Privacy Policy

🏢 1. Data controller

The controller responsible for the processing of the personal data collected through this website and the Kiwii service is the company that owns it, with contact address: [email protected].

📋 2. Data we collect

We collect the following personal data:

Identification data: first name, surname, email and phone number, provided when creating an account or using the contact form.
Service usage data: time-tracking records (time, geolocation, device), generated by employees when using the system.
Billing data: managed entirely by Stripe. Kiwii does not store credit card data.

⚖️ 3. Purpose and legal basis

We process your data to:

Provide the service (legal basis: performance of a contract): time-tracking management, report generation and account administration.
Legal compliance (legal basis: legal obligation): retention of records in accordance with Spanish Royal Decree-Law 8/2019 on working-time records.
Commercial communications (legal basis: legitimate interest or consent): sending updates about the service, only if you have accepted them.

🗓️ 4. Data retention

Data is retained while the account is active and, once cancelled, for the periods legally required (a minimum of 4 years for working-time records under Spanish labour regulations).

🤝 5. Disclosure to third parties

We do not disclose personal data to third parties, except:

Stripe: payment processor, based in the EU. See its policy at stripe.com/es/privacy.
Google Analytics (Google Ireland Ltd.): aggregated and anonymised measurement of website usage. Only activated if you accept analytics cookies in the banner. Anonymised IPs (anonymize_ip). Data may be transferred outside the EU under the standard contractual clauses approved by the European Commission. See policies.google.com/privacy.
Infrastructure providers: hosting on servers based in the European Union.
Legal obligation: when required by a competent authority.

🛡️ 6. Your rights

You may exercise at any time your rights of access, rectification, erasure, restriction, portability and objection by writing to [email protected].

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (aepd.es).

🍪 7. Cookies

This site uses two types of cookies:

Technical cookies (always active, legal basis: legitimate interest)

XSRF-TOKEN, kiwii_session: session and CSRF. Necessary for the site to function.
cookie_consent: remembers your decision about analytics cookies.

Analytics cookies (opt-in, legal basis: consent)

Google Analytics 4 (_ga, _ga_*): measures visits, page views and aggregated behaviour. Not loaded until you accept the cookie banner. Anonymised IP. No advertising cookies (ad_storage, ad_user_data, ad_personalization always denied via Google Consent Mode v2).

How to manage your consent

On your first visit, a banner appears allowing you to accept or reject analytics cookies. You can withdraw your consent at any time by deleting the domain's cookies in your browser, or by writing to [email protected].

🤖 8. Integrations with AI assistants (Kiwii Connect)

Kiwii offers Kiwii Connect, an optional feature that lets you connect your Kiwii account with third-party artificial intelligence assistants (for example ChatGPT by OpenAI, Claude by Anthropic or other compatible ones) so that you can query and manage your company's data in natural language.

How it works and what it involves:

The connection is voluntary and is activated by each company through explicit consent and a secure authorisation (OAuth). You can revoke it at any time from your panel.
Once connected, the data you query or act upon (for example employees, time records, absences, shifts, incidents, stock or expenses) is sent to the AI provider you choose in order to generate the response. That processing is subject to the privacy policy of that provider.
Access is limited to your own company's data (per-account isolation) and to the permissions you authorise (query only, or query and actions).
Every action carried out through the AI is recorded in your account's audit trail.
Kiwii does not sell this data or use it to train AI models.

If you do not activate Kiwii Connect, none of your data is shared with AI providers.

🔄 9. Changes to this policy

We reserve the right to update this policy. Material changes will be communicated by email or through a notice in the admin panel.