Privacy policy

This policy explains how we handle personal data when you visit krieen.com, contact us or send us a job application.

Who is responsible for your data?

Krieen Sustainable Communication S.L. is the data controller. Our tax identification number is B67338590. Our contact address is Carrer de Mallorca 183, Sobreático 1a, 08036 Barcelona, Spain. You can contact us about privacy at info@krieen.com or at this postal address.

Enquiries and working with us

When you use our contact form, we collect your name, email address and message, together with your company and phone number if you choose to provide them. We also record the submission date, a request identifier and your acknowledgement of the privacy notice. Messages are stored in our private website inbox. If you email us, we receive your email address, message and any attachments you send.

We use these details to answer your enquiry, discuss a project and, where applicable, prepare or deliver the services you request. For requests about entering into a contract with you, the legal basis is taking steps at your request before a contract or performing that contract, under Article 6(1)(b) of the GDPR. For other business correspondence, including contact with people representing an organisation, we rely on our legitimate interest in answering messages and maintaining business relationships, under Article 6(1)(f).

Your name, email address and message are required to send the contact form. Company and phone number are optional. Please only include information relevant to your request. The privacy checkbox records that you have read the notice; it does not subscribe you to marketing or authorise unrelated uses of your data.

Job applications

If you send your CV or portfolio to talent@krieen.com, we use the information you provide to assess your application and communicate with you about recruitment. This can include your contact details, experience, qualifications and work samples. The legal basis is taking steps at your request before a possible employment contract, under Article 6(1)(b) of the GDPR.

Please do not send identity documents, health information or other sensitive information unless we specifically request it for a lawful reason. If we would like to keep your application for future vacancies after considering your current application, we will ask separately for your consent. You can withdraw that consent at any time by contacting us.

Running and protecting the website

Our hosting provider processes technical information needed to deliver and protect the site, such as IP addresses, requested URLs, request times, browser information and error or security logs. Our contact form also uses a keyed hash derived from the submitting IP address to limit repeated messages. This is a pseudonymous security identifier, not anonymous data, and is stored with the enquiry.

We rely on our legitimate interest in keeping the website available, preventing abuse and protecting messages, under Article 6(1)(f) of the GDPR. We may also process records to meet legal obligations under Article 6(1)(c), or to establish, exercise or defend legal claims under Article 6(1)(f).

Website statistics

If you accept analytics, we use Vercel Web Analytics, provided by Vercel Inc., to understand visits and whether the contact process works. It reports page visits and events such as contact-link clicks, form starts, failed submissions and saved enquiries. The legal basis is your consent under Article 6(1)(a) of the GDPR. Analytics stays off until you accept it, and rejecting it does not prevent you from using the site or sending an enquiry.

Vercel describes this service as cookieless and based on aggregate statistics. It uses a temporary identifier derived from request information and discards the visitor session after 24 hours. That is a limit on the visitor session, not a promise that all statistics are deleted after one day. Reports can include the page, referring site, approximate location, device and browser type. We remove query strings and fragments from the page URL sent to analytics and do not include your form answers in custom analytics events.

We remember your analytics choice in this browser for 180 days. You can change it or withdraw consent at any time in Analytics settings, also linked as "Privacy settings" in the footer. Withdrawal stops further analytics collection; it does not reverse earlier lawful processing or identify your contribution within anonymous aggregate reports. Read our cookie policy for details of browser storage and Vercel's analytics privacy information for the service's processing.

Videos and external links

Some pages offer YouTube videos. We ask before loading the embedded player. If you choose to load it, Google receives connection and playback information, including your IP address, and may use cookies or similar storage. We rely on your consent to initiate this optional connection. You can stop it by removing the player using the control below the video or by leaving the page. See our cookie policy for the controls and limitations.

Our social links take you to external websites. Google and the operators of those sites explain their own processing in their privacy notices, including Google's privacy policy.

Who receives the information?

Authorised Krieen team members handle enquiries and applications. We use technology service providers in the following categories:

• Cloud hosting and content-delivery providers, which deliver the website, store its public media and process connection and security information.
• Managed database providers, which store contact-form submissions in our private website inbox.
• Business email providers, which handle correspondence and attachments, including recruitment messages.
• Website analytics providers, which process visit and contact-form event information to produce aggregate statistics.

IT support providers may also process information on our behalf when maintaining these systems. Professional advisers and public authorities may receive information where necessary to meet a legal obligation or deal with a claim.

These service providers operate internationally and may use subprocessors. Our website enquiry database is hosted in Germany. Hosting, email, analytics and support services may involve processing in the European Economic Area and in other countries, including the United States. Our hosting and analytics provider's published data processing terms include the European Commission's standard contractual clauses for applicable transfers. You can ask which providers have received your personal data and request information about the applicable transfer safeguards, including a copy where relevant, at info@krieen.com.

How long do we keep information?

We keep enquiries while we are answering them or discussing a possible project. If an enquiry does not become a client relationship, we delete it when the correspondence has ended and there is no ongoing proposal or reasonably expected follow-up. We may retain a restricted record where a specific legal obligation or claim requires it.

We keep applications while we assess them or run the relevant selection process. When we have finished considering your application and there is no ongoing recruitment process involving you, we delete it from active recruitment records. If we ask to keep it for future vacancies, we will specify a retention period when seeking your separate consent. We delete it when that period ends or you withdraw consent, unless a specific legal obligation or claim requires a restricted record for longer.

If an enquiry becomes a client relationship, the records needed to deliver the work and meet accounting, tax and contractual obligations follow the retention periods applicable to those purposes. We restrict records retained only for legal obligations or claims and delete them when the relevant period ends. This does not justify keeping every email or attachment indefinitely.

Security logs, enquiry security identifiers and backups are retained according to their operational purpose and the applicable provider settings. We review their necessity and restrict access. The 24-hour analytics session limit described above is separate from the reporting history retained by our analytics provider.

Your rights

Depending on the circumstances, you can ask to access, correct or erase your personal data, restrict its use, receive a portable copy, or object to processing based on legitimate interests. If processing relies on your consent, you can withdraw it without affecting processing that was lawful before withdrawal. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Contact info@krieen.com to exercise your rights. We may request information reasonably needed to verify your identity. We normally respond within one month; if the GDPR permits an extension, we will explain it within that first month. Some records may need to be retained despite an erasure request because of a legal obligation or claim.

You can complain to the Spanish Data Protection Agency, AEPD, or to the competent supervisory authority in the country where you live or work or where the alleged infringement occurred. You do not have to contact us first.

Changes to this policy

We update this policy when our processing changes and show the last-modified date below. We will provide additional notice or ask for consent where required. Browsing the website does not mean that you consent to new uses of your data.