Privacy policy

01Who is the controller

The data controller is Jaime Valdés, trading as Holding Insurtech as a self-employed professional in Spain. Full identification details appear at the end of this page. You can get in touch at any time through the email address shown there.

02Browsing the site

Browsing without registering triggers no processing of personal data. We use no third-party analytics, no tracking pixels and no advertising cookies. The only preference stored is your visual theme (light or dark), kept locally in your browser and never leaving your device.

03Contact form

If you write to us through the form on the home page we process your name, your email address, your business name if you give it, and the content of your message, together with the language you are browsing in and the page you wrote from, so we can reply in your language and know what you were looking at. The sole purpose is to reply to you and, if the project goes ahead, to prepare your quote. The legal basis is your consent, given by ticking the box before sending and withdrawable at any time by writing to the contact address. That data is not used for marketing communications, is not shared with anyone and is not combined with any other source. Enquiries that do not turn into a project are deleted once they are no longer needed, and in any case within a year.

04Kit Digital waiting list

If you join the Kit Digital waiting list we process your name, your email address, your business name if you give it, your employee-count bracket and the categories you tick as being of interest, along with the language you browse in. The purpose is to email you when an official call for applications is published and, if you ask us to, to advise you on it. The legal basis is your consent (Art. 6.1.a GDPR), given by ticking a box that is not pre-ticked. If you also tick the optional news box, that second consent — independent of the first and separately revocable — allows us to send you commercial communications by email under Article 21 of the Spanish LSSI. You may withdraw either consent at any time, as easily as you gave it: through the unsubscribe link carried in every email, or by writing to the contact address. This data is neither shared with third parties nor sold, and the list is deleted after twenty-four months at the latest. Joining this list does not constitute a grant application and creates no entitlement to any subsidy.

05User accounts

If you create an account we process your email address and the identifier returned by the sign-in provider you choose (Google), plus the billing details you enter voluntarily: name, company, tax ID and phone. The purpose is to identify you, let you follow your projects and issue your invoices. The legal basis is the taking of pre-contractual steps at your request and the performance of the contract (art. 6.1(b) GDPR). We never receive or store your Google password: authentication happens entirely at the provider.

06Bookings and payments

When you book a service we process the order data (plan, amount, date and status) and your billing details. Your card details NEVER pass through our servers: they are collected and processed directly by Stripe on its own payment page, and we only receive the payment confirmation, the last digits and the card country. The legal basis is performance of the contract and, for retaining invoices, compliance with our tax obligations.

07Processors and providers

To deliver the service we rely on three providers acting as data processors: Netlify, Inc. (site hosting), Supabase, Inc. (database and authentication) and Stripe Payments Europe, Ltd. (payment processing). All three provide adequate safeguards through the standard contractual clauses approved by the European Commission. The database, where your account and billing data lives, is hosted in a European Union region. The server that renders the pages may process the request outside the European Economic Area, always under those clauses. If you choose to sign in with Google, identification happens on their systems under their own policies.

08Communication channels

If you write to us on WhatsApp, or we reply to your enquiry there, your messages and your number are also processed by WhatsApp Ireland Limited (Meta Platforms) under its own policy. Likewise, our contact email is provided by Google Ireland Limited, so anything you send us by email passes through its servers. Both are recipients of that data simply by how the channel you choose works; we share nothing else with them. If you would rather avoid either, the website form stores your message only in our own database.

• WhatsApp privacy policy
• Google privacy policy

09International transfers

Some of the providers above have US parent companies. Where processing involves a transfer outside the European Economic Area, it relies on the standard contractual clauses and, where applicable, on certification under the EU-US Data Privacy Framework. We do not share data with any third party beyond these processors, except where legally required.

10How long we keep it

Account data is kept for as long as you keep the account open. Invoices and related accounting records are kept for the periods required by tax and commercial law, which run up to six years. Enquiries that do not become projects are deleted once they are no longer needed.

11Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by writing to our contact email with proof of identity. Many of these you can exercise yourself: billing details are editable from your account, and you can request full deletion by email. If you believe your request has not been handled properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).