Privacy policy

Effective date: 30 September 2026

Who we are

Kobalt Languages, S.L. ("Kobalt", "we", "us", "our") is a Spanish private limited company providing translation and localization services to enterprise customers. This Privacy Policy describes how Kobalt collects, uses, shares and protects personal data when you visit our website at kobaltlanguages.com, contact us about our services, or engage with us as a prospective or active customer or supplier.

Data controller: Kobalt Languages, S.L., Avinguda Diagonal 534, entr. izq, 08006 Barcelona, Spain. NIF: ESB65668238.

Privacy contact: contact@kobaltlanguages.com

Scope of this policy

This Privacy Policy applies to the personal data Kobalt collects through:

Our website (kobaltlanguages.com), including enquiries you send us by email from it. The website has no contact form, account or newsletter sign-up.
Direct business communications, when you email, call or meet with us as a current or prospective customer, supplier or partner.
Our customer relationship management (CRM) systems, where we maintain business contact information about people we work with.

This policy does not cover the processing of personal data Kobalt performs on behalf of its customers in the course of delivering translation services. That processing is governed by the Data Processing Agreement Kobalt signs with each enterprise customer, in which the customer is the data controller and Kobalt is the data processor. It also does not cover the privacy practices of third-party websites linked from kobaltlanguages.com; each third party operates under its own privacy policy.

Personal data we collect

We collect personal data only where we have a legal basis to do so under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Spanish Organic Law 3/2018 on Personal Data Protection.

Information you provide

Identification: name, job title, employer. Source: your emails, quote requests, business meetings. Legal basis: consent (Art. 6(1)(a)) or our legitimate interest (Art. 6(1)(f)).
Contact details: business email, phone number, postal address. Source: your emails, quote requests, business communications. Legal basis: consent or legitimate interest.
Service-request details: description of translation needs, languages, document types, deadlines. Source: your emails and quote requests. Legal basis: pre-contractual measures or performance of a contract (Art. 6(1)(b)).

Information collected automatically when you visit the website

Technical data: IP address, browser type, device type, operating system, referring page, as recorded in server logs. Legal basis: our legitimate interest in maintaining website security and performance.
Usage data: pages visited, referring site, browser, operating system, device type, screen size, language and approximate country, recorded by Umami, an analytics tool we host ourselves on our own server in Germany (analytics.kobalt.es). No cookies are used. Your IP address is used only to work out the country and is not stored, and nothing is recorded if your browser sends a “Do Not Track” signal. Legal basis: our legitimate interest in understanding how the website is used and improving it.

The website does not use tracking cookies, advertising trackers or behavioural profiling. See Cookies.

Information we collect from third parties

Business contact information from public business directories (for example LinkedIn), shared business contacts and networking events. Legal basis: our legitimate interest in identifying and contacting prospective business customers.

We do not collect special categories of personal data under GDPR Article 9. If you voluntarily share such information with us in correspondence, we limit retention to the strictly necessary period and apply enhanced protections. We do not collect personal data of minors (children under 16); our services and website are addressed exclusively to business contacts.

Purposes of processing

To respond to your enquiries and provide services. When you contact us, we use your contact details to reply, deliver requested information, and carry out pre-contractual or contractual measures (for example issuing quotes or signing engagement agreements).
To deliver translation and localization services. When you become an active customer, we use the contact information of your designated personnel to administer the engagement (project communications, file delivery, invoicing, contract management).
To manage commercial relationships. We maintain a customer relationship management system to track business contacts, prior communications and ongoing relationships.
To communicate about our services. Where we have your consent or another applicable legal basis, we may send communications about services, industry developments or events that may interest you. You can withdraw consent at any time (see "Your rights").
To meet legal and regulatory obligations. We retain certain records (for example invoicing and contract records) to comply with Spanish commercial, tax and labour law and other applicable regulations.
To protect our website and systems. We process technical data (for example server logs and IP addresses) to maintain website security, prevent fraud, and detect or respond to incidents.

Who we share personal data with

We do not sell personal data. We share personal data only with:

Service providers acting on our behalf (subprocessors), who process personal data only on our instructions and under contractual obligations equivalent to those of GDPR Article 28: website and hosting providers, email and communication platforms, customer relationship management systems, and translation management and computer-assisted translation tooling. A current list of subprocessors handling customer data is available on request and, for enterprise customers, is referenced in the Data Processing Agreement.
Professional advisors (legal, accounting and tax), where necessary to comply with our legal obligations or defend our legitimate interests, under appropriate confidentiality agreements.
Authorities and public bodies, where required by law or to comply with valid legal process.
A counterparty in a business transfer (merger, acquisition, restructuring or sale of assets), subject to applicable confidentiality and data protection commitments.

We do not share personal data with third parties for their own marketing purposes without your consent.

International transfers

Kobalt is established in Spain and processes personal data primarily within the European Union. Where personal data is transferred to a country outside the European Economic Area (for example to a US-headquartered customer when administering an engagement, or to a non-EU service provider), we apply the safeguards required by GDPR Chapter V: adequacy decisions of the European Commission, Standard Contractual Clauses under Implementing Decision (EU) 2021/914, or other lawful mechanisms under GDPR Articles 46 to 49. We do not transfer personal data to mainland China, Hong Kong or Macao.

How long we keep personal data

Active customer business contact information: the duration of the engagement, plus up to 12 months for contract close-out, invoice reconciliation and audit response.
Records required by Spanish commercial and tax law (invoicing, contracts): up to six years from the end of the fiscal year, per Article 30 of the Spanish Código de Comercio and applicable tax law.
Prospect or unsuccessful enquiry contact data: up to two years from last contact, unless you ask us to delete it earlier.
Website server logs: up to twelve months.
Website usage data (Umami): kept on our own analytics server for as long as it is useful for understanding how the website is used. It does not include your IP address.

When a retention period ends, we delete the data or anonymise it so it can no longer be linked to an individual.

Your rights

Under the GDPR and Spanish data protection law you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), including to direct marketing. Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing. We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects on individuals (Art. 22).

To exercise your rights, write to contact@kobaltlanguages.com or by post to the address under "Who we are". We will respond within one month of receiving your request, extendable by up to two further months for complex or numerous requests, in which case we will tell you within the first month. We may need to verify your identity before responding.

If you believe we are processing your personal data unlawfully, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain, www.aepd.es, or with the supervisory authority of your country of residence.

Security

Kobalt operates an integrated quality management system certified under ISO 9001:2015 and ISO 17100:2015, and applies the following measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access:

Encryption in transit (TLS 1.2 or higher) and at rest (AES-128 or higher) for personal data processed through Kobalt-controlled systems.
Access controls based on the principle of least privilege.
Multi-factor authentication for systems handling personal data.
A documented subprocessor management process, including written commitments from each subprocessor regarding data residency and security.
A documented incident management and corrective action process under ISO 9001:2015.
Personal data breach notification within 72 hours of becoming aware, in accordance with GDPR Article 33.

Further information on Kobalt’s security and compliance posture is available on request.

Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or in applicable law. The current version, with its effective date, is published at kobaltlanguages.com/privacy. For substantive changes we will give reasonable advance notice.

Contact

Questions about this policy or our processing of your personal data: contact@kobaltlanguages.com, or by post to Kobalt Languages, S.L., Avinguda Diagonal 534, entr. izq, 08006 Barcelona, Spain.

This Privacy Policy supersedes any previous Privacy Policy published by Kobalt Languages, S.L.