Privacy policy.

How we collect, use and look after personal data when you use this site or work with us. We have kept it as short and plain as the law allows.

Legal notice

This website is run by the business below, as required by Spain's information society services law, LSSI.

Trading name: Kitebox.

Owner: Felix Grant, autónomo.

NIF/NIE: Z1469451D.

Registered tax address: C/ Pere Dezcallar i Net 11, local 1, 07003 Palma de Mallorca, Illes Balears, Spain.

Email: felix@kitebox.co.uk.

Who we are

The controller of your personal data is Felix Grant, trading as Kitebox, autónomo, C/ Pere Dezcallar i Net 11, local 1, 07003 Palma de Mallorca, Illes Balears, Spain.

Email: felix@kitebox.co.uk. We have not appointed a data protection officer, as the law does not require one for a business of our size.

The laws we follow

We are based in Spain and most of our clients are in the UK. We follow the EU General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD). Where we handle data about people in the UK, we also follow the UK GDPR and the Data Protection Act 2018.

What we collect

Contact form and email: your name, email address, company, the services you are interested in, your budget range and your message.

Calls and projects: notes from calls, and the contact details of the people we work with at your organisation.

Site usage: pages viewed, device and browser type, approximate location and how you reached the site. We only collect this through analytics cookies if you allow them. See our cookie policy.

We do not ask for special category data, such as health information, and we ask you not to send it to us.

Why we use it, and our lawful basis

To reply to your enquiry and prepare a proposal: steps taken at your request before a contract, Article 6(1)(b).

To deliver and invoice work: performance of a contract, Article 6(1)(b), and our legal obligations under Spanish tax and accounting law, Article 6(1)(c).

To understand how the site is used: your consent, Article 6(1)(a). You can withdraw it at any time.

To keep the site secure and keep business records: our legitimate interests, Article 6(1)(f).

Who we share it with

We use a small number of service providers to run the business. Each one acts as a processor under a data processing agreement.

Website hosting: Vercel. Contact form delivery: Resend. Analytics: Google Analytics 4, only with your consent.

We do not sell personal data and we do not share it for advertising.

International transfers

Some of our providers are based outside the European Economic Area or the UK. Where that happens we rely on an adequacy decision, such as the EU decision covering the UK or the EU-US Data Privacy Framework, or on standard contractual clauses.

How long we keep it

Enquiries that do not lead to work: 12 months from our last contact.

Client records and invoices: as long as Spanish tax and commercial law requires, currently six years.

Analytics data: 14 months, set in Google Analytics 4.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to how we use it. You can also ask for a copy in a portable format. Where we rely on consent, you can withdraw it at any time.

Email felix@kitebox.co.uk and we will reply within one month. We may ask you to confirm who you are first.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right.

You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es). If you are in the UK, you can complain to the Information Commissioner's Office (ico.org.uk).

Changes to this policy

We will update this page when the way we handle data changes, and change the date at the top. If a change is significant and we hold your email address, we will tell you.