Privacy Policy

1. Data controller

• Holder: Andrey Balakirev (natural person, self-employed / autónomo).
• NIE: Z0142861J.
• Data-protection contact: balakirev.andrey@gmail.com

A Data Protection Officer has not been appointed, as the cases of art. 37 GDPR and art. 34 LOPDGDD do not apply.

2. What data we process and why

a) Contact / lead form

When you download a result or sign up to a tool waitlist, we collect: email address, profile type (installer, gestoría, OTC, CER member or other) and optional metadata (UTM origin, tool of interest). These data are used to:

• Deliver the requested file.
• Notify you when a waitlisted tool is released.
• Send occasional communications related to the CER sector and Kit CER tools (no spam, one-click unsubscribe).
• Internal aggregated statistics about demand per profile and tool.

b) Data processed in the browser

Tools that require files (Datadis CSV, coefficient TXT, etc.) process the data locally in your browser. Those files are not sent to our servers and are not stored. When you close the tab, the data is automatically deleted. This approach follows the client-side processing pattern recommended by the AEPD for calculation tools that handle sensitive data.

c) Technical logs

The server records basic access events (truncated IP address, user agent, path) for up to 30 days for security, abuse prevention and troubleshooting. They are not cross-referenced with personal identifiers.

3. Legal basis

• Consent (art. 6.1.a GDPR) — for sending email communications and waitlist subscriptions. Given when you submit the form.
• Legitimate interest (art. 6.1.f GDPR) — for technical security logs and aggregated statistics.

4. Retention

• Form data: until you withdraw your consent or for a maximum of 24 months without activity on your part (email opens, link clicks, tool downloads).
• Technical logs: 30 days.
• Browser-processed data: deleted when the tab is closed.

5. Recipients

We do not share data with third parties for commercial purposes. The data is stored in the site’s technical infrastructure (hosting / KV-store provider contracted for Kit CER), acting as data processor under art. 28 GDPR. If we later add external services (analytics, email provider), this will be notified in this policy before it takes effect.

6. International transfers

At the time of publication of this policy, all data is stored within the European Economic Area (EEA). If the infrastructure provider makes transfers to third countries, these will be carried out under the guarantees set out in chapter V of the GDPR (standard contractual clauses, adequacy decision, etc.). Any change will be reflected in this policy.

7. Your rights

You may exercise at any time the rights of:

• Access to your data.
• Rectification of inaccurate data.
• Erasure («right to be forgotten»).
• Restriction of processing.
• Objection to processing.
• Portability of your data.
• Withdrawal of consent at any time (without retroactive effect on prior processing).

To exercise these rights, send an email to balakirev.andrey@gmail.com indicating the right exercised and providing reasonable proof of identity (for example, replying from the registered email). We will respond within a maximum of one month.

If you consider that the processing does not comply with the regulation, you may file a complaint with the Spanish Data Protection Agency (AEPD).

8. Automated decisions

Kit CER does not carry out data processing based solely on automated decisions with legal effects on the user, nor profiling within the meaning of article 22 of the GDPR. The tools are indicative calculators; the results are interpreted and validated by the user.

9. Changes to this policy

This policy may be updated to reflect technical or legal changes. The current version is always published at kit-cer.es/en/privacidad. Substantial changes will be communicated by email to subscribed users before they take effect.