Legal · Kybernes Real Estate
Privacy policy
Last updated: 16 October 2026
This is an English translation for convenience. If there is any discrepancy, the Spanish version prevails.
This policy explains what personal data we process when you use this website, why, on what legal basis, how long we keep it, who we share it with and what rights you have.
1. Controller
Company Group Kybernes, S.L.U. (Tax ID B26766253), Plaza Josep Rovira 13, 4.º 2.ª, 08018 Barcelona, Spain. Email for any data protection matter: legal@kybernesgroup.com.
We have not appointed a data protection officer because we are not required to. Kybernes’ five websites (kybernesgroup.com and the realestate., tech., hotels. and pulse. subdomains) belong to the same company. When you contact Kybernes Real Estate, the controller is still Company Group Kybernes, S.L.U..
2. What data we process and where it comes from
We process the data you give us (contact and quote request form, email, WhatsApp, job applications), data generated as you browse (IP address, cookie identifiers, pages visited, whether you accept analytics) and, for business contacts, publicly available contact details from their company or LinkedIn profile.
We do not process special categories of data (health, beliefs, etc.) or data of children under 14 through the website. Please do not include them in free-text fields.
3. Purposes, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Contact and quote request form: answering your enquiry, qualifying it, telling you who to talk to and, if you ask, preparing and sending you a personalised quote and following it up | Name, email, phone (optional), profile (owner, guest, buyer, investor, owners’ association or company), company, message and the information you give us to prepare the quote (area or street of the home, size, rent, whether you live in Barcelona, timing) | Pre-contractual steps at your request (art. 6.1.b GDPR) and, if you write on behalf of a company, legitimate interest in answering business contacts (art. 6.1.f GDPR and art. 19 LOPDGDD) | While we handle the enquiry or the quote is valid, and up to 12 months after the last contact if no relationship follows; if a contract is signed, they become part of the contractual relationship |
| Booking the introductory call: giving you a day and time for a thirty-minute video call before the visit, sending you the confirmation and the link, and preparing the call | Name, email and the answers you give when booking (profile and what you need), and the day and time chosen | Pre-contractual steps at your request (art. 6.1.b GDPR) | While we handle the enquiry and up to 12 months after the last contact if no relationship follows |
| Communications to clients about services similar to those contracted | Email, services contracted | Legitimate interest and art. 21.2 LSSI, with the option to object in every message | While you are a client and until you object |
| Job or collaboration applications (employees, freelancers, Real Estate suppliers) | Name, contact details, CV, cover letter, LinkedIn profile, qualifications, availability, proposed fees | Pre-contractual steps at your request (art. 6.1.b) and, to keep the application for future openings, your consent (art. 6.1.a) | During the process and, if nothing follows, 12 months; with your consent, up to 24 months |
| Contractual relationship with clients, suppliers and collaborators | Identification, contact, invoicing, payment and service delivery data | Performance of the contract (art. 6.1.b); tax and accounting obligations (art. 6.1.c) | During the relationship and, blocked, the limitation periods (5 years by default; tax and accounting, 4 and 6 years) |
| Business prospecting (professional contacts who have not written to us) | Name, position, company, business email, public LinkedIn profile, sector | Legitimate interest (art. 6.1.f GDPR and art. 19 LOPDGDD), with the option to object in the first and every following message. First contact is by LinkedIn or phone; we only email if you have replied, been introduced to us or are already a client (art. 21 LSSI) | Until you object or 24 months without reply |
| LinkedIn (Kybernes pages) | Public interactions (following, comments, messages) | Legitimate interest in managing our professional presence; LinkedIn Ireland Unlimited Company is joint controller for page statistics under its terms | Under LinkedIn’s terms; messages are handled like the contact form |
| Web analytics | Cookie identifier, pages viewed, interaction with the page, device, referral source, truncated IP | Consent (art. 22.2 LSSI and art. 6.1.a GDPR) through the cookie banner | See the cookie policy |
| Security and server logs | IP, date and time, page requested, user agent | Legitimate interest in the website’s security (art. 6.1.f) | The hosting provider’s log period (30 days at most) |
| Handling rights requests and complaints | Identification and request data | Legal obligation (art. 6.1.c) | The limitation periods for infringements (up to 3 years) |
Fields marked as required in the form are needed to answer you; if you do not provide them, we cannot do so.
4. Automated decisions
We do not take automated decisions with legal effects on you through the website. We sort enquiries by profile and urgency to answer sooner, but the reply always comes from a person.
5. Children
The website is aimed at adults, professionals and companies. We do not knowingly process data of children under 14 (art. 7 LOPDGDD); if we find it has been provided, we will delete it.
6. Recipients and processors
We do not sell or share your data. We only disclose it to public authorities or courts when the law requires it, and to providers who process it on our behalf as processors under a data processing agreement (art. 28 GDPR):
| Provider | Service | Data location and safeguards |
|---|---|---|
| Google Ireland Limited (Google Workspace) | Email, calendar, document storage and contract signing | EU, with possible transfers to the US under the EU-US Data Privacy Framework and standard contractual clauses |
| Vercel, Inc. | Website hosting | Technical logs may be processed in the US, under standard contractual clauses |
| Formspree, Inc. | Receiving the contact form and forwarding it to our email | US, under standard contractual clauses |
| Cal.com, Inc. | Booking the introductory call: name, email and answers given when booking | US, under standard contractual clauses |
| Contentsquare SAS | Website usage analytics (only with your consent) | EU (France) |
| Google Ireland Limited (Google Tag Manager and Google Analytics) | Visit measurement (only with your consent) | EU, with possible transfers to the US under the EU-US Data Privacy Framework |
| Vercel, Inc. (Vercel Web Analytics) | Aggregated visit measurement, without cookies (only with your consent) | US, under standard contractual clauses |
| Supabase, Inc. (Amazon Web Services) | Database of our internal management tool, where we log enquiries and opportunities | EU (Ireland); standard contractual clauses for support from outside the EU |
| Microsoft Ireland Operations Ltd. | Shared channel with clients (Teams) | EU, under Microsoft’s Data Protection Addendum |
| Accounting and tax advisers, and our bank | Invoicing and payment | Spain |
Also to LinkedIn Ireland Unlimited Company, joint controller for company page statistics, under its terms of use.
7. International transfers
Some providers are US companies or may access data from outside the European Economic Area for support. In those cases the transfer relies on the EU-US Data Privacy Framework adequacy decision (if the provider is certified) or on the standard contractual clauses approved by the European Commission (Decision 2021/914), with any supplementary measures required. You can ask us for a copy of the safeguards at legal@kybernesgroup.com.
8. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given without affecting the lawfulness of earlier processing. Write to legal@kybernesgroup.com or to Plaza Josep Rovira 13, 4.º 2.ª, 08018 Barcelona, saying which right you are exercising and, if we have doubts about your identity, some detail that lets us confirm it. We will reply within one month (extendable by two more months in complex cases, after telling you).
If you believe we have not handled your rights properly, you can complain to the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid). We would appreciate it if you told us first.
9. Security
We apply technical and organisational measures appropriate to the risk: named accounts with two-factor authentication, encryption in transit and at rest, access control, backups and confidentiality commitments from our team and collaborators. No transmission over the internet is completely secure; if you notice any problem, write to legal@kybernesgroup.com.
10. Changes
We may update this policy to reflect legal changes or changes in our services. We will publish the new version with its date and, if the change is significant and we have your email, we will let you know.