Privacy policy

Version dated 27 October 2026

1. Data controller

Controller: a Spanish commercial company. CIF: B22809552. Intra-Community VAT number: ESB22809552. Registered office: Avinguda de la Costa Blanca 93, 03540 Alicante, Comunidad Valenciana, Spain. Commercial Registry of Alicante, Sheet A-199558. Contact: WhatsApp +34 624 309 985, Telegram @krepko_eu, e-mail hello@krepko.es.

2. Data we collect

Only the data you send us through the website form or by messenger: name, contact details (phone, username, e-mail) and the text of your enquiry. Please do not include special categories of data (health, religion, criminal records, etc.) in the free-text field; they are not needed for the initial assessment and, where required, will be requested separately with your explicit consent.

3. Purposes

To respond to your enquiry, prepare the exact plan and price, manage your assignment and keep you informed of its status.

4. Legal basis

Art. 6.1.b GDPR (Regulation (EU) 2016/679): pre-contractual measures taken at the request of the data subject and performance of what has been agreed; art. 6.1.a: your consent, expressed by ticking the box in the form; art. 6.1.f: legitimate interest in maintaining communication about an enquiry already initiated.

5. Recipients

Your data is not sold or transferred to third parties for advertising purposes. Only the following have access: technical providers that support the website and the intake of enquiries: website hosting and enquiry intake (GoDaddy, servers in the EU), Google services (spreadsheets; Google Analytics and Google Ads only after your cookie consent), the messaging operators Telegram and WhatsApp Business, the agency's CRM and the email delivery service MailerLite (if you left your email to receive materials) - as processors under art. 28 GDPR; the qualified professionals involved in your case (lawyer, gestor, sworn translator, notary); and public authorities where required by law. If you write to us via WhatsApp or Telegram, the correspondence is also processed by the operators of those services under their own policies.

Microsoft Clarity (behaviour analytics, only after you click "Accept" in the cookie banner): we use it to see how visitors use the website and to improve it. Legal basis: your consent (art. 6.1.a GDPR). Data: pages viewed, clicks, scrolling and cursor movements, screen size, device and browser type, approximate location based on the IP address and a pseudonymous Clarity identifier stored in cookies; from this Clarity builds heatmaps and session recordings. Text you type into form fields is masked and is not sent to Clarity. The service is provided by Microsoft Ireland Operations Limited, and the data may be processed by Microsoft Corporation in the United States (see section 6). Microsoft states that it acts as a data controller for Clarity and processes the data under the Microsoft Privacy Statement. You can withdraw your consent at any time with the "Change cookie choice" button in the Cookie policy or by deleting cookies in your browser settings; withdrawal does not affect the lawfulness of prior processing.

6. International transfers

Messaging, e-mail and technical service operators may process data outside the EEA. Such transfers are covered by the safeguards of the GDPR: adequacy decisions of the European Commission (including the EU-US Data Privacy Framework) or standard contractual clauses (art. 46 GDPR). Microsoft Clarity data may be transferred from Microsoft Ireland Operations Limited to Microsoft Corporation in the United States: Microsoft Corporation is certified under the EU-US Data Privacy Framework, and transfers between these Microsoft companies are also covered by standard contractual clauses.

7. Retention periods

Enquiries and correspondence without a formalized assignment: up to 12 months from the last contact. Documents and data of completed assignments: 5 to 10 years, as required by Spanish tax and other legislation. Web analytics data (if enabled): up to 14 months. Microsoft Clarity data (if enabled): session recordings 30 days; heatmaps, aggregated click data and recordings we mark for later review up to 9 months (periods set by Microsoft). At your request we will delete the data earlier, unless we are legally obliged to retain it.

8. Your rights

• access your data, rectify it or erase it;
• restrict processing, object to it and receive a copy in a portable format;
• withdraw consent at any time, without affecting the lawfulness of prior processing.

Write to us on WhatsApp, Telegram or at hello@krepko.es: we will respond within one month at the latest. If you believe your rights have been violated, you may lodge a complaint with the Agencia Española de Protección de Datos (AEPD, aepd.es).

9. Security

Data is transmitted over an encrypted connection (HTTPS/TLS). Access to work accounts is restricted and protected with two-factor authentication; your data is seen only by those who work on your assignment.

10. Minors

The website is not directed at children under 14. Data of minors is processed only within the framework of assignments of their parents or legal representatives.

11. Changes to this policy

The current version is always published on this page with its date. We will inform clients with ongoing assignments of substantial changes.