Privacy Policy

Last updated: June 8, 2026 · Version 1.0

CAF Corporation Ingeniería de Costes SL is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect personal information when you use the Kpex platform, in compliance with the EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD).

Data Controller
Data We Collect
Legal Basis for Processing
How We Use Your Data
Data Sharing
International Transfers
Data Retention
Your Rights
Cookies
Data Processing Agreement
Security
Children
Changes
Contact and DPA

1. Data Controller

CAF Corporation Ingeniería de Costes SL is the data controller for personal data processed through the Kpex platform.

Registered name	CAF Corporation Ingeniería de Costes SL
CIF	B-67719633
Registered address	Polígono Colón, Número 3, Escalera D, Piso 3, Puerta 2, C.P. 14001, Córdoba (España)
Email	privacy@caf-corporation.com

We have appointed a Data Protection contact for all GDPR matters: privacy@caf-corporation.com

2. Data We Collect

2.1 Account and registration data

Full name, corporate email address, company name, job title
IP address at registration, form completion time (bot detection)
Account status and approval records

2.2 Subscription and billing data

Subscription tier, start date, renewal dates
Invoice and payment records (payment method type, last four digits where applicable)
EU VAT number (for B2B EU customers)

2.3 Platform usage data

Projects, estimates, WBS structures, and cost data created by you
Module usage logs (which tools and features you access)
Session data: pages visited, actions taken, timestamps

2.4 Technical data

IP address, browser type and version, operating system
Device identifiers, session tokens
Error logs and diagnostic data

2.5 Communications data

Content of emails and support messages you send to CAF
CRM records created when you register, submit a contact form, or request a demo

3. Legal Basis for Processing

Processing purpose	Legal basis (GDPR Article 6)
Creating and managing your account	Performance of a contract (Art. 6(1)(b))
Billing and invoicing	Performance of a contract; legal obligation (Art. 6(1)(b)(c))
Providing the Kpex Services	Performance of a contract (Art. 6(1)(b))
Security, fraud prevention, and bot detection	Legitimate interests (Art. 6(1)(f))
Platform analytics and performance monitoring	Legitimate interests (Art. 6(1)(f))
Sending transactional emails (invoices, alerts)	Performance of a contract (Art. 6(1)(b))
Sending product update and marketing emails	Consent or legitimate interests (Art. 6(1)(a)(f)) — opt-out available
Compliance with legal obligations	Legal obligation (Art. 6(1)(c))
Tax record keeping (7 years)	Legal obligation — Ley General Tributaria

4. How We Use Your Data

We use personal data to:

Create and manage your Kpex account and Subscription;
Deliver the Services, including storing and displaying your estimates and projects;
Process billing, issue invoices, and manage payments;
Provide customer support and respond to enquiries;
Send service notifications (maintenance windows, feature updates, security alerts);
Send commercial communications where you have consented or where permitted under legitimate interest (you may opt out at any time);
Monitor and improve platform security and performance;
Comply with legal and regulatory obligations;
Enforce these Terms and investigate suspected misuse.

We do not sell your personal data to third parties.

We do not use your User Content (estimates, project data) to train AI models or for any purpose other than providing the Services to you, without your explicit written consent.

5. Data Sharing

We share personal data only as necessary for the purposes described in this Policy:

Service providers and sub-processors: hosting providers, email delivery services, payment processors, analytics tools — all subject to binding data processing agreements and GDPR-compliant safeguards.
Legal authorities: where required by a valid legal obligation, court order, or regulatory request under Spanish or EU law.
Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to equivalent data protection commitments.
Within the Kpex Exchange: for Vendor accounts, your company name and contact details may be visible to estimators who receive your RFQ responses. For Data Partners, contributed data is shared in aggregated and anonymised form only.

6. International Data Transfers

We aim to process and store personal data within the European Economic Area (EEA). Where data is transferred outside the EEA (e.g., to cloud infrastructure providers with servers outside the EU), we ensure adequate protection through:

Standard Contractual Clauses (SCCs) approved by the European Commission (Decision (EU) 2021/914);
Transfers to countries with an adequacy decision under Article 45 GDPR; or
Other appropriate safeguards under Article 46 GDPR.

You may request details of international transfer safeguards by contacting privacy@caf-corporation.com.

7. Data Retention

Data category	Retention period
Active account data	Duration of the Subscription + 60 days post-termination
User Content (estimates, projects)	60 days after account termination, then deleted
Billing and invoice records	7 years (Spanish tax law — Ley General Tributaria)
Security and access logs	12 months
Support communications	3 years from last interaction
Data Partner contributed data (anonymised)	Indefinitely (as licensed in Section 12 of the T&C)

After the applicable retention period, data is securely deleted or anonymised.

8. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

Right of access (Art. 15) — request a copy of the personal data we hold about you.
Right to rectification (Art. 16) — request correction of inaccurate or incomplete data.
Right to erasure (Art. 17) — request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
Right to restrict processing (Art. 18) — request that we limit how we use your data in certain circumstances.
Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
Right to object (Art. 21) — object to processing based on legitimate interests, including direct marketing.
Rights related to automated decision-making (Art. 22) — we do not make legally significant decisions about you solely by automated means.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email privacy@caf-corporation.com. We will respond within 30 days. Identity verification may be required.

If you are not satisfied with our response, you have the right to lodge a complaint with the Spanish data protection authority: Agencia Española de Protección de Datos (AEPD) at www.aepd.es. If you are located in another EU Member State, you may contact your local supervisory authority.

9. Cookies and Tracking Technologies

Kpex uses cookies and similar technologies to operate the platform and to improve your experience. Our cookie usage falls into the following categories:

Category	Purpose	Consent required?
Strictly necessary	Session management, CSRF protection, login state	No — required for platform operation
Functional	Language preferences, theme settings	No — legitimate interests
Analytics	Platform usage statistics (aggregated, no advertising profiling)	Yes — opt-in consent
Marketing	Not currently used on the Kpex platform	N/A

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent the platform from functioning correctly.

A full list of cookies used by Kpex is available in our Cookie Policy.

10. Data Processing Agreement (B2B)

Where CAF processes personal data on your behalf as a data processor (e.g., personal data of your employees or clients that you upload into Kpex estimates or project records), CAF acts as a data processor and you act as the data controller.

In those circumstances, the following applies:

CAF will process such personal data only on your documented instructions and for the purpose of providing the Services;
CAF will implement appropriate technical and organisational measures to protect the data (Section 11 below);
CAF will assist you in fulfilling your obligations as data controller under GDPR Articles 32–36 (security, breach notification, DPIAs, prior consultation);
Sub-processors engaged by CAF are listed at privacy@caf-corporation.com on request. CAF provides 30 days' notice of changes to sub-processors;
Upon termination, CAF will delete or return all processed personal data as described in Section 7.

Enterprise and Corporate customers who require a formal, separately signed Data Processing Agreement (DPA) in addition to this Policy may request one by contacting legal@caf-corporation.com.

11. Security Measures

CAF implements industry-standard technical and organisational security measures, including:

HTTPS/TLS encryption for all data in transit;
Encrypted data storage at rest;
Role-based access controls and principle of least privilege;
Regular security testing and vulnerability assessments;
Session management with CSRF protection;
Rate limiting on authentication and API endpoints;
Employee access to personal data restricted to those with a need to know.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, CAF will notify the AEPD within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where required by GDPR Article 34.

12. Children's Data

The Kpex platform is intended exclusively for professional use by individuals aged 18 or over. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact privacy@caf-corporation.com and we will delete it promptly.

13. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by email to your registered address and/or by notice within the platform at least 30 days before the changes take effect. The "last updated" date at the top of this page indicates the most recent revision.

14. Contact

For any privacy-related queries, data subject requests, or to request a formal DPA:

Privacy enquiries	privacy@caf-corporation.com
Legal / DPA requests	legal@caf-corporation.com
Supervisory authority (Spain)	Agencia Española de Protección de Datos — www.aepd.es

Contents