Privacy policy

The controller of your personal data is Kirvat (“Kirvat”, “we”, “us”).

You can contact us about anything related to your personal data at [privacy@kirvat.com].

This policy explains how we process personal data when you visit our website, contact us, book a call, apply for Kirvat Select, subscribe to our newsletter, become a client or supplier, or apply to work with us.

It does not cover the personal data of our clients’ customers that we handle while delivering our services. In that case, our client is the controller and we act as a processor, following their instructions under a Data Processing Agreement. If you are a customer of one of our clients, please read that company’s privacy policy.

Contact and booking data: your name, company, job title, email, phone number and any information you share in your message or during a call.

Client and supplier data: the contact details of the people we deal with at our clients and suppliers, billing details and the communications we exchange.

Newsletter data: your email address and, if you give them, your name and company.

Candidate data: the information in your CV and application, such as your name, contact details, languages, experience and anything you choose to tell us, plus our notes from interviews.

Browsing data: technical information such as your IP address, browser and device, and how you use our website, collected through cookies as explained in our Cookie Policy.

We do not ask for special categories of data, such as health data. Please do not include them in your messages or applications.

To answer your enquiries, hold the calls you book and assess Kirvat Select applications. Legal basis: taking steps at your request before entering into a contract, and our legitimate interest in replying to businesses that contact us.

To provide our services and manage our relationship with clients and suppliers, including invoicing and collecting payments. Legal basis: performance of the contract with the company you work for, and our legitimate interest in managing that relationship with its staff.

To meet our legal obligations, such as tax, accounting and anti fraud requirements. Legal basis: legal obligation.

To send you our newsletter. Legal basis: your consent, which you can withdraw at any time.

To send commercial information about our services to our clients, when it is similar to what they already contracted. Legal basis: our legitimate interest, as allowed by article 21 of Spanish Law 34/2002. You can object at any time.

To manage job applications and recruit people for our teams. Legal basis: taking steps at your request before entering into a contract. If we keep your application for future positions, we will ask for your consent.

To keep our website secure and improve it. Legal basis: our legitimate interest, and your consent for non essential cookies.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Enquiries and calls that do not lead to a contract: up to [12] months after our last contact.

Client and supplier data: for as long as the relationship lasts, and afterwards for the periods required by law, for example six years for accounting records under the Spanish Commercial Code and the periods set by tax law.

Newsletter: until you unsubscribe or withdraw your consent.

Candidates: until the recruitment process ends, or up to [12] months if you consent to us keeping your application for future positions.

After these periods, we delete your data or keep it blocked only for as long as it may be needed to handle legal claims.

We do not sell your personal data.

We share it only with service providers that help us run our business, acting as processors under contract, such as our website hosting provider [Hostinger], email and productivity tools, our CRM (HubSpot) and booking tools, our newsletter platform (MailerLite) and payment providers [such as Stripe].

We may also share it with public authorities, courts, tax advisers or lawyers when required by law or needed to defend our rights.

Some of our service providers may process data outside the European Economic Area. When they do, we make sure the transfer is protected by an adequacy decision of the European Commission, such as the EU US Data Privacy Framework for certified companies, or by the European Commission’s standard contractual clauses.

You have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw your consent at any time, without affecting processing carried out before.

To exercise your rights, write to [privacy@kirvat.com], telling us which right you want to exercise. We may ask for information to confirm your identity. We will reply within one month.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the data protection authority where you live or work.

Every commercial email we send includes a simple way to unsubscribe. You can also unsubscribe at any time by writing to [privacy@kirvat.com].

We apply appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, and we only give access to the people who need it to do their job.

Our services are aimed at businesses. We do not knowingly collect personal data from anyone under 18.

We use cookies and similar technologies on our website. You can find out which ones we use and how to manage them in our Cookie Policy.

We may update this policy from time to time. We will publish the new version on this page with its update date and, if the changes are important, we will let you know by email or through our website.