Privacy policy
What data we process, on what legal basis, for how long and who else sees it. No copy-pasted clauses: only what actually happens at IndustriaKit.
Last updated: 1 October 2026
Two different roles, and they should not be confused
When you visit this website, write to us, download a template or buy a kit, IndustriaKit is the data controller: we decide what data we ask for and why.
When your company subscribes to the panel and enters data about its workers, contractors or incidents, your company is the controller and we are the processor (Article 28 GDPR). We only touch that data on your instructions, and the relationship is documented in a data processing agreement you can generate and sign from our website.
This policy covers the first role. The second is governed by that agreement.
Who processes your data
Owner: Oscar Escanez Abad · NIF 23302634T
Trade name: IndustriaKit (Potencia Digital)
Address: Calle Trece de Septiembre n.º 10, Primero, 30310 Cartagena (Murcia), España
Contact: info@industriakit.com
We are not required to appoint a data protection officer and have not appointed one. Privacy enquiries are handled at the address above.
What exactly we process
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Contact or download form: name, email, company and whatever you write in the message. | Reply to you and send the requested material. | Your consent and pre-contractual steps (Art. 6(1)(a) and 6(1)(b)). | Until you ask for them to be erased, which you can do at any time. Every three years we check whether keeping them still makes sense. |
| Kit purchase: email, billing details and country. | Deliver the product, issue the invoice and account for VAT. | Performance of the contract and legal accounting and tax obligations (Art. 6(1)(b) and 6(1)(c)). | The applicable tax and commercial periods, generally six years. |
| Panel account: the name, email and profile picture Google gives us when you sign in with your account, your company, and an access log (date, browser type and the account as a cryptographic hash, not in clear). | Give access to the service, bill it and be able to investigate a security incident. | Performance of the contract and legitimate interest in the security of the service (Art. 6(1)(b) and 6(1)(f)). | For as long as the subscription lasts. When it ends we delete nothing on our own initiative: you choose whether we return it, erase it or both. |
| Server technical logs: IP address, date, requested resource and user agent. | Keep the service running and detect attacks or abuse. | Legitimate interest in network security (Art. 6(1)(f)). | Those applied by the hosting provider to its server logs. We do not copy them or combine them with other data. |
| Regulatory newsletter, only if you expressly request it. | Notify you of regulatory changes affecting your sector. | Your consent, withdrawable in every message (Art. 6(1)(a)). | Until you unsubscribe. |
What we do not do
- We use no analytics, no advertising pixels and no third-party cookies. There is no Google Analytics or equivalent tool on this website.
- We do not sell or transfer your data to anyone for commercial purposes.
- We take no automated decisions with legal effects on you, and we do not profile.
- Fonts are hosted on our own server: loading this page triggers no request to any third-party domain.
Who we share data with, and why
Only with the providers the service needs to work. Almost everything is processed inside the European Economic Area. There is one exception, and we name it: sign-in with Google, explained below with the safeguard that applies. The assistant's AI mode, which your company only uses if it switches it on, is processed inside the European Union.
- Raiola Networks S.L. (Spain) — hosting of this website and of the panel: accounts, the data your company puts into it, attached files and the email the website sends.
- Hostinger International Ltd. — server in Paris (France) running the automation that receives the forms and prepares emails. It does not host the panel.
- Stripe Payments Europe Ltd. (Ireland) — payment collection. Your card details are entered on Stripe's domain and we never see them.
- Brevo (Sendinblue SAS, France) — transactional email and newsletter delivery.
- Google Ireland Ltd. (Ireland) — sign-in to the panel. When you press “Sign in with Google” you identify yourself to Google, which returns your name, email and picture to us. Google acts there as controller of its own service and may process data outside the EEA under the safeguards stated in its privacy policy.
- Berget AI AB (Sweden, European Union) — only if your company switches on the assistant's AI mode. By default the assistant runs in local mode and sends nothing. With AI mode on, the question and the context it needs are processed in Berget's data centres inside the European Economic Area; Berget does not store their content or use it to train models.
- Voice dictation in the panel — the assistant's microphone transcribes on the device itself when the browser allows it. Otherwise the browser's speech service (Google, Microsoft or Apple, depending on which you use) does the transcription, only after the company agrees. IndustriaKit does not receive the audio, only the text sent.
In addition, where the law requires it, we hand data over to the tax authorities or to a court.
Health data: what the panel does not store
The staff module lets you record that a worker is on sick leave and since when, because your company needs that to plan shifts. It does not store the medical reason or the diagnosis: that would be special category data under Article 9 GDPR and the field simply does not exist.
If your company needs to keep medical information, it must do so at the occupational health service or the insurer, not here.
Security: what we do and what we do not yet
All traffic is encrypted with TLS. You sign in to the panel with a Google account, so we store no passwords. Each account's data is kept with earlier versions, so a mistaken change can be undone.
It is also worth saying what we do not have, because reading it elsewhere later would be worse: we have no ISO 27001 certification, no SOC 2 report, no external security audit and no database encryption at rest. If your procurement policy requires any of these, today we cannot meet it.
If a security breach occurs in our infrastructure, we will notify you in writing within a maximum of 24 hours of becoming aware, with whatever we know at that point, so that your company can meet its own 72-hour deadline before the supervisory authority.
Your rights
You may ask us for access to your data, its rectification or erasure, restriction of or objection to processing, and portability. An email to info@industriakit.com stating what you want is enough. We reply within one month at most.
If you are a panel customer you can also export all your company's information in an open format whenever you like, without asking. Nothing is deleted unless you ask: data you withdraw from the panel first goes to a bin for thirty days in case of a mistake, and if you ask us for full erasure we carry it out and confirm it in writing, except what we must keep for tax purposes.
If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (www.aepd.es) or to the supervisory authority in your country.
Minors and changes
This service is aimed at companies and professionals. It is not intended for minors and we do not knowingly collect data from minors.
If we change this policy, we will publish the new version with its date. If the change is substantial and affects panel customers, we will notify them by email before it takes effect.