Kybernes Group · Legal
Privacy policy
Last updated: 15 October 2026
This is an English translation for convenience. The Spanish version is the governing text.
This policy explains what personal data we process when you use our websites, why, on what legal basis, for how long, who we share it with and what rights you have.
1. Controller
Company Group Kybernes, S.L.U. (Tax ID B26766253), Plaza Josep Rovira 13, 4.º 2.ª, 08018 Barcelona, Spain. Email for any data protection matter: legal@kybernesgroup.com.
We have not appointed a data protection officer because we are not required to.
The five websites (kybernesgroup.com and the realestate., tech., hotels. and pulse. subdomains) belong to the same company. When you contact one of our units, the controller is still Company Group Kybernes, S.L.U.
2. What data we process and where it comes from
Data you give us (contact and quote request forms, meeting bookings, email, subscriptions, applications), data generated while browsing (IP address, cookie identifiers, pages visited, whether you accept analytics) and, for business contacts, the public contact details on your LinkedIn profile or company website.
We do not process special categories of data (health, psychological data, beliefs, etc.) or data of children under 14 through the websites. Please do not include them in free-text fields. If you take part in a selection process run with Kybernes Pulse, your tests are governed by the information sheet you receive in the process, and the controller is the convening body (town hall or company), not Kybernes.
3. Purposes, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| 1. Contact and quote request forms: answering your enquiry, telling you who to talk to and, if you ask, preparing and following up a personalised quote | Name, email, phone (optional), company, business type, size, urgency, message, unit and the information you give us for the quote | Pre-contractual steps at your request (Art. 6.1.b GDPR) and, if you write on behalf of a company, legitimate interest (Art. 6.1.f GDPR and Art. 19 LOPDGDD) | While we handle the enquiry or the quote is valid, and up to 12 months after the last contact if no contract follows |
| 2. Meeting bookings via cal.com | Name, email, phone (optional), date and time, notes, time zone | Pre-contractual steps (Art. 6.1.b) | As purpose 1 |
| 3. Newsletter by unit | Email, name (optional), unit, subscription date and source, opens and clicks if recorded | Consent (Art. 6.1.a GDPR and Art. 21 LSSI), which you can withdraw at any time | Until you unsubscribe; then your email is kept on a suppression list |
| 4. Communications to clients about similar services | Business email, services contracted | Legitimate interest and Art. 21.2 LSSI, with opt-out in every message | While you are a client and until you object |
| 5. Job or collaboration applications | Name, contact, CV, letter, LinkedIn profile, qualifications and registration where relevant, availability, proposed fees | Pre-contractual steps (Art. 6.1.b) and, to keep it for future openings, your consent (Art. 6.1.a) | During the process and 12 months; with consent, up to 24 months |
| 6. Contractual relationship | Identification, contact, invoicing, payment and service delivery data | Performance of the contract (Art. 6.1.b); tax and accounting obligations (Art. 6.1.c) | During the relationship and, blocked, the limitation periods (5 years by default; tax and accounting, 4 and 6 years) |
| 7. Business prospecting | Name, role, company, business email, public LinkedIn profile, sector | Legitimate interest (Art. 6.1.f GDPR and Art. 19 LOPDGDD), with opt-out in every message. First contact is by LinkedIn or phone; we only email if you replied, were introduced or are a client (Art. 21 LSSI) | Until you object or 24 months without reply |
| 8. LinkedIn | Public interactions | Legitimate interest; LinkedIn Ireland Unlimited Company is joint controller for page statistics | Per LinkedIn's terms |
| 9. Web analytics | Pages viewed, device, referrer and country, aggregated and without cookies | Consent (Art. 22.2 LSSI and Art. 6.1.a GDPR) through the banner | See the cookie policy |
| 10. Security and server logs | IP, date and time, page requested, user agent | Legitimate interest in website security (Art. 6.1.f) | 30 days in the hosting provider's logs |
| 11. Handling rights and complaints | Identification and request | Legal obligation (Art. 6.1.c) | Limitation periods for infringements (up to 3 years) |
4. Automated decisions
We take no automated decisions with legal effects through the websites. We sort enquiries by unit and urgency to reply sooner, but a person always answers.
5. Children
The websites are aimed at professionals and companies. We do not knowingly process data of children under 14; if we find any, we delete it.
6. Recipients and processors
We do not sell or transfer your data. We share it only with public authorities when the law requires it, and with providers that process it on our behalf under a processing agreement (Art. 28 GDPR): Google Ireland Limited (Google Workspace: email, calendar, documents and e-signature), Vercel, Inc. (hosting and, only with your consent, web analytics), Formspree, Inc. (receipt and forwarding of the kybernesgroup.com forms), Resend, Inc. (confirmation emails), Cal.com, Inc. (meeting bookings), Supabase, Inc. (database of our internal management tool, EU), Microsoft Ireland Operations Ltd. (Teams and data platform in Hotels and Tech projects) and our accounting adviser and bank. Today this site uses no newsletter tool.
7. International transfers
Some providers are US companies or may access data from outside the European Economic Area for support. Such transfers rely on the EU-US Data Privacy Framework (for certified providers) or on the European Commission's standard contractual clauses (Decision 2021/914). You can ask us for a copy of the safeguards at legal@kybernesgroup.com.
8. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent at any time, by writing to legal@kybernesgroup.com or to Plaza Josep Rovira 13, 4.º 2.ª, 08018 Barcelona. We reply within one month (extendable by two more in complex cases, with notice). You may complain to the Spanish Data Protection Agency (www.aepd.es); we would appreciate hearing from you first.
9. Security
We apply technical and organisational measures appropriate to the risk: named accounts with two-factor authentication, encryption in transit and at rest, access control, backups and confidentiality commitments. If you notice any problem, write to legal@kybernesgroup.com.
10. Changes
We may update this policy. We will publish the new version with its date and, if the change is relevant and we have your email, let you know.