Privacy Policy

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR), and the provisions of the Organic Law 3/2018, of 5 December, of Personal Data Protection and Guarantee of Digital Rights, as well as any other applicable data protection regulations, we provide you with further information on the processing of your personal data in this privacy policy (hereinafter the “Privacy Policy”).

1. Who is responsible for processing your personal data?

• Identity: KRAKEND, S.L.U. (hereinafter KrakenD or the “Company”)
• Address: Plaça Universitat 3, 6º, 08007 Barcelona, España
• E-mail: [email protected]
• Contact details of the Data Protection Officer: [email protected]

2. For what purpose do we process your personal data?

At KrakenD we process the information provided by interested parties for the following purposes:

I. To manage the registration of users and to control the development and fulfilment of the contractual relationship with them and, in this respect, to provide the service of on-line sale of the products offered through the website https://www.krakend.io. In particular, KrakenD will process the following categories of data and for the purposes specified below:

II. to manage complaints, as well as to respond to queries that may be submitted by users in relation to the website or services;

III. to send commercial communications, including by electronic means, about our products and services that we think may interest you;

IV. to manage your participation in competitions and promotional activities carried out by KrakenD;

V. to process information that we have obtained through cookies, as described in more detail in the Cookie Policy. Such processing is fully subject to what is established in the aforementioned policy;

VI. To comply with the legal obligations applicable to KrakenD, such as those derived from tax regulations and the prevention of money laundering.

VII. To track and analyze user behavior and interaction with our sales contact form to enhance user experience and improve our services. This data is shared with third-party analytics services, specifically Google Analytics.

VIII. To enable personalized marketing and communications through our online data partners. When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors (including RB2B) to associate these activities with other personal information they or others have about you, including by association with your email address. This allows us or service providers on our behalf to send targeted communications and marketing to your email address.

3. What is the legitimacy of the processing of your data?

The legal basis for the processing indicated in sections (I) and (II) is the execution of the Conditions of Use and of the Contract.

With regard to sections (III), (IV) and (V), the legal basis is the consent given by the user, which he may revoke at any time without affecting the provision of the service. You may withdraw your consent at any time by contacting the following e-mail address: [email protected].

With regard to section (VII), the legal basis is the legitimate interest of KrakenD to understand user interactions with our services and enhance user experience. This analysis is carried out in a way that respects your privacy rights and interests.

With regard to section (VIII), the legal basis is the legitimate interest of KrakenD to provide personalized marketing communications that are relevant to your business needs and interests. This processing is carried out in collaboration with trusted data partners and respects your privacy rights and interests.

Notwithstanding the electronic and non-electronic commercial communications sent when we have your consent as cited above, we may also send you communications when you are our customer. In this case, we will only send you information that is linked to us and that is related to products and/or services of ours that are identical or similar to those you have contracted. In these cases, we have a legitimate interest in processing your contact details and keeping you informed about any of our products and services, and this interest takes precedence over your rights in view of the non-sensitive nature of the data in question and the fact that the contractual relationship created with our customers results in the reasonable expectation of receiving this type of communication.

Finally, the legal basis for the treatment indicated in section (VI) is compliance with the regulations applicable to the Company (as is the case with Law 58/2003, of 17 December, on General Taxation; and Law 35/2006, of 28 November, on Personal Income Tax and partially amending the laws on Corporation Tax, Non-Resident Income Tax and Wealth Tax, and their respective implementing regulations, and other regulations that may be applicable).

4. How long will we keep your data?

The personal data provided will be kept for as long as you are a customer or registered user of our website. The personal data will be kept after the termination of the contractual relationship, duly blocked, for the periods established by law to meet the responsibilities that may arise from it. In particular, the personal data necessary to send you electronic commercial communications will be processed until you revoke the consent you have given and, once this has been withdrawn, for the time strictly necessary to respond to any liabilities that may have arisen. In any case, when the personal data is not necessary for the purpose for which it was collected and until it is definitively deleted, it will be kept blocked.

5. To which recipients will your data be communicated?

No data will be communicated to third parties unless legally obliged to do so or when strictly necessary to defend the rights and legitimate interests of KrakenD. Without prejudice to the above, personal data will be accessible to those third parties to whom KrakenD has entrusted a service in their capacity as data processors (e.g. technical and IT support providers), both with regard to the operation of the business and the administration of the Company. The Company shall enter into written agreements with the third parties participating in the provision of the services, which shall include the safeguards and guarantees required by the GDPR.

In addition to those detailed above, we share data with third-party analytics service providers, specifically Google Analytics, for the purpose of understanding and improving user interaction with our sales contact form. We also share data with online data partners, including RB2B, for the purpose of enabling personalized marketing and communications as described in section 2(VIII). We ensure that these third-party services are compliant with data protection regulations and they are not permitted to use your data for their own purposes.

KrakenD uses some cookies and technologies from third parties whose servers are, in certain cases, located outside the European Economic Area, your data may be transferred to those servers located in third countries (in particular, the United States). In any case, please note that KrakenD enters into agreements with such suppliers to ensure a level of data protection equivalent to that provided by European regulations. In particular, where necessary, standard contractual clauses approved by the European Commission will be signed and, for international transfers to the United States, it will be ensured that contracted providers are registered with the EU-US Privacy Shield agreement.

6. What are your rights when you provide us with your data?

Everyone has the right to obtain information about whether or not KrakenD is processing personal data concerning them.

Data subjects have the right to access their personal data, as well as the right to request the rectification of inaccurate data (and to complete those that are insufficient), to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected and to request its portability.

In certain circumstances, data subjects may request that their data be limited in their processing, in which case we will only keep them for the exercise or defence of claims.

In certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their data. In this case, KrakenD will stop processing the data, except for compelling legitimate reasons, or the exercise or defence of possible claims.

You may exercise your rights by sending an e-mail to [email protected], duly identifying yourself and indicating the specific right you wish to exercise.

Additionally, regarding the personalized marketing and communications mentioned in section 2(VIII), you have specific opt-out options:

• You may opt out of receiving targeted advertising by visiting https://app.retention.com/optout
• You also have the option to opt out of the collection of your personal data in compliance with GDPR by visiting https://www.rb2b.com/rb2b-gdpr-opt-out

If you have given your consent for any specific purpose, you are entitled to withdraw the consent given at any time, without this affecting the lawfulness of the processing based on the consent given prior to its withdrawal.

In the event that you feel your rights have been infringed with regard to the protection of your personal data, especially when you have not obtained satisfaction in the exercise of your rights vis-à-vis the Company, you may file a complaint with the competent Data Protection supervisory authority

7. More information about the processing of your data

The processing of the data collected through the data collection forms on the website or other means will be incorporated into the Processing Activities Register for which KrakenD is responsible.

KrakenD treats the data confidentially and adopts the appropriate technical and organisational measures to guarantee the appropriate level of security for the processing, in compliance with the requirements of the GDPR, Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights and other applicable regulations on data protection.

Nevertheless, it cannot guarantee the absolute invulnerability of the systems, therefore, and to the maximum extent permitted by the applicable legislation, it does not assume any responsibility for damages derived from alterations that third parties may cause in the computer systems, electronic documents or files of the user. If you choose to leave our web site through links to web sites that do not belong to our entity, KrakenD shall not be responsible for the privacy policies of those web sites or for the cookies that they may store in the user’s computer.

Google Analytics: Our website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States.

8. Whistleblower & Ethical Reporting Policy

The Company is committed to maintaining the highest standards of integrity, ethical conduct, and legal compliance. This policy provides a secure and confidential channel for all personnel to report suspected misconduct without fear of retaliation. This commitment is a cornerstone of our control environment and aligns with our dedication to the principles of security, confidentiality, and privacy.

Scope

This policy applies to all employees, contractors, and other stakeholders of the Company. Reportable concerns include, but are not limited to:

• Violations of company policies, including the Information Security Policy and Acceptable Use Policy.
• Suspected data breaches or security incidents.
• Unethical or unlawful conduct, including fraud or corruption.
• Violations of privacy principles or mishandling of confidential information.
• Actions that pose a threat to the availability, integrity, or security of company systems.

Reporting Procedure

All concerns should be reported promptly. To facilitate reporting, the company has established a confidential reporting channel:

Confidential Reporting Form: Whistleblower Form

Individuals may choose to submit their reports anonymously. However, providing contact information may assist in the investigation. All submissions will be directed securely and exclusively to the designated investigation team, which consists of the Head of Compliance and the General Counsel. In the event a report involves a member of the investigation team, the report should be made directly to the CEO or, alternatively, to the Chair of the Board’s Audit Committee (or equivalent committee) at [email protected]

Confidentiality & Non-Retaliation

Confidentiality: All reports will be handled with the utmost discretion. The identity of the reporting individual will be kept confidential to the extent possible, consistent with the need to conduct a thorough and fair investigation. Non-Retaliation: Whale strictly prohibits any form of retaliation, harassment, or adverse employment action against any individual who, in good faith, reports a concern or participates in an investigation. Any person found to have engaged in retaliation will be subject to disciplinary action, up to and including termination.

Investigation Process

Upon receipt of a report, the designated investigation team will conduct a prompt and impartial review. The team will document its findings and recommend appropriate corrective actions to senior management and, where applicable, the board of directors. The objective of every investigation is to address the reported issue, remediate control deficiencies, and prevent recurrence.