PRIVACY AND PERSONAL DATA PROTECTION POLICY
1. GENERAL PROVISIONS
This Privacy Policy regulates the processing of personal data of users of the kraftds.com website (hereinafter, the "Website"). The data controller is CUBO D'ORO BY KRAFT HOLDING S.L., with NIF B93891125, registered office at Passeig Gafarró, 29, 08197 Sant Cugat del Vallès (Barcelona), Spain.
Contact email: lawyer@kraftds.es
By using the Website, the user confirms that they have read this Policy. Our services are not directed to minors under 14 years of age. The Controller does not intentionally collect personal data from minors. If we discover that we have collected data from a minor under 14 without the consent of their parents or legal guardians, we will proceed to delete it immediately.
2. DEFINITIONS
Personal data: any information relating to an identified or identifiable natural person.
Data subject: a natural person, user of the Website, to whom the personal data refers.
Processing: any operation performed on personal data: collection, recording, organization, storage, adaptation, retrieval, use, disclosure, anonymization, restriction, erasure, or destruction.
Data Controller: the entity that determines the purposes and means of the processing.
GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
3. SCOPE OF APPLICATION
This Policy applies in the following cases:
- Use of the Website without registration — viewing pages, downloading catalogs, installation guidelines, certificates, and declarations of performance.
- Submission of contact forms — requesting a suspended ceiling quote, requesting a commercial offer, consulting a sales representative.
- Registration in the area for designers and architects — access to 3D models, IES photometric files, and other technical documentation.
- Registration and use of the Onliner 2.0 platform — calculation of suspended ceiling specifications for distributors and partners.
- Subscription to the newsletter and technical updates.
4. LEGAL BASES FOR PROCESSING
The Controller processes personal data on the following bases:
- Art. 6.1.a) GDPR (consent of the data subject): newsletter, analytical and marketing cookies, registration in the designers' area and on the platform;
- Art. 6.1.b) GDPR (performance of a contract): management of quote requests and commercial inquiries;
- Art. 6.1.c) GDPR (compliance with a legal obligation): applicable to the Controller for tax and accounting purposes;
- Art. 6.1.f) GDPR (legitimate interest of the Controller): security of the Website, protection of technical materials against unauthorized distribution, establishment or defense of legal claims.
5. PURPOSES OF PROCESSING AND PROCESSED DATA
Management of user inquiries
Name, phone number, email address, company name, area, and type of premises — to prepare the specification calculation, a commercial offer, or to respond to a technical inquiry.
Area for designers and architects
First and last name, email address, phone number, company or studio name, type of professional activity, city, link to portfolio — to create the account, verify the email address, and provide access to technical materials. The Controller records the downloads of files from the area — date, time, file name, user account — based on the legitimate interest of protecting materials against unauthorized distribution.
Onliner 2.0 Platform
Partner or distributor account data, history of calculations, and specifications — for the operation of the platform and user support. The processing of data on this platform is additionally subject to its own Terms and Conditions of Use, the acceptance of which is necessary for the provision of the service.
Newsletter
Email address — for sending news, technical updates, and commercial offers only upon specific consent.
Website Analytics
Anonymized data regarding user behavior — to improve the structure and content of the Website. This data is not used to identify the user.
6. DATA RETENTION PERIODS
In accordance with Spanish regulations, data will be kept for the time necessary to fulfill the purpose and, subsequently, will be kept duly blocked:
- Inquiries and quote requests: data will be kept until the inquiry is resolved and, subsequently, blocked for a maximum of 5 years for the formulation, exercise, or defense of legal claims (Art. 1964 of the Civil Code).
- Designer accounts and Onliner 2.0 platform: as long as the user maintains their account active. After requesting unsubscription, data will be kept blocked for 6 years due to commercial legal obligations (Art. 30 of the Commercial Code). Data with tax relevance will be blocked for 4 years (General Tax Law).
- Newsletter: until the user revokes their consent or objects to the processing.
- Analytical and marketing cookies: the information obtained will be kept for a maximum period of 24 months, or until the user deletes the cookies from their browser.
7. RECIPIENTS AND INTERNATIONAL TRANSFERS
The Controller does not sell or transfer personal data to third parties, except in the following cases:
- Distributors and commercial partners: when the user has submitted a purchase request, their contact details may be communicated to the partner closest to the project location, exclusively for the management of such request.
- Data processors: hosting providers, email delivery services, and web analytics tools, operating under a data processing agreement.
- Public authorities: in accordance with current regulations.
- International transfers: International data transfers to the United States resulting from the use of analytics and marketing tools (Google Analytics, Meta Pixel) are carried out in accordance with the EU-US Data Privacy Framework, based on an adequacy decision of the European Commission (Art. 45 GDPR), as these US entities are duly certified.
In the event that the user requests services or products in countries outside the European Economic Area that do not have an adequacy decision (for example, Ukraine), their contact details may be transferred to local distributors or partners. This transfer is carried out under Article 49.1.b) of the GDPR, as it is strictly necessary for the performance of a contract or the implementation of pre-contractual measures at the user's request.
8. RIGHTS OF THE DATA SUBJECT
According to the GDPR and the LOPDGDD, the user has the right to:
- access their personal data (Art. 15 GDPR);
- rectify inaccurate data (Art. 16 GDPR);
- erasure — «right to be forgotten» (Art. 17 GDPR);
- restriction of processing (Art. 18 GDPR);
- data portability (Art. 20 GDPR);
- object to the processing (Art. 21 GDPR), including objection to direct marketing;
- withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
- lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. Users residing in Ukraine also have the right to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua) or other competent local supervisory authority.
The Controller informs that no automated decisions are made, nor is profiling carried out that produces legal effects concerning the user or similarly significantly affects them. To exercise these rights, the user may write to the email address indicated in Section 1, specifying "Data Protection" in the subject line. The Controller will respond without undue delay and, in any case, within one month of receiving the request.
9. MANDATORY NATURE OF DATA
The provision of personal data is voluntary; however, fields marked with an asterisk (*) in the forms are necessary to provide the corresponding service. Refusal to provide such data may prevent the preparation of the quote, the creation of the account, or the management of the inquiry.
11. SECURITY MEASURES
The Controller applies organizational and technical measures to protect personal data against unauthorized access, disclosure, alteration, accidental loss, or destruction.
Access to personal data is restricted to employees who need it to perform their duties and who are subject to confidentiality obligations. Data transmission between the user's browser and the Website is carried out via an encrypted connection.
12. LINKS TO OTHER WEBSITES
The Website contains links to other resources, including national websites of the company, social networks, and third-party services. The Controller does not control the content of such resources and is not responsible for their privacy policies.
13. MODIFICATIONS TO THE POLICY
The Controller reserves the right to modify this Policy as a result of regulatory changes or changes in Website functionality. The updated version is published on this page with an indication of the effective date.