Privacy policy

1. Who is the controller

This is a translation. In case of discrepancy, the Spanish version prevails, as Spanish law applies.

• Controller: Cristina Allende Casal (kikiriki.works)
• Tax ID (NIF): 53778339S
• Address: C. de Piamonte 23, 28004 Madrid (España)
• Contact: hello@kikirikiworks.com

No data protection officer has been appointed: none of the cases in article 37 GDPR applies. For anything concerning your data, write to the address above.

2. What data we process and why

a) Mailing list sign-up (footer form)

• Data: your email address.
• Purpose: sending you our publications and news about kikiriki.works.
• Legal basis: your consent (art. 6(1)(a) GDPR), given by ticking the box and submitting the form.
• Retention: until you unsubscribe. Every email includes an unsubscribe link.

b) Enquiries through /contacto

• Data: whatever you fill in: name, email and, if you provide them, phone, company and the content of your message.
• Purpose: answering your enquiry and, where appropriate, preparing a proposal.
• Legal basis: pre-contractual measures taken at your request (art. 6(1)(b) GDPR).
• Retention: one year from the last communication. If the enquiry leads to a commercial relationship, billing-related data is kept for six years (art. 30 of the Spanish Commercial Code) plus any applicable tax periods.

c) Applications through /unete

• Data: name, email and, if you provide them, phone, LinkedIn profile, CV and the professional information it contains.
• Purpose: assessing your application to collaborate with kikiriki.works.
• Legal basis: pre-contractual measures taken at your request (art. 6(1)(b) GDPR).
• Retention: one year from the date you write to us; after that they are deleted. Ask us to delete them sooner and we will.

d) Commercial communications to people who write to us

• Data: name and email address.
• Purpose: adding you to our mailing list and sending you content and news, beyond answering your enquiry.
• Legal basis: your consent (art. 6(1)(a) GDPR), collected through a specific box that is not pre-ticked. It is optional: if you leave it unticked, we still answer your enquiry.
• Retention: until you withdraw consent.

e) Website analytics

• Data: your IP address (shortened by Google and never shown to us), a random identifier for your browser, the pages you visit, how long you stay, where you came from, and approximate device and location (city) data.
• Purpose: knowing how many people read the site and which pages interest them, so we can decide what to write and what to fix. No advertising, no profiling.
• Legal basis: your consent (art. 6(1)(a) GDPR), given through the cookie notice. Without it, nothing from Google is loaded.
• Retention: the cookies last 2 years; aggregated Google Analytics reports, 14 months.
• How to withdraw it: from the panel in the Cookie policy, in one click.

We make no automated decisions and build no profiles with this data. The fields marked as required in each form are the minimum we need to help you: without them we cannot reply.

3. If we contacted you first (commercial prospecting)

Besides people who write to us, we reach out to professionals on our own initiative, by email or on LinkedIn, to present our services.

• Data: name and surname, job title, company, public professional profile and work email address.
• Source: publicly available sources and professional networks, mainly LinkedIn, plus business directories and databases.
• Legal basis: our legitimate interest in promoting our services to businesses (art. 6(1)(f) GDPR), read together with article 19 of the Spanish Data Protection Act (LOPDGDD), which covers professional contact data when the person is approached in their business capacity and not in their private sphere.
• Retention: up to one year from the last contact, or until you object.

You can object at any time, without giving reasons, by replying to the message or writing to hello@kikirikiworks.com. When you do, we keep your address on a suppression list for the sole purpose of never contacting you again.

4. Who receives your data

We neither sell nor share your data. Only the providers that serve us have access, as processors and under a contract signed in accordance with article 28 GDPR:

• Tally (Belgium) — contact and application forms.
• MailerLite (Lithuania) — mailing list management and newsletter delivery.
• Cloudflare (United States, with an EU subsidiary) — website hosting and delivery.
• Google (Google Ireland Limited) — email and document storage through Google Workspace, and website analytics through Google Analytics, the latter only if you accepted analytics cookies.
• Clay and HeyReach (United States) — only for the commercial prospecting described in section 3. They receive no data from people who contact us through the website.
• HeroKit — the animated background on the home page loads from their servers, so they receive your IP address and the technical details of the request simply because you visited the page. That same component in turn requests a typeface from Google Fonts and a measurement script from Cloudflare Insights. None of the three stores anything on your device or sets cookies.

Beyond that, we will only disclose your data where legally required (for example, to the tax authorities, the courts or law enforcement).

5. International transfers

Tally, MailerLite and Google Workspace process data within the European Economic Area. Cloudflare, Google Analytics, Clay and HeyReach involve processing in the United States. Those transfers rely on the EU-US Data Privacy Framework adequacy decision and, additionally, on the standard contractual clauses approved by the European Commission (art. 46(2)(c) GDPR).

6. Your rights

You may exercise the following rights at any time:

• access: find out whether we process your data and which data;
• rectification: correct inaccurate data;
• erasure: ask us to delete data that is no longer needed;
• objection: object to processing based on legitimate interest, including commercial prospecting;
• restriction: ask us to keep the data but not use it while a claim is resolved;
• portability: receive the data you gave us in a machine-readable format;
• withdrawal of consent you had given, without affecting processing carried out before the withdrawal.

Write to hello@kikirikiworks.com stating which right you are exercising. It is free and we reply within one month at most. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, C/ Jorge Juan 6, 28001 Madrid), the competent supervisory authority.

7. Security and minors

We apply reasonable technical and organisational measures to protect your data: encrypted connections across the site, access limited to the people who need it, and GDPR-compliant providers.

This website and its services are aimed at professionals and people over 14. We do not knowingly collect data from anyone younger; if we find any, we delete it.

8. Changes to this policy

If we change how we handle data, we will update this page and its date. Where a change significantly affects you and we have your email address, we will let you know.