments or to changes in its activity. The current version will be published on the Website at all times, indicating its date of last update. If the changes are substantial and affect processing based on your consent, we will inform you and, where appropriate, seek your consent again.