Skip to content
Kardu

Privacy policy

Last updated: September 2026

1. Data controller

The data controller for personal data collected through kardu.eu is Kardu GRC SpA, a company incorporated in Chile. For any privacy-related queries, you can contact us at privacy@kardu.eu.

This policy covers the kardu.eu website. If you use the platform, the app’s privacy policy also applies: https://app.kardu.eu/privacy.

2. Data we collect

We collect only the data strictly necessary to provide the service:

  • ✓Name, email, company, company size, country, the regulations you are interested in and, if you write one, a message, when you fill in the form to book a Kardu Foundation conversation. We use them only to prepare that conversation. The time slot is booked through Zeeg (Zeeg GmbH, Germany; data hosted in the EU), which receives the name and email you enter when booking. The conversation takes place over Google Meet (Google Ireland Limited), which processes your name, your email and the technical data of the call; we do not record calls.
  • ✓Email address and your answers, when you request your Vendor Security Check report or write to us.
  • ✓Aggregated website browsing data (page views, scroll depth, click heatmaps, clicks on the main buttons, form submissions without their content and Core Web Vitals performance metrics), only if you accept analytics.
  • ✓If you use the platform and accept analytics, in-app usage events linked to a pseudonymous user ID (no name or email), to improve the product.
  • ✓Billing data, only if you subscribe to a paid plan.

Analytics consent is a single choice for kardu.eu and app.kardu.eu: whatever you choose on one also applies on the other. On the website analytics is aggregated; in the app events are linked to a pseudonymous ID, never to your name or email. We do not install advertising cookies, and we do not sell or share your data with third parties for advertising purposes.

3. Legal basis for processing

The processing of your data is based on the following legal grounds under the GDPR:

  • ·Performance of a contract or pre-contractual steps at your request — to provide the service you have requested or prepare the conversation you book.
  • ·Consent — for analytics (PostHog) on the website and in the app, and for sending product communications, revocable at any time.

4. Where your data is stored

Data is stored on servers located within the European Union. Our web analytics (PostHog) uses its EU instance and call bookings (Zeeg) are hosted in Germany. Video calls over Google Meet may involve Google processing data in the United States, under the EU-US Data Privacy Framework and Google’s standard contractual clauses. Beyond that, we do not transfer personal data outside the European Economic Area, except for the documented exceptions in our list of sub-processors.

5. Cookies

Kardu uses strictly necessary technical cookies (session management, language preferences) and, only with your consent, analytics cookies (PostHog). We do not use advertising cookies. You can manage your consent at any time from our cookie policy.

6. Your rights

As a data subject, you have the following rights under the GDPR:

  • ·Access — request a copy of the data we hold about you.
  • ·Rectification — correct inaccurate or incomplete data.
  • ·Erasure — request the deletion of your data.
  • ·Portability — receive your data in a structured, machine-readable format.
  • ·Objection — object to processing based on legitimate interest.
  • ·Restriction — request restriction of processing in certain circumstances.

To exercise any of these rights, write to us at privacy@kardu.eu. We will respond within a maximum of 30 days.

If you believe we have not handled your data correctly, you can lodge a complaint with the data protection authority of your EU country; in Spain, the Spanish Data Protection Agency (AEPD, aepd.es).

7. Changes to this policy

We may update this policy occasionally. We will notify you by email if the changes are significant. The date of the last update will always be visible at the top of the document.

8. Contact

For any queries relating to this policy or the processing of your personal data, you can contact our privacy team at privacy@kardu.eu.