Privacy Policy

Last updated: March 1, 2026

1. Data Controller

Kubo ERP S.L. is the data controller for personal data collected through this website (kubo-erp.com) and the ERP application.

  • Company name: Kubo ERP S.L.
  • Registered address: Madrid, Spain
  • Privacy contact: privacy@kubo-erp.com

2. Data We Collect

We collect the following types of data:

Data you provide directly

  • Full name
  • Email address
  • Your Kubo account data: name, email, preferred language and password (always stored hashed, never in plain text)
  • Company name and phone number (when provided)
  • Content of messages sent via the contact form
  • Billing information (when applicable)

Account and authentication

To manage your account we use two sign-in mechanisms:

  • Magic links: single-use, short-lived links we email you so you can sign in without a password.
  • The kubo_account session cookie: a technical, encrypted, host-only cookie that keeps you signed in. It contains no personal data readable by the browser and is not shared with third parties (see section 7).

Data collected automatically

  • IP address and browser information
  • Pages visited and time spent
  • Technical and analytics cookies (see section 7)

3. Purpose of Processing

We use your data for the following purposes:

  • Contract performance: Providing the contracted ERP service, account management and billing.
  • Customer support: Responding to inquiries and managing support requests.
  • Service communications: Technical notifications, security updates and maintenance notices.
  • Service improvement: Usage analysis (always anonymized or aggregated) to improve the platform.
  • Legal compliance: Maintaining records required by tax and legal obligations.

4. Data Retention

Data is retained for as long as necessary to fulfil the purpose for which it was collected:

  • Active account data: while the account remains active.
  • After cancellation: available for export for 30 days, then securely deleted.
  • Billing records: retained for 5 years in accordance with Spanish tax law.
  • Contact records: up to 1 year from the last interaction.

6. Your Rights

Under the GDPR, you have the following rights:

  • Access: Obtain confirmation of whether we process your data and a copy of it.
  • Rectification: Correct inaccurate or incomplete data.
  • Erasure: Request deletion of your data when it is no longer necessary.
  • Portability: Receive your data in a structured, machine-readable format.
  • Restriction: Restrict processing in certain circumstances.
  • Objection: Object to processing based on legitimate interests.

If you have a Kubo account, you can exercise two of these rights yourself from your account area, under "Billing & data": download a copy of your data (portability, in JSON format) and request the deletion of your account (erasure). When you request deletion, your data stays available for export for 30 days before secure erasure; billing records are kept for the legal period noted in section 4.

To exercise any of these rights, you can also contact us at privacy@kubo-erp.com. We will respond within 30 days. You may also lodge a complaint with the Spanish Data Protection Authority (AEPD) or your local supervisory authority.

7. Cookies

We use the following types of cookies:

  • Essential technical cookies: Required for the site to function (session, CSRF). These include the kubo_account session cookie, which keeps you signed in in encrypted form. No consent required.
  • Analytics cookies: To understand site usage in aggregate. Require your consent.

You can manage your cookie preferences at any time via your browser settings or our cookie panel.

8. Security

We implement the following technical and organizational measures to protect your data:

  • TLS encryption in transit for all communications.
  • Encryption of sensitive data at rest.
  • Automated daily backups with 30-day retention.
  • Role-based access control (RBAC) with least-privilege principle.
  • Complete data isolation between tenants via multi-tenant architecture.
  • Continuous monitoring and periodic security audits.

9. Subprocessors

To deliver the service we rely on a small set of providers (data processors) that may process personal data on our behalf, always under contract and with GDPR safeguards. You can review the full list, with each provider's purpose and data location, in our subprocessor registry.