Privacy Policy

1. Data Controller

‍Human Affinity Platform, S.L., a company domiciled at Calle Fuencarral 135, 6º ext left, with NIF B87794384, (hereinafter, “Kymatio” or the “Company”) is responsible for the processing of your personal data. This privacy policy provides information regarding the processing of personal data of customer representatives or potential customers, job candidates, supplier representatives or users of social networks who interact with us, following the provisions of the General Data Protection Regulation (“GDPR”).

You can contact us by writing an email to privacy@kymatio.com to resolve any questions you may have regarding this policy. If you wish, you can request a list of recipients of your data at the same email address.

2. Data Protection Officer

‍Kymatio has a Data Protection Officer, in charge of responding to any concerns that our users may have regarding the protection of their personal data and our practices in this regard. In addition, you can contact our Data Protection Officer to exercise any of your data protection rights and to suggest any action related to this area.

To contact our Data Protection Officer, please write an email to privacy@kymatio.com with your request and we will respond as soon as possible.

3. Data processing of representatives of client companies

‍If you are a representative of a Kymatio client company because you have any of our services, we will process your data as follows:

• Purpose of processing: We process your data to maintain, fulfill, develop, control, and execute the business relationship that we have with our client (your employer) or with you if you are self-employed as a Kymatio client. Additionally, we may send you commercial communications about our services, keeping you informed about news that may be of interest to you, based on prior profiling of your interests and/or web browsing. This profiling is done through a study of your browsing behavior (visits to each page, visit times, frequency, etc.) and your preferences when using our services. We do this to ensure that our communications and promotions are genuinely relevant to you.
• Types of data processed: The data requested in the form you fill out, identification data (name and surname, email), web browsing data, information about your browsing preferences, and the interests you have indicated or can be inferred from your browsing habits.
• Legal basis: The processing of your data is necessary to execute our contractual relationship (for example, for managing the provision of services to your company). Regarding the sending of commercial communications, Kymatio has a legitimate interest in maintaining contact with you to inform you of our news that may be relevant to you.
• Recipients: Only some of our technology and management service providers will have access to your personal data, as required to execute the services they provide us (for example, agencies or hosting services). These providers process your data according to our instructions and always under our control. We may also share your data with other group companies, based on legitimate interest in joint supplier management.
• International data transfers: To provide the service, we use technology providers who may access your personal data from the United States, always following our instructions. These providers adhere to the Privacy Shield framework, which ensures US entities apply data protection standards equivalent to those in Europe. You can request an updated list of recipients by emailing privacy@kymatio.com.

Additionally, your data may be transferred to technology providers located in countries outside the European Union (“EU”). You can request an updated list of these recipients by emailing privacy@kymatio.com.

Such international data transfers are made based on the signing of standard contractual clauses issued by the European Commission, in accordance with Article 46.2 of the GDPR. You can request a copy of these clauses by emailing privacy@kymatio.com.

• Data retention period: Your data will be kept for the duration of our contractual relationship. Regarding commercial communications, your data will be retained as long as you wish; you can unsubscribe at any time using the link in our communications. If you do not interact with our commercial emails for 18 months (meaning you do not open them), we will proceed to delete your data for this purpose.
• Required data: The information requested in the fields marked with an * in the data collection form is mandatory, as Kymatio needs this data to provide the service with all guarantees. Failure to provide this information would prevent us from optimally delivering the service.

4. Data processing of potential customers for advertising

‍If you are not yet a Kymatio customer but wish to receive our communications about news, offers, campaigns, launches, etc., your data will be processed as follows:

• Purpose: To keep you informed about our news and offers of interest.
• Types of data processed: Identification data (email address, name and surname), web browsing data, information about your browsing preferences.
• Legal basis: Your express consent, demonstrated by checking the corresponding box.
• Recipients: Only some of our technological service providers will have access to your personal data as needed to provide their services. They will process your data according to our instructions and always under our command.
• International data transfers: To provide you with the service, we use technology providers who may access your personal data from the United States, always following our instructions. These providers adhere to the Privacy Shield framework, ensuring US entities apply equivalent data protection standards to those in Europe. You can request an updated list of recipients by emailing privacy@kymatio.com.
• Data retention period: Your data will be kept for as long as you wish; you can unsubscribe at any time using the link in our communications. If you do not interact with our commercial emails for 18 months (meaning you do not open them), we will delete your data.
• Required data: The information requested in fields marked with an * in the data collection form is mandatory, as Kymatio needs it to send you commercial communications. Not providing this information would prevent us from sending you such communications.

5. Data processing for contact through form, email, or chat

‍If you have submitted an inquiry to Kymatio, we will process your data as follows:

• Purpose: To resolve the query or question you have raised.
• Types of data processed: Email address, name, and surname.
• Legal basis: Kymatio has a legitimate interest in responding to any queries you may raise.
• Recipients: Only some of our technological service providers will have access to your data as needed to execute their services, always under our instructions and control.
• International data transfers: As above, we may use technology providers located in the United States or outside the EU under the same safeguards as previously mentioned.
• Data retention period: Your data will be retained for this purpose until your query has been resolved.
• Required data: The information requested in fields marked with an * in the data collection form is mandatory to allow us to respond to your inquiry. Failure to provide this information would prevent us from responding optimally.

6. Processing of candidate data sent via the "Work with us" form

‍If you are a candidate for a job at Kymatio and have sent us your CV, we will process your data as follows:

• Purpose: To review your application, current or future, for a job position at Kymatio.
• Types of data processed: Identification data (ID / NIF, name and surname, address, telephone, e-mail, signature, image, date and place of birth), employment data, and academic and professional information.
• Legal basis: Your express consent, given by checking the corresponding box.
• Recipients: Only our technological service providers, as needed to provide their services, under our instructions and control.
• International data transfers: Same as above.
• Data retention period: Your data will be kept for one year from the date you submitted your CV to Kymatio.
• Required data: The information requested in fields marked with an * in the data collection form is mandatory, as we need it to assess your job application. Not providing this information would prevent us from optimally evaluating your candidacy.

7. Processing of social network users interacting with Kymatio profiles

‍If you interact with Kymatio on a social network, we process your data as follows:

• Purpose: To interact with you in accordance with the policies of the social network and to manage our online communities according to both your interests and ours.
• Types of data processed: Name, surname, and user nickname on the social network.
• Legal basis: Legitimate interest to process your data within the normal operation of the social network to resolve queries, doubts, etc., as well as to interact with you as usual on the network.
• Recipients: No third party will access your social network data through Kymatio.
• Data retention period: We will retain your data only as long as needed to resolve your query or for the duration of our interaction. Note that, although we will not specifically save this data, it may remain on the social network according to their own policies.

8. Data processing of supplier representatives

‍If you represent a Kymatio supplier company because you provide services to us, we process your data as follows:

• Purpose: To maintain, fulfill, develop, control, and execute the business relationship we have with our supplier (your employer) or with you if you are self-employed.
• Types of data processed: Data requested in the relevant form, identification data (name and surname, email), and employment, academic, and professional data, among others.
• Legal basis: The processing is necessary for the execution of our contractual relationship (for example, management of services provided to us by your company).
• Recipients: Only some of our technology and management service providers as needed, and always under our instruction. We may also share your data with other group companies, based on the legitimate interest of joint supplier management.
• International data transfers: Same as above.
• Data retention period: Your data will be kept for the duration of our contractual relationship.
• Required data: The information requested in fields marked with an * in the data collection form is mandatory, as Kymatio needs it to provide the service with all guarantees. Not providing this information would prevent us from providing the service optimally.

9. Exercise of rights

‍You can exercise the following rights before Kymatio:

• Right of access to your personal data to know what data is being processed and the processing operations carried out with it.
• Right to rectify any inaccurate personal data.
• Right to delete your personal data, when possible.
• Right to request restriction of processing when the accuracy, legality, or necessity of the data processing is in doubt, in which case we may keep the data for the exercise or defense of claims.
• Right to object to the processing of your data, for example, to resolve any query you have submitted through the contact form, email, or chat, or when you interact with us on social networks, or if you are a representative or contact at a Kymatio provider.
• Right to withdraw your consent to receive commercial communications at any time, via the link included in each communication.
• Right to data portability, when you are a Kymatio client and the processing is intended to maintain our contractual relationship. Portability means receiving your personal data in a structured, commonly used, and machine-readable format and transmitting the data to another data controller when processing is carried out by automated means.

You may exercise your rights at any time, free of charge, by writing to privacy@kymatio.com. Please specify the right you wish to exercise, as well as your identification data. If, to verify your identity, we require additional information, we will let you know.

If you believe that Kymatio has committed an infringement of data protection legislation, please contact us at privacy@kymatio.com so that we can resolve the issue as soon as possible. In any case, you may also contact the Spanish Data Protection Agency (www.aepd.es) and claim the protection of your rights.