Who we are

Kobalt Languages, S.L. ("Kobalt", "we", "us", "our") is a Spanish private limited company providing translation and localization services to enterprise customers. This Privacy Policy describes how Kobalt collects, uses, shares, and protects personal data when you visit our website at kobaltlanguages.com, contact us about our services, or engage with us as a prospective or active customer or supplier.

Data controller:

Kobalt Languages, S.L.
Plaça Josep Maluquer i Salvador 3-4, 2a planta
08401 Granollers, Barcelona, Spain
NIF: ESB65668238

Privacy contact: privacy@kobaltlanguages.com

Scope of this policy

This Privacy Policy applies to the personal data Kobalt collects through:

  • Our website (kobaltlanguages.com), including the contact form and any related quote requests.
  • Direct business communications when you email, call, or meet with us as a current or prospective customer, supplier, or partner.
  • Our customer relationship management (CRM) systems, where we maintain business contact information about people we work with.

This policy does not cover the processing of personal data Kobalt performs on behalf of its customers in the course of delivering translation services. That processing is governed by the Data Processing Agreement Kobalt signs with each enterprise customer, in which the customer is the data controller and Kobalt is the data processor.

This policy also does not cover the privacy practices of third-party websites linked from kobaltlanguages.com. Each third party operates under its own privacy policy.

Personal data we collect

We collect personal data only where we have a legal basis to do so under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Spanish Organic Law 3/2018 on Personal Data Protection.

A. Information you provide voluntarily

  • Identification — name, job title, employer. Source: contact form, quote requests, business meetings. Legal basis: consent (Art. 6(1)(a)) or our legitimate interest (Art. 6(1)(f)).
  • Contact details — business email, phone number, postal address. Source: contact form, quote requests, business communications. Legal basis: consent or legitimate interest.
  • Service-request details — description of translation needs, languages, document types, deadlines. Source: contact form, quote requests. Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b)).

B. Information we collect automatically when you visit our website

  • Technical data — IP address, browser type, device type, operating system, referring page. Legal basis: legitimate interest in maintaining website security and performance.
  • Aggregated, anonymous usage data — page views, referrers, country, browser, device type. Collected via Umami self-hosted analytics, without cookies and without personal identifiers. Legal basis: legitimate interest in understanding aggregate website usage.

C. Information we collect from third parties

  • Business contact information from public business directories (e.g., LinkedIn), shared business contacts, networking events. Legal basis: legitimate interest in identifying and contacting prospective business customers.

We do not collect:

  • Special categories of personal data under GDPR Article 9 (racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data, health data, sexual orientation, sex life). If you voluntarily share such information with us in correspondence, we limit retention to the strictly necessary period and apply enhanced protections.
  • Personal data of minors (children under 16). Our services and website are addressed exclusively to business contacts and are not directed at children.

Purposes of processing

We use personal data for the following purposes:

  1. To respond to your enquiries and provide services. When you contact us through the website or directly, we use your contact details to reply, deliver requested information, and execute pre-contractual or contractual measures.
  2. To deliver translation and localization services. When you become an active customer, we use the contact information of your designated personnel to administer the engagement (project communications, file delivery, invoicing, contract management).
  3. To manage commercial relationships. We maintain a customer relationship management system to track business contacts, prior communications, and ongoing relationships.
  4. To improve our website and services. We analyse aggregated, non-identifying website usage data to understand which content is useful and to identify technical issues.
  5. To communicate about our services. Where we have your consent or another applicable legal basis, we may send communications about services, industry developments, or events that may interest you. You can withdraw consent at any time.
  6. To meet legal and regulatory obligations. We retain certain records (e.g., invoicing, contracts) to comply with Spanish commercial, tax, and labour law and other applicable regulations.
  7. To protect our website and systems. We process technical data (e.g., server logs, IP addresses) to maintain website security, prevent fraud, and detect or respond to incidents.

Cookies and similar technologies

The Kobalt website is built to collect as little visitor data as possible. We do not use tracking cookies, third-party advertising trackers, social media pixels, or behavioural profiling tools.

  • Analytics: we use Umami, a privacy-first analytics tool that we self-host on our own infrastructure at analytics.kobalt.es. Umami does not use cookies and does not collect personally identifiable information. It records anonymous, aggregated data such as page views, referrers, country, browser, and device type. No individual visitor can be identified or tracked across sessions.
  • Local storage: the website may use your browser's local storage to remember basic preferences. This information stays on your device and is not transmitted to us or to any third party.

Because the website does not set tracking cookies, no consent banner is required for analytics. You can still configure your browser to manage cookies and local storage at any time. A detailed Cookie Policy is published at kobaltlanguages.com/legal/cookies-policy.

Who we share personal data with

We do not sell personal data. We share personal data only with:

A. Service providers acting on our behalf (subprocessors). We engage carefully selected third-party providers to support our operations. They process personal data only on our instructions and under contractual obligations equivalent to those imposed by GDPR Article 28. Categories include:

  • Website and hosting providers
  • Email and communication platforms
  • Customer relationship management systems
  • Translation management and computer-assisted translation tooling
  • Self-hosted analytics infrastructure (Umami at analytics.kobalt.es)

A current list of subprocessors handling customer data is available on request and, for enterprise customers, is published in the Subprocessor List referenced in the Data Processing Agreement.

B. Professional advisors. External legal, accounting, and tax advisors, where necessary to comply with our legal obligations or defend our legitimate interests, under appropriate confidentiality agreements.

C. Authorities and public bodies. Where required by law (e.g., tax authorities, courts, supervisory authorities) or to comply with valid legal process.

D. Business transfer scenarios. In the event of a merger, acquisition, restructuring, or sale of all or part of our assets, personal data may be transferred to the relevant counterparty, subject to applicable confidentiality and data protection commitments.

We do not share personal data with third parties for their own marketing purposes without your consent.

International transfers

Kobalt is established in Spain and processes personal data primarily within the European Union. Where personal data is transferred to a country outside the European Economic Area (e.g., to a US-headquartered customer when administering an engagement, or to a non-EU service provider), we apply the safeguards required by GDPR Chapter V, including:

  • Transfers to countries the European Commission has determined provide an adequate level of protection (Adequacy Decisions); or
  • Standard Contractual Clauses (SCCs) approved by the European Commission under Implementing Decision (EU) 2021/914; or
  • Other lawful transfer mechanisms under GDPR Articles 46–49.

We do not transfer personal data to mainland China, Hong Kong, or Macao. This commitment is described in further detail in our Data Residency Statement, available on request.

How long we keep personal data

We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with applicable legal obligations:

  • Active customer business contact information: duration of the active engagement, plus up to 12 months for contract close-out, invoice reconciliation, and audit response.
  • Records required by Spanish commercial and tax law (invoicing, contracts): up to six (6) years from end of fiscal year, per Article 30 of the Spanish Código de Comercio and applicable tax law.
  • Prospect or unsuccessful enquiry contact data: up to two (2) years from last contact, unless the prospect requests earlier deletion.
  • Website server logs: up to twelve (12) months.
  • Aggregated analytics data (Umami, no personal identifiers): according to the retention configuration of our self-hosted Umami instance.

Following expiry of the retention period, we delete the data or anonymise it so it can no longer be linked to an individual.

Your rights

Under the GDPR and Spanish privacy law, you have the following rights with respect to your personal data:

  • Right of access (Article 15) — to obtain confirmation of whether we process your personal data and, if so, a copy of that data.
  • Right to rectification (Article 16) — to have inaccurate personal data corrected and incomplete data completed.
  • Right to erasure / right to be forgotten (Article 17) — to have your personal data deleted in defined circumstances.
  • Right to restriction of processing (Article 18) — to limit how we process your personal data in defined circumstances.
  • Right to data portability (Article 20) — to receive personal data you provided to us in a structured, commonly used, machine-readable format and to transmit it to another controller.
  • Right to object (Article 21) — to processing based on our legitimate interests, including profiling, and to direct marketing.
  • Right to withdraw consent — where processing is based on your consent, you can withdraw consent at any time without affecting the lawfulness of prior processing.
  • Right not to be subject to automated decision-making (Article 22) — including profiling that produces legal or similarly significant effects. We do not perform automated decision-making with significant effects on individuals.

To exercise your rights, contact us at privacy@kobaltlanguages.com or by post at the address listed under "Who we are" above. We will respond within one (1) month of receiving your request, extendable by up to two further months for complex or numerous requests, in which case we will inform you within the first month. We may need to verify your identity before responding to your request, to protect your data against unauthorised disclosure.

Right to lodge a complaint: if you believe we are processing your personal data in violation of applicable law, you have the right to lodge a complaint with the Spanish data protection supervisory authority:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
www.aepd.es

If you reside outside Spain, you can also lodge a complaint with the supervisory authority of your country of residence.

Security

Kobalt operates an integrated quality management system certified under ISO 9001:2015 and ISO 17100:2015, and applies the following measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access:

  • Encryption in transit (TLS 1.2 or higher) and at rest (AES-128 or higher) for personal data processed through Kobalt-controlled systems.
  • Access controls based on the principle of least privilege.
  • Multi-factor authentication for systems handling personal data.
  • A documented subprocessor management process, including written commitments from each subprocessor regarding data residency and security.
  • A documented incident management and corrective action process under ISO 9001:2015.
  • Personal data breach notification within seventy-two (72) hours of becoming aware, in accordance with GDPR Article 33.

Further information on Kobalt's security and compliance posture is available on request.

Children's data

Our website and services are addressed to business contacts and are not directed at children under 16. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, please contact us so we can delete it.

Automated decision-making

We do not use automated decision-making (including profiling) that produces legal or similarly significant effects on individuals.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The current version, with its effective date, is published on this page. For substantive changes, we will provide reasonable advance notice (e.g., website notice, email to active customers and registered users).

Contact

If you have questions about this Privacy Policy or about our processing of your personal data:

Email: privacy@kobaltlanguages.com
Post: Kobalt Languages, S.L., Plaça Josep Maluquer i Salvador 3-4, 2a planta, 08401 Granollers, Barcelona, Spain

Effective date: 1 February 2026. This Privacy Policy supersedes any previous Privacy Policy published by Kobalt Languages, S.L.