Last updated: 5 October 2026

1. Data controller The controller responsible for the processing of personal data described in this policy in connection with www.kairosbarcelona.com is: Registered company name: KAIROS TOP SERVICES SL. Spanish tax identification number (NIF): B88844923. Address: Avinguda de l’Enllaç, 9, puerta 10, 08173 Sant Cugat del Vallès, Barcelona, Spain. Contact email, including for data protection requests: info@kairosbarcelona.com. Kairos Barcelona is the trading name used on this website.

2. Personal data we process When you contact us by email, we process the information you provide: your name, email address and, where supplied, telephone number, company details and the content of your enquiry. If you send documents, we may process the personal data they contain to deal with your request. Please provide only the information necessary and avoid sending sensitive data or information about other people that is not relevant to your enquiry. The website platform may also process technical information, such as your IP address, browser information and security logs. Usercentrics records consent preferences, the date of those preferences, and the identifiers and technical data necessary to manage them and demonstrate your choice. The use of cookies and third-party services is explained in the Cookie Policy and the website’s privacy preferences panel.

3. Purposes and legal bases We use personal data for the following purposes: - To respond to enquiries about our services and communicate as necessary to deal with them. When you request a quotation or steps towards a potential contract on your own behalf, the legal basis is taking steps at your request prior to entering into a contract, under Article 6(1)(b) of the GDPR. - To handle other business correspondence, general enquiries and requests you make as a representative or contact person for a company. The legal basis is our legitimate interest in responding to requests and maintaining business relationships, under Article 6(1)(f) of the GDPR. You may object to this processing in the circumstances provided for by law. - To comply with applicable legal obligations and handle requests to exercise data protection rights, under Article 6(1)(c) of the GDPR. - To maintain website security and prevent misuse, under Article 6(1)(f) of the GDPR, on the basis of our legitimate interest in protecting the website and its communications. - To manage and demonstrate consent preferences in order to comply with applicable legal obligations, under Article 6(1)(c) of the GDPR. For non-essential technologies that require consent, the legal basis is your consent, which you can withdraw through the privacy preferences panel. Sending an enquiry does not subscribe you to marketing communications. We will not use your data for marketing campaigns without an appropriate legal basis. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

4. Data retention We retain enquiry data for as long as necessary to respond and maintain the related correspondence. If no contractual relationship is established, we retain the data only while the enquiry remains open or related business follow-up is ongoing. Once that purpose has ended, the data will be deleted unless retention is necessary to comply with legal obligations or address potential liabilities. Where a request leads to a contract, the necessary data will be retained for the duration of the contractual relationship and the applicable statutory retention periods. Where retention is required by law or to address potential liabilities, access to and use of the relevant data will be restricted, or the data will be blocked as required by Spanish law, for the appropriate period. Retention periods for cookies and similar technologies are described in the specific cookie information. Consent records will be retained as necessary to demonstrate preferences and comply with applicable obligations.

5. Recipients and service providers Authorised personnel who need access to handle enquiries may access personal data, subject to confidentiality obligations. We also use technology providers to host and maintain the website, manage email and administer consent: Wix, Microsoft 365 and Usercentrics. Where they act on our behalf, processing is governed by the relevant data protection agreements. We may disclose data to public authorities or other bodies where required by law. We do not sell the personal data of people who contact us. The use of external services such as Google Maps may involve processing by the service provider. Information about these services and the conditions for their activation is provided in the Cookie Policy and the privacy preferences panel.

6. International data transfers Technology providers may process data outside the European Economic Area (EEA). Wix states that it processes data in Israel and may process data in other countries. Its processing agreements provide for adequacy decisions and standard contractual clauses, with additional measures where appropriate. Microsoft provides for standard contractual clauses for transfers of data relating to its business services under its Data Protection Addendum. The Usercentrics agreement provides for processing within the EU or EEA and requires safeguards under Chapter V of the GDPR for transfers to third countries, including adequacy decisions or standard contractual clauses, as applicable. When you use Google Maps through this website, Google may process data under its own policy. Google describes international transfers based on adequacy decisions, including the EU-US Data Privacy Framework for certified entities, and standard contractual clauses where appropriate. You can consult these providers’ information and agreements at: Wix: https://support.wix.com/es/article/acuerdo-de-procesamiento-de-datos-para-usuarios-de-wix Microsoft: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?lang=31 Usercentrics: https://usercentrics.com/legal-documents/ Google: https://policies.google.com/privacy Google data transfer frameworks: https://policies.google.com/privacy/frameworks You may request information about the safeguards applicable to processing carried out on our behalf by emailing info@kairosbarcelona.com.

7. Your rights You may request access to your personal data, rectification or erasure and, where applicable, restriction of processing, object to processing and request data portability. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. To exercise these rights, email info@kairosbarcelona.com, stating the right you wish to exercise and providing the information needed to locate your data. We will request additional information to verify your identity only where we have reasonable doubts; you do not need to attach a copy of your identity document as a matter of course. If you believe your data has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos): https://www.aepd.es.

8. Providing personal data Providing personal data is voluntary. However, we need a way to contact you and sufficient information about your request to respond. Without contact details or adequate information, we may be unable to deal with your request. This website does not currently offer an active contact form.

9. Changes to this policy We will update this policy when our processing activities or relevant circumstances change. If the controller changes or a different use of the data is envisaged, we will provide the information required by law. Updating this text alone does not authorise new uses or transfers of personal data.