1. Data Controller
In accordance with Regulation (EU) 2016/679 (GDPR) and applicable national data protection legislation, the data controller for your personal data is:
- Company name: KodeCoder
- Registered address: Apartado de Correos 2003, 08223, Terrassa (Barcelona), Spain
- Email: info@kodecoder.com
- Website: kodecoder.com
2. Data We Collect
Depending on how you use our services, we may collect the following categories of personal data:
2.1 Data you provide directly
- Identity data: first name, last name, company name.
- Contact data: email address, phone number, country.
- Account data: login credentials (passwords stored with encryption ).
- Project data: descriptions and requirements shared during the engagement process.
- Communications: messages sent via the contact form or email.
2.2 Data collected automatically
- Usage data: IP address, browser type, operating system, pages visited, session duration anonymously.
- Security logs: when several failed login attempts occur in a row from the same IP address, we log that IP address and the browser used so we can detect and investigate possible attacks (brute-force, bots). This logging is internal and is not used for tracking or analytics purposes. We also note the IP address, the approximate country (worked out from the IP on our own server) and the reason when an automated registration attempt is blocked, and, in summary form (with the email partly hidden), repeated attempts to register an email that already has an account. We do not keep what the person making the attempt typed.
- Log of emails sent: to know whether an email actually went out (verifications, invitations, notices), we keep the recipient's address, the type and subject of the message and its state (pending, sent or failed) with the dates. We do not keep the content of the message.
- Anti-spam verification (reCAPTCHA): when a form submission fails reCAPTCHA verification, we internally log which form was affected and why (without linking it to your name or email) to detect spam attacks or technical failures in the verification system itself.
- Login history: every time you successfully log in to your account, we record the date and time, IP address, the approximate country of that connection (worked out from the IP on our own server) and the browser/device used. This history lets us detect suspicious access and is shown to you (your first and last login dates) in your profile; authorized staff can consult it for account support and security purposes.
- Cookies and similar technologies: as described in our Cookie Policy.
2.3 Third-party data (public Google reviews)
If you connect your Google Business Profile account to our admin panel, we automatically import public reviews that Google users have left about KodeCoder, to display them on our website alongside reviews submitted directly through our form. For each Google review we may process: the author's public name, public profile photo, star rating, and review text. This data is already public on Google at the time it is imported, and every imported review stays unpublished on our site until an administrator manually reviews and approves it. If you are the author of a review and would like us to remove it from our site (regardless of whether it remains visible on Google), you can request this by emailing hola@kodecoder.com.
2.4 Data obtained by our sales team
If you have spoken with someone from our sales team (by phone, in a meeting, at an event or because someone referred you), we may record you as a prospect with the details you gave us in that conversation: name, surname, company and, where applicable, tax ID, email and phone, together with the internal notes needed to prepare your quote. We tell you about this in the first email we send you (the confirmation of your request), which states where the data came from and how to exercise your rights.
All the requests you make with the same email are grouped under your prospect record (or client record, if you already are one), so we can follow them up without asking for the same details again. Each prospect is only visible to the salesperson who manages it and to administration.
2.5 Client area account
When you accept a quote and become a client, we email you an invitation to create your password and access your client area. The account is only created when you accept the invitation; at that point you accept our terms and this policy, and choose whether you want to receive marketing communications. You can also register yourself; in that case the account stays pending until we approve it.
2.6 Electronic signature of agreements and annexes
If you sign an agreement, an annex or an additional revision agreement from your client area, we email you a one-time code and, when you sign, we keep as evidence of the signature: your name, the email verified with the code, the date and time of sending, verification and signature, the IP address, the browser (user agent), the version of the signed text and the document's digital fingerprint (SHA-256). This data is included on an evidence page at the end of the signed PDF, a copy of which we send to you. The code is only stored hashed and stops working after 10 minutes.
2.7 Referral codes
If you reach our website through a referral link or code (for example, the one of a salesperson who recommended you, or of one of our campaigns), or if you type a code in the request form, we record which code was used, how (link, typed or assigned by our team), through which channel and when, together with the offer that code promises you. We use it to apply that offer to your first project, credit the request to the right salesperson or campaign, and calculate our sales team's commission.
If the code belongs to a salesperson, that salesperson is told that your request arrived with their code and can see your contact details like the rest of their portfolio. On the website, the link's reference is kept in your browser only until you send the form: in the tab while it is open and, only if you accepted analytics cookies, for 90 days. You can erase it at any time from "Cookie settings".
3. Purposes & Legal Basis
| Purpose | Legal basis |
|---|---|
| Managing the contractual relationship (service delivery) | Art. 6(1)(b) GDPR — contract performance |
| Responding to enquiries and contact forms | Art. 6(1)(b) GDPR — pre-contractual measures |
| Managing prospects and following up quote requests (including contacts recorded by our sales team) | Art. 6(1)(b) GDPR — pre-contractual measures at the data subject's request; Art. 6(1)(f) GDPR — legitimate interest in handling business contacts |
| Applying a referral code's offer, crediting the request and calculating the sales commission | Art. 6(1)(b) GDPR — pre-contractual measures and contract performance; Art. 6(1)(f) GDPR — legitimate interest in measuring campaigns and remunerating our sales team |
| Client area invitation and account management | Art. 6(1)(b) GDPR — contract performance |
| Electronic signature of agreements and annexes, and keeping their evidence | Art. 6(1)(b) GDPR — contract performance; Art. 6(1)(f) GDPR — legitimate interest in being able to prove the signature in case of a claim |
| Sending marketing communications (newsletter) | Art. 6(1)(a) GDPR — explicit consent |
| Website analytics and improvement (analytics cookies) | Art. 6(1)(a) GDPR — consent |
| Advertising and remarketing on Meta (marketing cookies) | Art. 6(1)(a) GDPR — consent |
| Compliance with legal and tax obligations | Art. 6(1)(c) GDPR — legal obligation |
| Fraud prevention and service security | Art. 6(1)(f) GDPR — legitimate interest |
| Displaying public Google reviews about KodeCoder | Art. 6(1)(f) GDPR — legitimate interest (public reputation already disclosed by the data subject) |
4. Data Retention
We retain your personal data for as long as necessary to fulfil the purposes for which it was collected:
- Client and project data: for the duration of the contractual relationship and, once ended, for applicable statutory periods (minimum 5 years for tax and commercial obligations).
- Contact form data (no contract): 2 years from the last communication.
- Prospects and quote requests that do not lead to a contract: 2 years from the last activity, after which they are deleted automatically.
- Referral codes on a request: kept with the request or prospect (same periods); on a project, the code and the offer applied are kept with the project. In your browser, the reference is erased when you send the form or, at most, after 90 days (analytics cookies only).
- Client area invitations: the link expires after 7 days; the invitation record is deleted 90 days after it is used, revoked or expires.
- Former clients' data: after the relationship ends it is kept blocked for the statutory periods (Art. 32 of Spain's LOPDGDD), available only to courts and public authorities, and is not reused for commercial purposes. If you choose to work with us again, we may reactivate your client record.
- Signed agreements and their signature evidence: for the duration of the contractual relationship and then for the limitation periods of claims arising from it and the statutory periods (minimum 6 years for commercial obligations). Drafts and voided documents are kept as long as the project.
- Consent records: for as long as necessary to demonstrate compliance.
- Navigation logs: up to 12 months.
- Security logs: 90 days once an issue is resolved; a maximum of 12 months if it remains open.
- Log of emails sent: 90 days.
- Login history: 12 months from each login, after which it is automatically deleted.
- Platform audit records (who performed which action in the system): the IP address and browser data are deleted after 12 months; the record itself is kept for 5 years to demonstrate security and compliance with our obligations.
- User accounts that have been removed: kept for 30 days in case the removal was a mistake, and then irreversibly anonymised (the name, email, sessions and the rest of the account's data are erased).
- Newsletter: until you withdraw your consent. Twelve months after you unsubscribe, we anonymise your email and name.
- Google reviews: for as long as the review stays published on your Google Business Profile and its removal from our site has not been requested.
6. International Transfers
Where a service provider is located outside the European Economic Area (EEA), we ensure transfers are protected by appropriate safeguards, such as:
- European Commission adequacy decisions.
- Standard Contractual Clauses (SCCs) approved by the European Commission.
7. Your Rights
Under the GDPR, you have the right to:
- Access (Art. 15): know whether we process your data and obtain a copy.
- Rectification (Art. 16): correct inaccurate or incomplete data.
- Erasure / "right to be forgotten" (Art. 17): request deletion of your data when no longer necessary. If we have no legal duty to keep it, we irreversibly anonymise it; if we must keep it (for example, invoices for projects), it stays blocked until the statutory period ends and is never reactivated.
- Restriction of processing (Art. 18): request suspension of processing in certain circumstances.
- Data portability (Art. 20): receive your data in a structured, machine-readable format.
- Object (Art. 21): object to processing based on legitimate interests or for direct marketing.
- Withdraw consent: revoke consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email info@kodecoder.com with a copy of your ID. We will respond within 30 days.
If you believe processing of your data infringes the GDPR, you have the right to lodge a complaint with your local supervisory authority. In Spain: Agencia Española de Protección de Datos (AEPD) — www.aepd.es.
8. Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure, including:
- HTTPS/TLS encryption on all communications.
- Passwords stored with encryption .
- Restricted staff access to personal data.
- Regular encrypted backups.
- Security notices when your account is accessed from a country other than your usual one.
For those notices we work out the country of the connection on our own server, without sending your IP address to any third party. We use a country database from MaxMind for this.
This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.
9. Minors
Our services are directed at businesses and professionals. We do not knowingly collect data from individuals under 14 years of age. If you become aware that a minor has provided us with data without parental consent, please contact us so we can delete it.
10. Policy Changes
We may update this policy to reflect regulatory or operational changes. For significant changes, we will notify you via the website or email. The date of the last update is always shown at the top of this document.
12. Google Analytics, Tag Manager & A/B Testing
Google Analytics 4: we use Google Analytics 4 (Google LLC) to anonymously measure site usage. It is only activated if you have consented to analytics cookies. Data is transferred to Google LLC (USA) under Standard Contractual Clauses. IP addresses are anonymised before storage. More information: Google Privacy Policy.
Google Tag Manager: we use this Google tag management tool to centrally load measurement tools. It is only activated if you have consented to analytics or marketing cookies.
A/B Testing: we randomly assign a display variant (A or B) stored in your browser's localStorage under the key kc-ab. This data contains no personally identifiable information, is used solely to improve site design and user experience, and is only activated with your analytics consent.
Google Business Profile: as explained in point 2.3, we periodically import public reviews from our Google Business Profile through Google's official API (Google LLC). This connection requires explicit authorization from an administrator and only processes data the review's author has already made public on Google.
Meta Pixel: we use the Meta pixel (Facebook/Instagram, Meta Platforms Ireland Ltd.) to measure the effectiveness of our ads and show you relevant ads on Facebook and Instagram. It is only activated if you have consented to marketing cookies. More information: Meta Privacy Policy.
13. Contact
For any enquiries regarding this policy or the processing of your personal data:
- Email: info@kodecoder.com
- Contact form: Contact us